DORA
Articles 9 to 12 require ICT logs whose integrity and traceability hold up under examination. An agent acting on production is an ICT operation like any other.
Enforceable audit log for AI agents
Prove what your agents did.
To someone with no reason to believe you.
Which human delegated, to which agent, to call which tool, with which verdict. Sealed, exportable, verifiable offline.
$ obsign-proxy --policy policy-bundle.json
identity PROVEN u:marie.dupont via sso.acme.fr
REFUSED delete_production_db forbid_destructive_prod
$ obsign verify evidence.json --trusted-keys keys.json
✓ 15/15 records · hash chain intact
✓ checkpoint ed25519 ok · anchor rfc3161
root 9f2ca41d07b6e5d3 · exit 0
$
Apache-2.0 core air-gap ready chain intact
01
Agent incidents, on the record
Your AI agent can turn on you.
-
One word: “Additionally”
A workflow that answered issues from anyone read a private repository and posted its contents straight back as a public comment, using the tool it had been given to reply with. The attacker needed no code, no credentials and no access.
Source · Noma Security ↗ -
Nine seconds
A Cursor agent running Claude Opus 4.6 picked up an unrelated Railway token and deleted the production volume along with every backup at that level. The most recent usable copy was three months old, and the account of the incident was the confession the agent wrote about itself.
Source · The Register ↗ -
terraform destroy
Working from a new machine with a stale state file, the agent judged destroying through Terraform “cleaner and simpler” than the AWS CLI, and took out the VPC, the ECS cluster, the database and its automatic snapshots. One table alone held 1,943,200 rows.
Source · Alexey Grigorev ↗ -
Two accounts of one outage
The Financial Times reported, from internal sources, that an in-house coding agent had caused production outages; Amazon answered publicly that the Cost Explorer outage came from a misconfigured role, “not AI as the story claims”. Nothing published lets an outsider settle it.
Source · Amazon, Financial Times ↗ -
An issue title
The triage agent ran inside GitHub Actions with
Source · Adnan Khan, SafeDep ↗BashandWrite, and the issue title reached the model verbatim. The chain ran from there to code execution, then to the publishing tokens of an extension with five million installs; the hole stood open about fifty days. -
The first malicious MCP server
A copy of a legitimate MCP server, published on npm, added one line at version 1.0.16: a blind copy of every message sent, to an address belonging to its author. 1,643 downloads before removal: password resets, invoices, internal mail.
Source · The Hacker News ↗ -
A pull request, a wiper
An attacker got a pull request merged that placed destructive instructions in the assistant’s system prompt: clear the system to a near-factory state, delete the cloud resources. The version shipped to a marketplace with around 950,000 installs before being pulled.
Source · BleepingComputer ↗ -
During a code freeze
The agent destroyed a database of 1,200 executive profiles and 1,190 company records during an explicit code freeze, then fabricated users and reported test results that were false. Its operator had told it not to, eleven times, in capitals.
Source · The Register ↗ -
“I have lost your data”
A
Source · gemini-cli issue #4586 ↗mkdirfailed silently, the agent carried on as though the folder existed, and renamed every file onto the same destination, overwriting all but the last one. Its own account: “I have failed you completely and catastrophically.” -
A hostile server, a shell
CVE-2025-6514, rated 9.6: a malicious MCP server could inject system commands through a forged authorisation response and execute code on the client machine. Versions 0.0.5 to 0.1.15 were affected, the proxy that desktop AI clients use to reach remote servers.
Source · JFrog ↗
And how many cases never made the news? ↓
02
Enforceable today
Three texts, one requirement.
NIS2
Logging and integrity obligations run down the whole subcontracting chain, reaching entities that never had a regulator before. The evidence pack is the same artefact on both sides of the contract.
ANSSI / SecNumCloud
The gateway makes no outbound call, keys arrive as signed files, and time is anchored by file exchange. Built for those constraints, not certified against them.
How to certify what your AI agents do ↓
03
Certifying an act, in four steps
Between the call and the verdict,
four acts.
The agent speaks MCP to obsign-proxy. Identity proven by OIDC, every act evaluated against signed Cedar policy, method space default-deny in both directions. A refused call never reaches the server.
The record is written and fsync'd before the call is forwarded. Delegation, decision, and effect chain by construction; the log keeps argument hashes, never contents.
obsign-ledger runs elsewhere, reads the log without writing to it, and seals with a key the gateway never sees, held in an HSM in production. Checkpoints anchor at an RFC 3161 authority.
One self-contained evidence pack. The auditor runs obsign verify (~31 crates, buildable from source, no network) and gets a machine-checkable verdict.
All of it turns on what the rule says. ↓
04
Rules, not instructions
A prompt asks.
A policy arbitrates.
policies/tools.cedar
- // deny wins over permit, and what nobody permits is refused.
