What is Obsign?
Obsign produces verifiable proof of what your AI agents did to your systems: which human delegated, to which agent, to call which tool, with which policy verdict. Cryptographically sealed, exportable, and verifiable offline by an auditor with access to neither your infrastructure nor ours.
This is not an observability product. Observability answers “what happened?” for fifteen days. Obsign answers “prove it”, twenty-four months later, to someone with no reason to believe you.
The moving parts
Section titled “The moving parts”An agent speaks MCP to the gateway, the policy decides, the log is sealed, and the auditor verifies offline:
| Component | Role |
|---|---|
obsign-proxy | The MCP gateway: arbitrates every act against signed policy, records before forwarding |
obsign-policy | Signed policy bundles, Cedar evaluation, tool catalogue, argument rules |
obsign-identity | OIDC verification, claim mapping, RFC 8693 delegation chain, hot key rotation |
obsign-wal | Durable local log, written and fsync’d before any call goes out |
obsign-ledger | Sealing away from the gateway, checkpoints, RFC 3161 anchoring, evidence export |
obsign-control | Compiles policies from git into immutable signed releases; fleet export; read-only console |
obsign | The offline verifier, the CLI the auditor runs |
obsign-audit-core | Record format, hash chain, Merkle trees, signed sealing: the single implementation everything depends on |
What verification establishes
Section titled “What verification establishes”- No record removed, inserted or modified. The hash chain and contiguous sequence numbers cover this.
- No wholesale rewrite. Signed checkpoints, with a key held outside the writing process (KMS/HSM), close the hole a hash chain alone leaves open.
- No seal spirited away. Checkpoints are chained to each other.
- What is not proven is reported as unproven. A record covered by no valid checkpoint is flagged as such.
Verifying evidence goes through each of these in detail, along with the exit codes a scheduled job should act on.
Where to go next
Section titled “Where to go next”- Quickstart runs the gateway, seals a log and verifies it, in five minutes.
- Architecture covers how the pieces fit and why they are separated.
- Identity & delegation covers proven identity, the actor chain and machine principals.
- Open core & licensing sets out what is Apache-2.0 (everything on this page) and what is commercial.