Overview

What it is

Agents now touch the shell, the filesystem, databases, third-party APIs, and secrets. When a regulator, an auditor, or your DPO asks you to prove what an agent did, most teams have nothing to show. IAGA Sentinel produces that proof. Every governance verdict becomes an Ed25519-signed receipt linked into a hash-chained append-log, verifiable offline by checking Ed25519 signatures and hash-chain links against one public key, structured to line up with EU AI Act Article 12 (record-keeping). Turning that chain into an Annex IV technical-documentation dossier is Enterprise · planned.

Three things in one binary

• A kernel. Process launches go through iaga run, which consults the governance pipeline before spawning. The HTTP sidecar still works for SDK-aware agents.
• A signed log. Every governance verdict produces an Ed25519-signed receipt linked to the previous one in a hash-chained append-log, per run. Replay re-verifies the whole signed chain offline.
• A reasoning brain. Optional ONNX models emit evidence, never verdicts. The deterministic risk engine decides, under fixed risk weights; ML produces scores the policy can read.

Verdicts can be tightened with Dictum: a typed policy DSL with deterministic tree-walk evaluation and a Hindley-Milner type checker, loadable as a --policy overlay on top of the YAML profile system. The overlay merges stricter-wins, so it can only narrow what the engine already decided.

What the recent releases added

• 1.9.2 — a policy typo no longer blocks everything. A Dictum policy that referenced a context path which does not exist — a typo like action.risk_score instead of risk.score — used to load without complaint and then block every action, including ones the policy had nothing to do with, showing reasons that pointed back at the baseline. Two example policies shipped in the repository had exactly that bug. Now iaga serve --policy validates every path against the context the pipeline actually builds and exits with code 2, naming the path and the valid roots. The fail-closed rule is unchanged and deliberately so: an attacker must not be able to disable a guard by making it error. What changed is that a writing mistake no longer reaches the point where that rule applies. The two examples (no_pii_egress.dictum, strict.dictum) and the sample_context.json fixture were corrected, and a test now fails if the accepted schema and the constructed context ever diverge again. Receipts, the wire contract, and the Dictum language are unchanged: 1.9.0 and 1.9.1 receipts verify without modification.
• 1.9.1 — a bootstrap manual. One file, AGENTS.md: a self-sufficient path from a clean checkout to build, dashboard, MCP connection, and offline receipt verification, for a human or an LLM agent. No code changed. It also corrected how the Dictum runtime was documented, verified against a live server rather than read from the source: policy attribution lives in auditEvent.reasons, not risk.reasons; policy_hash is the SHA-256 of the compiled AST, not of the file bytes; and the usage object requires provider and model.
• 1.9.0 — evidence integrity and deployment. Closing an external code review, three things stopped being best-effort. Receipts can now fail closed (IAGA_SENTINEL_RECEIPT_FAIL_CLOSED): normally a receipt that cannot be signed leaves a gap between the SQL audit trail and the signed chain while the verdict returns anyway, and with the variable on the call fails instead of returning a verdict with no evidence. Default off, so 1.8.1 stays byte-for-byte identical, and the limits are documented openly (the audit row is written before the receipt, so a crash in between still diverges). workspaceId and tenantId are no longer taken from the request body: they derive from the agent profile, and a request declaring a different one gets 403 scope_mismatch instead of being evaluated against that workspace's thresholds and allowlists. Unparsable config is now fatal, where before it logged a warning and continued with zero profiles, looking configured while governing nothing. Plus a Helm chart and Kubernetes manifests, with the signing key on a writable volume so the root filesystem can stay read-only.
• 1.8.1 — a rebuilt Operator Console, and cost control on by default. The dashboard is now a structured multi-view app (strict monochrome, live charts) with downloadable audit reports as CSV, JSON, or a print-pipeline PDF, scoped to the whole fleet or a single agent. Cost and model visibility ship out of the box: the cost-control feature is on by default, and receipts stay byte-identical when no usage is reported, so the determinism guarantee is preserved.
• 1.5.6 — Dictum. The typed policy language formerly called APL is now Dictum end-to-end: .dictum files, the iaga-sentinel-dictum crate, the dictum build feature, and a dictum[…] reason on every signed receipt. The rename is behavior-preserving: the receipt wire format stays byte-identical and .apl / --apl keep working as aliases. The release also ships a self-contained “Test Me Now” demo kit.
• 1.5.4 — the policy enforces what it promised. Dictum’s secret_ref() now detects real credentials and PII inside a payload, and a new url_host() builtin gives policies a per-host egress allowlist. Every block or review carries its cause into the audit event and the signed receipt, and receipts hash-chain across a whole session into one tamper-evident chain.
• 1.5 — cost control. LLM token and dollar spend is priced locally (no external billing API), captured into the signed receipt and the audit ledger, and surfaced through /v1/cost/*, a dashboard panel, and iaga cost, with per-session budgets expressible in Dictum and a deterministic response cache. Shipped default-off in 1.5; on by default since 1.8.1, with receipts byte-identical when no usage is reported.
• 1.4 — the integration surface. Copy-paste adapter examples across a dozen frameworks (Claude Code, Claude Agent SDK, OpenAI, LangChain, LangGraph, CrewAI, AutoGen, LlamaIndex, Vercel AI, Microsoft Agent Framework, PydanticAI) plus an MCP adapter and a lightweight Rust client crate.

An honest posture

IAGA Sentinel enforces softly and certifies hard. The signed evidence and the offline verification are real now, from a clean checkout on the default feature set. Authoritative kernel-level enforcement (eBPF/LSM) is not in the open build; it lives on the Enterprise roadmap, and iaga kernel status says so by reporting authoritative: no. Until that ships, the value here is the proof, not the block. We do not market enforcement we do not provide.

The proof does not depend on us. Anyone can verify a receipt chain offline against one public key, with no call home and no trust in IAGA required. The evidence is cryptographic, not testimonial.

What makes it different

• Proof, not testimony. Ed25519 hash-chained receipts, verifiable offline against one public key, with no call home.
• Honest posture. Soft enforcement is stated in the evidence itself (is_authoritative: false); iaga kernel status reports authoritative: no. We do not market enforcement we do not provide.
• Sovereign by deployment. Runs on infrastructure you choose, with no call home at runtime; BUSL-1.1 converts to Apache-2.0; no IAGA-operated service ever holds a copy of your evidence.
• EU AI Act-shaped. The receipt lines up with Article 12 logging and is shaped to feed the Annex IV technical documentation a high-risk system needs by 2 December 2027 for standalone high-risk systems, and 2 August 2028 for those embedded in regulated products, following the 2026 Digital Omnibus deferral.

Where to go next

• How it works: receipts, the hash-chain log, and offline verification.
• EU AI Act mapping: Article 12 and Annex IV, obligation by obligation.
• Quickstart: three commands to a signed, offline-verifiable verdict.
• Tutorial: from zero to verified evidence, in 16 parts, including troubleshooting.
• Reference: Cargo features, the CLI, environment variables, and the HTTP surface.
• The source is on GitHub, source-available under BUSL-1.1.