sengol.authz.decision
allowed
#4,821
agent_id: kyc-triage-agent
tool: core_banking.read_account
prev 7c1e…a09f
v1.1.0 now shipping
Build without fear.
Build without fear.
Govern without friction.
Sengol is the governance and evidence layer for production AI agents. It runs guardrails inline, evaluates every call, gates your deploys, and turns each decision into a cryptographically signed, tamper-evident record your risk team and your regulator can verify — inside your own perimeter.
Request early access
$ pip install sengol
29Regulatory frameworks
30+Built-in evaluators
2 linesTo instrument an agent
0Bytes leaving your VPC
The gap
Dashboards score your agents. They don't prove anything.
When an examiner asks "show me the evidence for this AI agent", a trace viewer is not an answer. Sengol produces the artifact that is — the gate verdict and the regulator-submittable record are the same signed object, not three synchronized copies.
Your engineers want to ship.
Governance that costs a sprint gets routed around. Sengol is two lines and a CI step.
Your risk team wants proof.
Not screenshots. Append-only, hash-chained, independently verifiable records.
Your business wants both.
Ship agents into regulated workflows without waiting for a quarterly review.
Sengol is the reason you can say yes to all three.
How it works
Four steps from agent to admissible evidence.
Every step is a Python call, a CLI command, an API route — and a signed record.
01
Instrument
One call patches the Anthropic and OpenAI SDKs at class level. Every existing agent call is intercepted — no per-call changes. Or ingest OTel traces directly.
sengol.instrument()
02
Evaluate
Deterministic evaluators run first in under a millisecond and short-circuit on CRITICAL. LLM judges then run concurrently — hallucination, PII, toxicity, tool misuse, adversarial robustness.
30+ evaluators
03
Gate
Block the call inline before the user sees it, and block the deploy before it merges. The GitHub Action posts a verdict on the PR and exits non-zero on failure.
sengol run-suite
04
Prove
Each verdict is HMAC-signed, hash-chained, and mapped to the obligation it satisfies. Export an evidence pack that a third party verifies offline, with no access to your systems.
sengol audit verify
Capabilities
One platform, from the request to the regulator.
Runtime control, evaluation quality, cryptographic evidence, and access governance — designed as one chain, not four tools you integrate yourself.
Stop the bad call before it reaches the customer.
Guardrails run inline in the request path. CRITICAL failures block immediately; everything else is recorded and routed. Enforcement is a policy decision, not a code change.
- Pre- and post-call interception — patches the Anthropic and OpenAI SDKs; streaming responses are buffered and evaluated before delivery.
- Tool authorization allow-lists — per-agent policies block unauthorized tool calls, with a signed decision record on allow and block.
- Delegation-depth limits — agent-to-agent chains are reconstructed from OTel spans and attenuated at a declared depth.
- MCP tool integrity — tool definitions are hash-pinned at approval, so a post-approval "rug pull" is flagged CRITICAL.
- Gateway-native — drop into LiteLLM or Portkey for allow / block / redact with in-path PII redaction.
import sengol
sengol.configure(
agent_id="kyc-triage-agent",
agent_version="2.4.0",
policies=["OSFI_E23", "PIPEDA"],
)
sengol.instrument() # every LLM call is now governed
# your existing code is unchanged
resp = client.messages.create(...)
# on a CRITICAL failure:
# BlockedError: PII_LEAKED — response withheld,
# signed AuditRecord #4,822 writtenEvaluation that holds up as model validation.
Deterministic checks run first and short-circuit on CRITICAL, so you never pay for a judge call you don't need. LLM judges then fan out concurrently.
- 30+ built-in evaluators — hallucination, faithfulness, PII, toxicity, refusal accuracy, explainability, adversarial robustness, AML typology, tool-call correctness.
- Trajectory evaluation — score the whole agent run, not just the final message: tool order, argument schemas, forbidden tools, intent resolution.
- Ensembles and flake tolerance — unanimous, majority or weighted vote; repeat an LLM check N times and require M passes.