- @id("forbid_destructive_prod")
- forbid (principal, action == Action::"tool_call", resource)
- when { resource.destructive && context.env == "prod" };
- @id("forbid_robot_destructive")
- forbid (principal, action == Action::"tool_call", resource)
- when { resource.destructive && !context.has_human_delegation };
- @id("allow_scoped")
- permit (principal, action == Action::"tool_call", resource)
- when { context.scopes.contains(resource.required_scope) };
- @id("support_channel_only")
- forbid (principal, action == Action::"tool_call", resource == Tool::"send_message")
- when { context.args.channel != "#support" };
$ obsign-control compile --source ./policies --key-id ops-2026
✓ schema in step with tools.json
✓ 4 rules type-checked · 0 unreachable
✓ policies@9f2ca41 signed ed25519 · ops-2026
The arbitration happens outside the agent’s reasoning loop. ↓
05
Proof, not observability
A screenshot of a dashboard
convinces nobody.
| Trace collection | Obsign | |
|---|---|---|
| Question | “What happened?” | “Prove it.” |
| Horizon | a retention window, read by your teams | years later, read by a hostile third party |
| Control | observes after the fact | refuses before the call is forwarded |
| Evidence | no artefact that survives being contested | a pack that verifies offline, with no network |
| Trust required | the reader has to take your word for it | none: they check the maths themselves |
Which leaves how. ↓
06
The path of one record
The hash chains.
The key attests.
What happens to it
seq=42 · args_hash
Written and persisted before the call is forwarded. Arguments enter as hashes; their values stay with you.
prev_hash → hash
Each record carries the fingerprint of its predecessor, on contiguous numbers. Nothing inserts, nothing disappears.
checkpoint · Ed25519
A checkpoint is signed by a key the writing process never holds. That is what makes a wholesale rewrite detectable.
RFC 3161 · tsr
The checkpoint fingerprint is timestamped by a third party. A signature proves who sealed; only the anchor proves when.
The keys it takes
-
The sealing key
Ed25519 · PKCS#11 · --key-id seal-prod
Lives in an HSM behind PKCS#11 and never enters the ledger process. A compromised host can sign now, not re-seal history later.
-
The timestamping authority
RFC 3161 · --tsa tsa.internal.acme.fr
Countersigns the checkpoint fingerprint. Its whole job is to be somebody else, so that a key holder cannot backdate.
-
The policy key
obsign-control --key-id ops-2026
Signs the Cedar bundle. The rule id quoted in a decision points back at the bundle that was in force.
-
The auditor’s trusted keys
obsign verify --trusted-keys keys.json
Obtained outside the pack, through another channel. Without them verification returns exit 3: consistent, but unproven.
Without the keys, a pack proves only itself. ↓
07
What the auditor reads
One file goes to the auditor.
Export
$ obsign-ledger export --chain-id prod --out evidence.json
✓ 15 records · 1 checkpoint · 1 anchor · 1 key
evidence.json · 41 KB · self-contained
The pack (extract)
evidence.json
- {
- "chain_id": "prod",
- "records": [
- { "seq": 3, "kind": "tool_call", "tool": "delete_production_db",
- "actor": "support-copilot", "on_behalf_of": "u:marie.dupont", "args_hash": "b7c1…9f" },
- { "seq": 4, "kind": "decision", "outcome": "deny", "policy_id": "forbid_destructive_prod" }
- ],
- "checkpoints": [
- { "seq": 15, "root": "9f2ca41d07b6e5d3", "key_id": "seal-prod", "sig": "ed25519:…", "anchor": "rfc3161" }
- ],
- "keys": [ { "key_id": "seal-prod", "alg": "ed25519", "pub": "…" } ]
- }
Verify
$ obsign verify evidence.json --trusted-keys keys.json
✓ 15/15 records · hash chain intact · seq contiguous
✓ checkpoint ed25519 ok key_id=seal-prod · anchor rfc3161 ok
PROVEN root 9f2ca41d07b6e5d3 · exit 0
The verdict is not yours to give. ↓
08
Designed for the security review
Where Obsign sits
obsign-control
Compiles the policy source and signs the bundle. It decides nothing at runtime: what the gateway loads is a signed artifact, and the rule id in a decision points back at it.
The human
Proven by your IdP over OIDC. Their token is the root of the delegation chain, and it is what tells a destructive act with somebody behind it from one without.
The agent
Speaks MCP and nothing else. It never holds a credential for the tools, and a refusal reaches it as a protocol error it cannot argue with.
obsign-proxy
The only path between the agent and its tools. Default-deny in both directions, evaluation outside the model’s reasoning loop, and the record written before the call is forwarded.
The MCP servers
Your own tools, unmodified. They are reached only through the gateway, which is what makes the log complete rather than best-effort.
The WAL
The gateway’s only output, and it holds no key. Append-only, fsync’d before the call goes out: a crash loses the call, never the record of it.
obsign-ledger
Runs on another host, reads the WAL without writing to it, and seals with a key kept in an HSM. It detects a rewritten log rather than certifying it.
