provenza

Provenance for every AI action.
_{See and govern every AI in your company — with provable accountability.}
From an employee pasting into ChatGPT to autonomous agents acting on their own —
watch it, control it, and prove every decision was authorized. Self-hosted, no external SaaS.

👀 Live demo  ·  🚀 Deploy  ·  ✨ Why it's different  ·  🧩 Features  ·  📖 Docs

AI entered your company through every door at once — shadow AI on laptops,
autonomous agents delegating to each other, and no way to prove who authorized
what. Most governance tools watch one door. Provenza covers them all,
under one set of rules.

👀 Try the live demo

stickstock.lol — organization demo, e-mail [email protected],
password provenza-demo. A read-only login to a demo bank: agents with their own
keys, a signed delegation chain, denied and held actions, a refused privilege
escalation, AI tools found on employees' laptops. Open an action and check its
signature in your browser. The data is made again every night.

🚀 Deploy on your server

Requirements: Linux with systemd (Ubuntu 24.04+, Debian 13+, RHEL/Rocky 9.3+
or Fedora), 4 GB RAM, a domain pointing at the server. The installer sets up
Podman itself.

git clone https://github.com/kironovlaziz-del/provenza.git /opt/provenza
cd /opt/provenza
sudo ./install.sh

The installer asks for your domain and the first administrator, generates every
secret, runs the stack as rootful Podman containers managed by systemd (Quadlet),
gets an HTTPS certificate and schedules a daily backup.
It also puts the egress proxy and the endpoint agent on the server, with their keys -
nothing to copy from the interface; add --sensor for the eBPF egress sensor.
Upgrades are one command, sudo provenza upgrade: it backs up first and rolls back if the
new version does not come up. Full guide: docs/self-hosting.md.

Connect an agent from the interface: Agents → New agent → Connect an AI client
gives one command for the machine where Gemini CLI, Claude Code, Cursor or any
OpenAI-compatible client runs. The agent's keys are made there and never leave it.

Govern egress on another Linux host: Runtime → Register sensor gives a
one-line command that downloads the sensor from your Provenza (no Go, no git there).

Just looking? On your own computer, not a server (demo password, development
secrets): docker compose -f docker-compose.dev.yml up --build - or podman compose
with Podman - then http://localhost:3000 with organization demo, [email protected] /
demo12345 (development guide).

✨ What makes it different

🔐 Verifiable Agent Governance

When one AI agent delegates a task to another, the delegating agent signs the
handoff — the delegated capabilities, the TTL, a single-use nonce and a timestamp —
with Ed25519, or with a post-quantum hybrid key (Ed25519 and ML-DSA-65,
FIPS 204), where both signatures must verify. With agent-held keys, Provenza
stores only the public key, so it cannot sign in the agent's name. Recorded agent
actions are signed the same way and bound to the policy check that allowed them.

Proof that does not depend on trusting Provenza: download the evidence for any
delegation or action and check it offline with tools/provenza_sign.py or plain
OpenSSL, against the key fingerprint the agent's owner gave you. On the live
delegation map, click an edge to run the same check in your browser.

This is the kind of verifiable accountability the EU AI Act asks for — made
clickable (how it works). What it does and does not
guarantee is spelled out in the security model.

🟦 active agent   🟥 policy violation   — verified delegation   ┈ blocked chain   ✓ verified in your browser

📸 Screenshots

Live delegation map Agents, delegations, violations — signatures verified in-browser	Dashboard Gateway calls, incidents and approvals at a glance
Connections Manage AI providers — keys encrypted, never returned by the API

🧩 Features

🎯 Governance — default

• Governed LLM gateway — agents reach OpenAI, Anthropic, Groq, Azure OpenAI
  or a self-hosted model through one OpenAI-compatible gateway, under the same
  rules. Every call is recorded as metadata (model, outcome, tokens, time) — the
  prompt and the answer are never stored. "Self-hosted providers only" is one switch.
• Policy hierarchy and approvals — one policy at three levels (organization →
  team → agent; lower levels only tighten), visual agent rules, and a person's
  approval for risky agent actions (policy hierarchy).

👁️ Shadow AI — unsanctioned AI

• Endpoint agent finds local models and AI agents (Claude Code, Cursor,
  Copilot, Aider, CrewAI, n8n, …), including unknown ones by their behavior.
• Browser extension warns before a secret is pasted into an AI tool.
• Passive network discovery — read-only; nothing is connected automatically.
• Everything lands in one Sightings list, with an AI domain catalog and device
  inventory (collectors).

🤖 Agents — autonomous AI

• Registry with scoped tools, delegation limits, teams and role templates.
• Signed delegations and actions, offline-verifiable (above).
• Workload attestation — Kubernetes, GitHub Actions, Google Cloud, Azure,
  GitLab, SPIFFE: each agent bound to its workload (docs).
• One way out — an egress proxy that holds the credentials and checks every
  outbound call (egress lockdown), and an eBPF sensor
  daemon that contains each governed workload's network in the kernel: allowed
  destinations only, DNS filtered, blocks reported (sensor).
• Behavior and circuit breakers — baselines and self-protection.
• Kill switch in levels: agent → team → all agents → all AI traffic, with
  exact undo (docs).
• SDKs for Python, JavaScript and
  Go.

📜 Identity and evidence

• Single sign-on (OpenID Connect) and SCIM — people switched off at the
  identity provider lose their sessions, and their agents' keys are revoked
  (docs).
• Tamper-evident audit log — append-only, hash-chained, signed Merkle
  checkpoints with RFC 3161 time-stamps; any record provable offline with
  tools/provenza_audit.py (docs).
• Incidents, notifications (e-mail, webhooks) and a compliance view.

📖 Documentation

Start at docs/README.md. The user guide
(oʻzbekcha) walks through the UI; the
development guide covers running from source, configuration
and tests.

Contributing

Bug reports, feature requests and pull requests are welcome. Please read
CONTRIBUTING.md first.

• Code of Conduct
• Security policy — report vulnerabilities privately
• Changelog

License

Apache License 2.0 — see LICENSE.

Copyright 2026 Laziz Kironov.

Featured in