- Red teaming — pluggable adversarial backends (Garak, PyRIT) surface probe breaches as CRITICAL findings.
- Own your judge Enterprise — mine your traces, calibrate against human labels, fine-tune a small model in your VPC, and gate it on TPR/TNR, Cohen's κ and position consistency before promotion.
$ sengol run-suite --controlbook osfi_e23.yaml \
--dataset-path suites/kyc.jsonl --min-pass 0.95
evaluating 128 cases · 11 evaluators
✓ PIIEvaluator 128/128
✓ FaithfulnessJudge 126/128
✓ ToolCallMatch 128/128
✗ AdversarialRobustness 121/128
pass rate 0.943 < min_pass 0.95
GATE FAILED · exit 1 · deploy blocked
128 signed AuditRecords writtenEvidence, not logs. Verifiable by someone who doesn't trust you.
Every verdict is a signed, append-only record in a per-agent hash chain. Change one byte anywhere in the history and verification fails — loudly, and provably.
- HMAC-SHA256 hash chain — append-only, tamper-evident, with a canonical signed payload per record type.
- Ed25519 countersignatures — a second, asymmetric signature so a third party verifies without ever holding your secret.
- Merkle anchoring — periodic roots anchored to an RFC 3161 timestamp authority and Rekor, proving a record existed at a point in time.
- Offline verification — export a portable bundle and verify it with no network, no server, and no access to your infrastructure.
- WORM-grade storage — Postgres, DynamoDB, or S3 with Object Lock in COMPLIANCE mode.
$ sengol audit verify --offline pack.json
bundle kyc-triage-agent · 2026-Q2
records 4,823
chain OK every prev_hash links
hmac OK 4,823 / 4,823 signatures
ed25519 OK countersignatures valid
anchors OK 3 Merkle roots · RFC 3161 + Rekor
tampered 0
VERIFIED — no live server contactedRegulations as executable objects, not PDFs.
A framework is a catalog entry, not a Python class. Sengol compiles it into obligations, routes each obligation to the evaluators that satisfy it, and keeps the evidence bound to the exact control that ran.
- 29 frameworks out of the box — OSFI E-23, SR 26-2, EU AI Act, GDPR, HIPAA, FINTRAC, MAS, SAMA, APRA, ISO 42001, NIST AI RMF and more.
- Bring your own policy — an internal standard is one YAML entry. No new code, same signed evidence, same reports.
- Cross-framework crosswalk — one control node maps to many regimes, so a single run answers OSFI and the AI Act at once. OWASP ASI coverage included.
- Obligation coverage, live — see which obligations are covered, by which evaluator, by which record — and which are not.
- Regulator-shaped reports Enterprise — JSON evidence pack and CRO-readable PDF, driven by your ControlBook.
policy_id: OSFI_E23
mappings:
- obligation: E23-3.3 # explainability
evaluators: [ExplainabilityEvaluator]
severity: HIGH
coverage_required: true
pass_rate: 0.95
- obligation: E23-6.1 # ongoing monitoring
evaluators: [DriftMonitorPresent]
severity: CRITICAL
coverage_required: true
# every record carries the obligation it satisfiedEnterprise identity, segregation of duties, and legal hold.
Governance software that can't govern its own operators isn't evidence. Sengol enforces who may approve what, records it, and signs it.
- SSO and provisioning — OIDC and SAML 2.0 sign-in, SCIM 2.0 user lifecycle, IdP group-to-role mapping re-derived on every login.
- Segregation of duties — object-scoped maker–checker: the person who builds a judge cannot be the person who promotes it. Overrides require a reason and a signed record.
- Resource-scoped access — bounded roles over label hierarchies, resolved server-side per request and pushed into the query, so a scoped auditor sees only their line of business.
- Independent challenge — an E-23 style validator review, attested by a challenger provably disjoint from the development actors.
- Legal hold, retention and erasure — statutory retention floors, dual-control on any shortening, GDPR/PIPEDA erasure that purges data without breaking the chain.
