Trust control plane for autonomous AI agents
Issue signed passports, verify risky actions before they run, and keep a tamper-evident record of every decision — all in one place.
How it works
Five stages, one loop. Every stage below is a live API in this build — the guided demo walks all of them with real calls against a real ledger.
- 1Register
An agent is issued a signed passport and a bill of materials: models, tools, scopes, risk tier, and a named responsible human.
- 2Attest
Before it acts, the agent presents runtime evidence that it is the code you approved, on hardware you accept.
- 3Verify
Each proposed action is scored against the policy the business set once — allow, log, step up, hold for a human, or isolate.
- 4Contain
A failed verdict opens an incident and can pause, isolate, or divert the agent into a sandbox that studies its intent.
- 5Prove
Every step lands on a hash-linked ledger with signed receipts an auditor can verify without trusting your database.
Guided demo
One tenant, three agents, and a full trust lifecycle. Every step is a real API call — nothing is pre-recorded.
Not started
Recent decisions
No actions verified yet. Load the guided demo or register an agent to begin.
Needs attention
Nothing waiting on a human right now.
Agents
Every agent gets a signed passport and an Agent Bill of Materials the moment it is registered.
Register an agent
Inventory
No agents yet.
Verify & simulate
Score a proposed action against the active policy, optionally enforce the verdict at runtime, or run a what-if simulation without an agent.
Proposed action
Decision
Submit an action to see a signed decision.
What-if risk simulator
no agent neededEvidence
Cryptographic proof for the selected agent — passport, bill of materials, hash-linked ledger, signed memory, and zero-knowledge-style proofs.
Select an agent from the view to inspect its evidence.
Forensic timeline
Every recorded event for this agent in one chronological view — decisions, attestations, memory writes, proofs, approvals, incidents, and trust grants. Each row carries the hash or signature that makes it independently checkable.
Loading timeline…
Memory integrity
Proof commitments
Selective disclosure
Share only the passport fields a counterparty needs — signed, minimal, verifiable.
Lifecycle
Revoking an agent invalidates its passport immediately. Use for compromised or decommissioned agents.
Config snapshot & restore
Capture the agent's policy / intent / permission-state config as a restorable snapshot, or restore a prior snapshot by id (reissues the passport).
Governance
Set the thresholds that decide allow / challenge / approve / isolate, test policy-as-code, and work the human queues.
Create policy
Policies
No policies loaded.
Draft policy-as-code rules from plain English
Deterministic and local — reads the same phrase vocabulary as the , but produces deny / require-approval rules for the evaluator below instead of trust-score thresholds. Never auto-activated; requests to bypass or disable controls are rejected outright.
Policy-as-code evaluator
Write deny when path > value rules, one per line. Evaluated against the input JSON below.
Approval queue
No approvals waiting.
Containment enforcement
What containment can actually do here. A dry run exercises cluster RBAC and admission but stops nothing — read this before relying on an isolate.
Loading…
Containment incidents
No containment incidents.
Containment actions
Every attempt, what it actually enforced, and the failure reason when a connector did not take effect.
No containment actions.
Open a sandbox session
Terminating a compromised agent ends the investigation with it. A sandboxed agent keeps calling tools and keeps getting plausible successes — every call recorded, nothing reaching a real system.
The sandbox only answers calls the trust engine or the firewall already refused. It can never let an action through.
Sessions
No sandbox sessions.
Observed intent
Select a session to see what the agent kept reaching for.
Draft a threshold policy from plain English
Deterministic and local by default — no model call, no network, reproducible. Every threshold comes with the phrase that produced it. Sets allow/challenge/approval/isolate scores; for deny/require-approval from the same kind of prompt, use the Policy-as-code tab.
Root-cause reports
Generated from recorded facts only — every line traces to a ledger row, which is what makes the report usable as evidence rather than commentary.
No reports yet. Generate one from a containment incident.
Create / update agent group
Groups apply a shared loss ceiling, denied scopes, and allowed tools across their members at verify time.
Agent groups
No agent groups.
Trust graph
How agents, tools, memory, and decisions relate across your tenant.
No graph nodes yet.
Intel & interop
Reputation indicators, hardware attestation, and agent-to-agent trust negotiation (AITP).
Add reputation indicator
Verify attestation
providers: —Indicators
No indicators yet.
Agent-to-agent negotiation
Federation partners & consent
Register trusted partner domains, then grant scoped, revocable consent before sharing evidence bundles (PC-43).
No federation partners yet.
Operations
Access accounts, identity provisioning, evidence exports, signing, tracing, and system status.
Service accounts
Evidence exports
SCIM users
SCIM groups & SSO
OIDC single sign-on
Loading…
Register SIEM / IAM / CSPM integration
Register an outbound integration and mapping. A registered, enabled, https SIEM destination is required before SIEM export (SSRF guard).
Integrations
No integrations configured.
System status
Loading…
Request traces
No traces captured yet.
Onboard beta tenant
Readiness
No beta tenants.
Platform & compliance
The six TrustChain product requirements, each scored against what this deployment can actually do — plus how those controls map to NIST AI RMF, the EU AI Act, and DORA.
Loading capability posture…
Trust engine settings
Per-tenant overrides for the trust-score signal weights and the trust-decay curve. Each field shows the platform default; edit a value to override it for this tenant. Admin only.
Loading…
Semantic firewall
Scores each tool call against the agent's declared Intent DNA and denies a divergent one before execution. Off by default — characterize it on your own traffic with npm run drift:eval before enabling, then verify the enforcement point in the proxy runbook.
Loading…
Attestation trust policy
What this tenant will accept as proof that an agent runs untampered code. Evidence is refused unless it verifies against a registered provider root and matches an active measurement. Admin only.
Loading…
Trusted provider roots
Root certificates (AWS Nitro) or JWKS documents (Azure MAA, GCP Confidential Space) that evidence must chain to. Retiring a root keeps it on past attestations for audit.
Loading…
Approved measurements
Known-good enclave images. Every field pinned here must match the attested value, so pinning more fields is strictly stricter.
Loading…
Ledger epochs
Decisions are batched into Merkle epochs. Publishing an epoch root to an external transparency log is what makes a rewritten decision detectable by someone other than us.
Loading…
Inclusion proof
Prove one decision was in the ledger when its epoch was sealed. Download the JSON and verify it offline with node scripts/verify-inclusion.mjs proof.json — no database access needed.
Verifiable credential passport
Issue the agent's passport as an SD-JWT-VC a counterparty can verify with the published DID document — including withholding fields they do not need.
Verify a credential
Paste a credential from any deployment. A third-party credential also needs the issuer's JWK from their DID document — an unresolvable issuer fails closed rather than trusting a key carried inside the credential.
BYOK envelope encryption
Require memory to arrive already encrypted under a data key wrapped by your own KMS. TrustMesh then holds ciphertext it cannot read — which also disables the server-side features that need plaintext.
Loading…