End-to-end governance workflow.
From artifact creation through runtime governance to offline-verifiable evidence. Eight steps: 1 to 5 are the architecture, most of it in the private reference runtime, and the published gateway performs 6 to 8 for tool calls.
The gateway evaluates the call against its policy, records the decision, and signs the receipt; each aga-proxy receipt carries the SHA-256 of the policy's canonical JSON. Whether the action is blocked is an integration point wired per deployment.
This walkthrough is an illustrative trace, not a customer deployment.
Artifact Creation
Architecture: at approval time, a governance artifact encodes permitted operations, measurement rules, governance policies and a validity period, Ed25519-signed. In the published packages, aga-proxy loads a JSON policy file and signs the SHA-256 of the policy's canonical JSON into every receipt, and aga-mcp-server mints its artifact at runtime through attest_subject.
System Launch
Architecture: before the agent starts, the gateway verifies the artifact signature and its validity window. A failed check seals a denial, and the handler that blocks the launch is wired per deployment. In the request-access Kubernetes component an admission webhook performs this check for labelled pods, against the key the artifact carries and without pinning an issuer key; the published packages do not.
Initial Measurement
Architecture: the boundary computes an initial integrity measurement and compares it to the sealed baseline; a mismatch seals a denial. The published aga-mcp-server measures only when called, over content the caller supplies.
Measurement During Execution
Architecture: during execution the boundary re-measures on the schedule the artifact sets, over classes such as configuration and dependency checksums. No published package does this; it is in the private reference runtime.
Drift Detection
A measured hash that differs from the sealed one is a mismatch; the comparison is exact equality, with no tolerance band. In aga-mcp-server 3.6.0 through 3.6.2 a mismatch puts the server in QUARANTINE, recorded in process, not in the exported bundle.
Governance Decision
The boundary signs the decision into a receipt. The published gateway performs this step for tool calls: aga-proxy signs PERMITTED or DENIED for each tools/call and does not forward a call it denies (its default profile, permissive, denies nothing on policy grounds; policy denial needs --profile standard or restrictive, or a --policy file in allowlist or denylist mode; known issue 7 on /security describes the calls refused without a receipt). aga-mcp-server 3.6.0 through 3.6.2 enters QUARANTINE on a mismatch and TERMINATE on a TTL expiry found at the next measurement (in process, not in the exported bundle); a revoke_artifact call terminates it at once, and the exported bundle shows that call and every later governed call, DENIED with GOVERNANCE_BLOCKED, until the governed client calls attest_subject. That call lifts a quarantine, revocation or termination, and the exported bundle does not record it. Other handlers are integration points wired per deployment.
Receipt Generation
Each recorded decision is a signed receipt: the decision, its reason, a timestamp, the previous receipt's hash and the gateway's signature, hash-linked into a tamper-evident chain. In 3.6.0 through 3.6.2 the measurement and quarantine receipts stay in aga-mcp-server's process; the exported bundle holds the tool-call receipts.
Evidence Bundle & Verification
An export produces a portable bundle: the receipt chain, Merkle inclusion proofs, and a signed checkpoint. On aga-proxy each receipt binds the policy by hash; the policy itself is not included. Anyone can verify it offline.
End-to-end trace.
All hashes truncated. An illustrative trace of the architecture, not output from a published package.
Read the architecture behind each step.
The technology overview walks through every cryptographic primitive, every governance mode, and every verification step the gateway takes between artifact seal and evidence bundle.