$ sengol judge promote --record-id jmc_91f2 \
--approver alice@bank.example
model card verified gate passed
TPR 0.94 TNR 0.92 κ 0.71 PC 0.88
checking segregation of duties…
validate actor bob@bank.example
promote actor alice@bank.example
✓ distinct actors · maker-checker satisfied
APPROVED · PromotionDecisionRecord signed
mfa_asserted=true · acr=urn:mace:...:mfa
Also included
The parts nobody remembers until the audit.
CI/CD gate with PR verdicts
A GitHub Action runs your suite on every pull request, posts a sticky comment with the verdict and coverage, and exits non-zero to block the merge. The gate verdict is the audit record — not a copy of it.
Drift detection with a closed loop
CUSUM detection on the live pass-rate stream. A breach doesn't just alert — it can trigger re-evaluation, suspend the agent, block new deploys, or route to human approval, and every response is signed.
Shadow agent discovery
Find agents running in your estate that nobody registered — then register, dismiss, or quarantine them with a signed disposition.
Spend & quota governance
Per-agent, per-model cost and token budgets with signed usage evidence. Multi-currency limits with pinned or live FX.
Recertification triggers
When a regulation changes, affected agents are queued for recertification automatically — from a signed regulation-update event.
Human review queue & authority model
Escalation with SLAs, override authority by risk tier, and a versioned authority model whose status transitions are themselves signed records. Who may reverse a governance action — and what evidence that takes — is a declared artifact, not tribal knowledge.
Policy portability
Export authorization policies to AWS Cedar, import Microsoft Agent Control Specification manifests as declared capabilities. Your policy is not trapped in our format.
Frameworks
29 frameworks compiled. Yours is one YAML entry away.
Sengol is not OSFI-specific. It is opinionated about OSFI E-23 because that is where it ships first.
OSFI E-23 Model risk
SR 26-2 Fed / OCC / FDIC
EU AI Act
GDPR
FINTRAC Part 6F
PIPEDA
HIPAA
NIST AI RMF
ISO/IEC 42001
OSFI B-10 Third party
BCBS 239
SOX
CCPA
OCC 2011-12
SR 11-7
UK GDPR
PRA SS1/23
FCA AI
EBA ML IRB
MAS TRM
MAS FEAT
PDPA Singapore
SAMA AI Ethics
PDPL Saudi Arabia
RBI IT Governance
IRDAI AI/ML
DPDP India
APRA CPG 234
US Treasury AI RMF
Adding a framework is one catalog.yaml entry — zero new Python classes.
Your internal model-risk standard works exactly the same way.
Integrations
Fits the stack you already run.
Sengol sits underneath your agents and beside your observability — it does not ask you to move.
Anthropic SDK
OpenAI SDK
OpenTelemetry
MCP servers
LiteLLM
Portkey
GitHub Actions
Langfuse
MLflow
Prometheus & Grafana
PostgreSQL
DynamoDB & S3
AWS · Azure · GCP
Kubernetes & OpenShift
AWS KMS
Entra ID & Okta
Security & deployment
Your perimeter. Your keys. Your data.
Sengol is an SDK first and a service second. The evidence chain is written to a store you own, in an environment you control. Nothing about the design requires your prompts or completions to reach us.
docker compose up
for a laptop. Helm and Terraform for AWS, Azure, GCP, OpenShift and on-prem.
Fully air-gapped, if that's the requirement.
-
Data residency by architecture
Evidence is written to your Postgres, DynamoDB or S3. Judges can run entirely on models inside your VPC.
-
Signing keys you control
Local HMAC or AWS KMS-backed signing with rotation, so old records still verify after a key change.
-
Identity that survives review
OIDC, SAML 2.0, SCIM 2.0, RBAC with a "you cannot grant what you don't hold" invariant, TOTP MFA, and audited break-glass.
-
Built for scale and HA
Multi-replica coordination, connection pooling, keyset pagination, and durable outbox delivery — no Redis required.
