Frequently asked questions
The questions engineers and DPOs ask first, answered plainly.
Yes. The standalone iaga-verify binary checks the Ed25519 signatures and the hash chain against one public key, with no database, no server, and no call home. The receipt chain works even if IAGA disappears.
Soft enforcement runs in userspace and is bypassable if the process is compromised. Hard enforcement uses eBPF/LSM kernel hooks and is trustworthy even if userspace is compromised. The open build ships soft enforcement and marks the distinction honestly in every receipt; the real kernel loader is Enterprise and roadmap.
No. The core is deterministic policy. ML models are opt-in: bring your own ONNX models in the open build, where they emit evidence and never verdicts. A curated, pre-trained model library is on the Enterprise roadmap.
No. It does not route, load-balance, or cache model traffic. It is an evidence layer that sits on top of whatever routes or enforces underneath, signing what happens. Point any SDK at the HTTP sidecar, or sign MCP tool calls.
The evidence stays in your hands, verifiable offline with no call home. The open build is BUSL-1.1 converting to Apache-2.0, so you can run it air-gapped, fork it if needed, and reduce third-party infrastructure exposure.
Copy-paste adapters ship for Claude Code, Claude Agent SDK, OpenAI (Python and TypeScript), OpenAI Agents, Vercel AI, LangChain, LangGraph, CrewAI, AutoGen, LlamaIndex, Microsoft Agent Framework, and PydanticAI, plus an MCP adapter, a generic template, a Rust client crate, and two released packages: VoltAgent on npm and Letta on PyPI. Every tool call gets one signed receipt. Enforcement is consistent within each SDK (allow runs; review and block both raise), but the failure default is not uniform: the Python and TypeScript SDKs fail open on transport errors and are configurable to fail closed, while the VoltAgent and Letta plugins and the MCP proxy fail closed. The Claude Code hook maps review to a human 'ask' prompt rather than a hard stop.
Yes. The cost-control feature is on by default since 1.8.1. Token and dollar spend is priced locally against a built-in pricing table (no external billing API), lands in the signed receipt and the audit ledger, and surfaces through /v1/cost/*, the dashboard, and iaga cost. Session budgets are enforceable in Dictum, stricter-wins. Receipts stay byte-identical when no usage is reported, so determinism is preserved.
The open verifier needs no network at all. Packaged air-gapped distribution, with signed offline update bundles, is on the Enterprise roadmap.
The open build is source-available under Business Source License 1.1, with a Change License of Apache-2.0 and a Change Date four years after each release is published. The conversion is written into the license itself.