Your AI agent just placed an order, deleted a row, sent an email, merged a PR. Can you prove exactly what it did — to an auditor, a customer, or yourself after an incident?
Signet is the independent trust layer for agent actions. Every tool call gets a signed receipt that anyone can verify offline, without trusting the platform that hosted the agent or the vendor that stored the logs — and since 0.11, the authorization behind an action carries its own proof: who the agent is (principal), who let it act (delegation), and who allowed this specific action (authority-signed decision).
Your agents run on their infrastructure. The proof belongs to you.
Why Not Just Logs?
Traditional logs tell you what a platform says happened. They're mutable, provider-dependent, and unverifiable without trusting the party that wrote them.
Signet receipts are different. Modify any field — tool name, parameters, timestamp, signer — and the Ed25519 signature breaks. Delete or reorder entries and the SHA-256 hash chain breaks. Verification requires only the public key. No network call, no API, no login.
| Ordinary logs | Signet receipts |
|---|
| Provider says it happened | Anyone can verify it, offline |
| Mutable after the fact | Signature breaks on tamper |
| No ordering proof | Hash chain breaks on delete/reorder |
| Trust the log host | Verify with the public key |
| One-sided claim | Bilateral co-signing available |
Use logs for observability. Use Signet when you need evidence.
Who Is This For?
- MCP builders — wrap any MCP server with
signet proxy, sign every tools/call, no code changes
- Security / compliance teams — tamper-evident audit trail that satisfies EU AI Act Art. 12, SOC 2 CC7.2, ISO 27001 A.8.15
- Enterprise agent platforms — prove what the agent did, who authorized it, which policy was in force
- Framework users — LangChain, CrewAI, Claude Code, Codex, OpenAI Agents, Vercel AI SDK — all supported
- Agent-to-agent deployments — bilateral co-signing when both sides hold keys
If a tool call cannot be verified independently, it should not be trusted unconditionally. This matters when an auditor asks for proof, when an incident happens on infrastructure you don't control, or when the question isn't "what does the console say" but "what actually happened."
Each agent gets an Ed25519 identity. Every tool call can be signed, appended to a hash-chained audit trail, verified offline or before execution, co-signed by the server, bound to a delegation chain, and optionally bound to a policy decision.
The video above shows the full flow. The SVG below shows the CLI signing details, or jump to See It Reject Bad Requests to watch the server block bad requests before they run.
What Signet Adds
Signet adds a lightweight trust layer for agent actions:
- Sign every tool call with the agent's cryptographic key
- Verify requests offline or at the execution boundary before they are trusted
- Proxy any MCP server transparently — sign requests without touching agent or server code, with local bilateral audit co-signing in the proxy path
- Co-sign server responses with bilateral receipts when you control both sides
- Trace multi-step workflows by linking receipts with
trace_id and parent_receipt_id
- Authorize agents with scoped delegation chains that prove who allowed the action
- Attest policy by embedding a signed
PolicyAttestation when a YAML policy is satisfied
- Inspect locally with an append-only audit log and dashboard, no hosted control plane required
What's New In 0.11
- Canonical principals: every identity can carry a scoped principal URI (
agent://prismer/deploy-bot), signed inside receipts and delegation tokens; acting_for claims are machine-corroborated by the chain root.
- Authority-signed authorization decisions:
signet authorize pre-approves one intent; signet sign --decision produces a receipt backed by it (or --authority-key does it in one step). A decision binds to the action via intent_hash, so replay onto a different action is refused.
- Revocation:
signet revoke invalidates delegation tokens and decisions with an issuer-signed record. Verification reports an explicit status — revoked fails, unknown is never reported as authorized (--require-revocation-known for strict mode). Evidence bundles carry revocation records.
- Conditions and limits: policy rules carry typed obligations (
require_approval, sandbox, …); delegation scopes carry constraints (--max-calls, --spend-limit). Sign paths enforce call-count budgets and the narrowing invariant (a grant can shrink a delegation, never widen it).
- Hardening:
verify() now correctly verifies v4 receipts; rate-limited policy rules fail closed when no state is supplied; delegation expiry binds to wall clock (backdating a receipt timestamp no longer dodges it).
Compliance
Signet provides the technical controls that auditors look for when assessing AI agent operations. See the full Compliance Mapping for details.
| Framework | What Signet Addresses |
|---|
| SOC 2 Type II | Signed audit trail (CC7.2), tamper detection (CC7.3), role-based scope (CC6.3), authorization proof (CC8.1) |
| ISO 27001 | Event logging (A.8.15), access control (A.5.15), authentication (A.5.17), configuration management (A.8.9) |
| EU AI Act | Article 12 record-keeping: event logging, traceability, identification, integrity |
| DORA | ICT incident logging (Art. 17), third-party risk evidence (Art. 28-30), audit trail integrity |
| NIST AI RMF | Govern (delegation chains), Map (signed receipts), Measure (audit queries), Manage (policy engine) |
Signet is a tool, not a certification. It provides controls that support compliance — your deployment and configuration determine compliance posture.
Try It In 30 Seconds
pip install signet-auth
以上为 README 的开头部分。其余内容请阅读原文。 查看完整 README ↗
