IAGA Sentinel
View on GitHub · 174
ENFR
Docs

OSS vs Enterprise

GitHub · ★ 174

The conceptual governance kernel is the open build. Enterprise adds modules that require specialist engineering at scale, in a separate commercial repository.

Ships in the open build today

Verifiable from a clean checkout. cargo test --workspace and cargo build --release cover the default feature set; the items below that name a Cargo feature need --all-features or that flag explicitly:

  • 8-layer governance pipeline, single binary, one endpoint (POST /v1/inspect)
  • Ed25519 signed receipts + hash-chained append-log per run
  • iaga-verify: standalone offline verifier (Rust), no database, no server, no call-home
  • Dictum policy language + Hindley-Milner type checker, live overlay
  • Soft enforcement (cross-platform UserspaceKernel) with secret scrubbing on iaga run
  • MCP governance: a stdio proxy in front of a server you launch through it, gating tools/call, plus GovernedTool wrappers
  • Copy-paste adapters for a dozen frameworks, plus two released packages (VoltAgent on npm, Letta on PyPI), Python + TypeScript SDKs, and a Rust client crate
  • Cost control on by default (since 1.8.1): local pricing, budgets, response cache
  • BYOK signer (Signer trait, LocalDiskSigner)
  • SQLite by default, Postgres behind the postgres feature
  • OpenTelemetry receipt export (otel-receipts feature)
  • WASM plugins with offline Sigstore + SBOM attestation and signed manifests (plugins, plugin-attestation, plugin-manifest-signing features)
  • Operator Console served from the binary: multi-view, live charts, downloadable audit reports (CSV / JSON / PDF)
  • Optional fail-closed receipts (IAGA_SENTINEL_RECEIPT_FAIL_CLOSED, default off): a receipt that cannot be signed fails the call instead of returning a verdict with no evidence
  • workspaceId / tenantId derived from the agent profile, never from the request body: a mismatched claim gets 403 scope_mismatch
  • Dictum policy paths validated at load: iaga serve --policy exits 2 naming the bad path and the valid roots
  • Helm chart + Kubernetes manifests, signing key on a writable volume so the root filesystem can stay read-only

What Enterprise adds

These modules live in a separate commercial repository. Some are still in development; treat them as commitments, not open-build features.

  • eIDAS qualified signatures via a qualified trust service provider Enterprise · planned
  • Annex IV dossier generator (Article 11 + Annex IV) Enterprise · planned
  • RoPA / DPIA / post-market monitoring Enterprise · planned
  • DPO dashboard: review queues, SLA timers, signed approvals Enterprise
  • SIEM export (CEF / ECS / OCSF) with Splunk HEC and Microsoft Sentinel shippers Enterprise
  • Real Aya-rs eBPF/LSM loader (hard enforcement) Enterprise · planned
  • macOS Endpoint Security + Windows ETW/WFP backends Enterprise · planned
  • Enterprise SSO (SAML / OIDC / SCIM) Enterprise · planned
  • Air-gapped distribution Enterprise · planned
  • Curated ML model library (intent-drift, prompt-injection) Enterprise · planned
  • Native KMS SDK signers (AWS KMS, Azure Key Vault, Vault, PKCS#11) Enterprise
  • Governance mesh (multi-region active-active) Enterprise · planned
  • Semantic response caching Enterprise · planned

The open-core promise

The conceptual governance kernel is the open build: the receipt schema, the replay algorithm, the Dictum evaluator (with WASM codegen and the Hindley-Milner type checker), the reasoning framework with BYO ONNX, the UserspaceKernel soft enforcement, the BYOK signer pattern, the Sigstore plus SBOM plugin attestation primitive, receipt input capture, and the cost-control primitives. None of the Enterprise modules shipped in 1.0 GA, so moving them to Enterprise does not violate the never-retroactively-remove-from-the-open-build covenant. The public boundary is documented in ADR 0010.

License, in plain English

The open build is source-available under BUSL-1.1 with a Change License of Apache-2.0 baked into the license itself:

  • You can run, copy, modify, and redistribute IAGA Sentinel freely for internal use, research, evaluation, and any non-production use.
  • You can run it in production as long as your use does not consist of offering IAGA Sentinel itself to third parties as a hosted or managed service that exposes a substantial set of its features. Building your own product on top of it for your customers is fine.
  • Four years after each release is published, that release converts automatically and irrevocably to Apache-2.0. The conversion is written into the license, so it is not something that can be walked back later.

Source-available is not the same as OSI open source. The BUSL term is deliberate: it stops a third party from reselling IAGA Sentinel as a hosted service, while guaranteeing every release becomes true open source on its Change Date. You can run it air-gapped and keep it even if IAGA disappears. The full text is in LICENSE.