-
Retention done correctly
Statutory retention floors, legal hold that blocks disposition, WORM cold export, and signed retirement records. Erasure never breaks the chain.
Who it's for
One chain of evidence. Three very different readers.
Answer the examiner without a fire drill.
- Obligation coverage per agent, per period
- Independently verifiable evidence packs
- Declared authority and override model
- Independent challenge with enforced separation
Governance that doesn't cost you a sprint.
- Two lines at startup, no per-call changes
- SDK, CLI, REST API and GitHub Action
- Works with your existing OTel pipeline
- Self-host with Compose, Helm or Terraform
Evidence bound to the control that produced it.
- Every response scored against declared controls
- Human review queue with escalation SLAs
- Automatic recertification on regulation change
- Legal hold, retention floors, defensible disposal
Packaging
Start free. Scale to examination-grade.
Run the SDK, the evaluators, the signed audit chain and the CI gate at no cost. Certified regulatory packs, the judge factory and managed deployment are licensed.
FreeSelf-hosted
Everything an engineer needs to govern agents locally and in their own infrastructure.
- Full Python SDK and all built-in evaluators
- Signed audit chain and offline verification
- Local Console UI and Docker Compose
- CLI, REST API and GitHub Action gate
- JSON evidence exports
$500per month · hosted API
For AI teams that want the evidence plane without running the infrastructure.
- Everything in Developer
- Hosted, managed governance API
- SSO sign-in and team access controls
- Drift monitoring and alerting
- Email support
CustomRegulated & air-gap
For institutions where the evidence has to survive an examination.
- Certified regulatory packs and PDF reports
- SLM Judge Builder — own and validate your judge
- SCIM, segregation of duties, independent challenge
- Helm, Terraform, air-gap deployment
- Retention, legal hold and recertification automation
- SLA and named support
Questions
The ones we always get asked.
How is this different from LangSmith, Arize or Galileo?
Those are developer observability tools — they help engineers debug agents faster, and they do it well. They produce dashboards and scores. Sengol produces evidence: a signed, hash-chained, offline-verifiable record bound to the specific obligation it satisfies, plus the runtime controls that decide what happens next. The gate verdict and the record you hand an examiner are the same object.
Does any of my data leave my infrastructure?
Not by design. The SDK writes to an audit store you own — your Postgres, DynamoDB or S3 — in your own environment. Deploy with Docker Compose, Helm or Terraform inside your VPC, or fully air-gapped. If you use a hosted LLM judge, that provider sees the judge prompt; run a local model instead and nothing leaves at all.
What does "cryptographically signed evidence" actually mean here?
Each record has a canonical payload signed with HMAC-SHA256 and linked to the previous record in a per-agent hash chain, so the store is append-only and tamper-evident. Records are additionally countersigned with Ed25519 and periodically Merkle-anchored to an RFC 3161 timestamp authority and Rekor. A third party can verify an exported bundle offline, with the public key alone — no access to your systems or your secret.
My regulator isn't on your list. Now what?
Add it. A framework in Sengol is a catalog entry with obligations and evaluator routing — no new Python classes. That is exactly how internal bank policies and regional regimes are supported, and they get the same compiled obligations, the same signed evidence and the same reports as the 29 that ship in the box.
How long does integration actually take?
Runtime instrumentation is two lines at process startup — sengol.configure() and sengol.instrument() — with no per-call changes to your agent code. The CI gate is one workflow step. Mapping your controls into a ControlBook is the part that takes real thought, and it is the part that produces the evidence.
What's free and what's licensed?
Free to run: the SDK, every built-in evaluator, the signed audit store, offline verification, the local Console, the CLI and the CI gate. Licensed: the certified regulatory packs and PDF reports, the Judge Builder pipeline, and managed deployment tooling — Helm, Terraform, air-gap and the hosted API.
Early access
Your teams ship. Sengol keeps agents in bounds.
Declare your controls once. Sengol makes them executable, verifiable, and defensible in production.