The HSM
Holds the sealing key and signs on request over PKCS#11, a local library call, so the ledger still makes no network call. The key never enters a process anyone can read.
The timestamping authority
Stamps the checkpoint fingerprint by file exchange: a request out, a token back, nothing listening. A signature proves who sealed; this is what proves when.
The auditor
Outside your infrastructure and outside ours. Builds the verifier from ~31 crates, runs it with no network, and gets an exit code rather than a screenshot.
Owning the gateway does not rewrite sealed history. ↓
09
Objections
“We already have audit logs.”
They live in a database your teams can modify, with a retention window of a few weeks, inside the very infrastructure being questioned. They answer “what happened?” internally. They do not answer “prove it” to someone with no reason to believe you. The difference is not how much information you hold. It is who can contest it.
“Just scope the tokens.”
You should, and it is not enough. A scoped token authorises a service, not an argument: it cannot tell
send_message to #support from send_message to #all-hands. It does not record which human delegated to which agent. And it produces no evidence: after the incident, a correctly scoped token does not tell you what was attempted. Obsign does not replace least privilege. It arbitrates at the level of the act and keeps an enforceable record of it.“Our agents don’t go through MCP (yet).”
That is less and less true: your infrastructure providers are shipping MCP servers one after another, and Railway opened its own two days before the PocketOS incident. The gateway wraps any MCP server, as a child process or as a shared HTTP service, and deploys as a mandatory proxy: network policy allows only its egress. A call that bypasses it shows up as a configuration incident you can detect and fix.
“Another vendor to trust with our most sensitive data.”
Obsign receives nothing. The gateway makes no outbound network call, the log keeps hashes and never contents, and the core is Apache-2.0: you will build the verifier from source and verify without us. An air-gapped site works identically.
“How is this different from our SIEM?”
A SIEM collects and correlates what your systems report, to detect. Obsign attests: it arbitrates the act before it happens and produces a sealed record whose integrity is established outside the system that wrote it. The two stack: ship the gateway’s alerts to the SIEM, hand the evidence pack to the auditor.
“We could just sign our own logs.”
Signing a line says nothing about what surrounds it. It does not survive a truncation, a replay, a re-signature after the fact, or a stolen signing key. It carries no delegation chain either, so it cannot say which human stood behind the agent. What closes those holes is a chained log, checkpoints signed by a key the writer never holds, external time anchoring, and a verifier someone else can build. That takes a product, not a line of code. The core is open, so audit it instead of believing us.
“Does it slow the agents down?”
One durable write per act, before the call is forwarded: an
fsync, not a network round trip. Sealing runs on another host, asynchronously, off the critical path, so an agent never waits on a signature. The cost sits on the write path and is bounded by design. Measure it in your own environment; a number on a website would not tell you much.“What about prompt injection?”
The dangerous form is the indirect one. The instruction does not come from your user; it arrives inside something the agent reads, an issue, an e-mail, a supplier’s page, and by the time it is read it is indistinguishable from work. Obsign does not try to read the agent’s mind, and no vendor should claim to. What it does is bound what the agent is able to do: signed policy, argument-level, default-deny, enforced outside the reasoning loop. A manipulated agent still cannot step outside the policy, and the attempt is recorded as a refusal.
“We are not regulated enough for this.”
The question never comes up before the incident. It comes up the next day, when a customer, an insurer or an authority asks what happened, and the retention window on your traces has already closed. Installing Obsign costs a day of integration. Not having had it is measured on the day your only available account is the one an agent wrote about itself.
“What does it cost?”
The core is Apache-2.0 and stays that way. Gateway, policy, sealing, verifier: you will be able to run the whole critical path without paying anyone. Support and compliance are priced on scope, and that conversation belongs on a call. Start with one real agent flow.
10
Complete and verifiable without us
The core, without us.
The rest, with.
Support & compliance
For teams that answer auditors and regulators across a fleet, not one agent. Separate code, separate licence, and the core keeps working without it.
-
Compliance report packs
The evidence pack laid out as a file an auditor reads: scope, period, verdicts, and the command that checks it again.
-
RBAC & SSO for the console
Who reads what, by role and by scope, tied to your directory rather than to a second list of accounts.
-
Long-term retention
Sealed chains kept and replayable years later, past the window an operational store is built to hold.
-
Onboarding & priority support
Put behind one real agent flow, with someone who knows your deployment when the auditor calls.
sealed · timestamped · offline-verifiable
Your agents are already acting on your systems.
Start being able to prove what they did.
Start with one flow
A scoped pilot on one real agent flow, in your environment: the policy written with your security and audit people, the gateway on the path, and a verification replayed in front of your internal audit. The pack is sealed on your side and checked on theirs, with no access to your infrastructure.
- sponsored by security or internal audit
- agents already calling real tools
- a regulated estate, air-gapped or not