Provenza

Provenance for every AI action.
_{See and govern the AI in your company — with provable accountability.}
From an employee pasting into ChatGPT to autonomous agents acting on their own —
watch it, control it, and prove every decision was authorized. Self-hosted, no external SaaS.

👀 Live demo  ·  ⏱ Quickstart  ·  🚀 Deploy  ·  ✨ Why it's different  ·  🧩 Features  ·  📖 Docs

---

Provenza is an open-source AI governance platform for companies that use AI agents: it finds shadow AI, keeps a registry of every AI agent, checks each agent action against policy before it runs (an MCP gateway), and writes a signed, tamper-evident audit log that anyone can verify offline.

AI entered your company through every door at once — shadow AI on laptops, autonomous agents delegating to each other, and no way to prove who authorized what. Most governance tools watch one door. Provenza covers them all, under one set of rules.

👀 Try the live demo

stickstock.lol — organization demo, e-mail demo@stickstock.lol, password provenza-demo. A read-only login to a demo bank: agents with their own keys, a signed delegation chain, denied and held actions, a refused privilege escalation, AI tools found on employees' laptops. In Agent activity → Live Map, click a delegation and check its signature in your browser. The data is made again every night.

🚀 Deploy on your server

Requirements: Linux with systemd (Ubuntu 24.04+, Debian 13+, RHEL/Rocky 9.3+ or Fedora), 4 GB RAM, a domain pointing at the server. The installer sets up Podman itself.

git clone https://github.com/kironovlaziz-del/provenza.git /opt/provenza
cd /opt/provenza
sudo ./install.sh

The installer asks for your domain and the first administrator, generates every secret, runs the stack as rootful Podman containers managed by systemd (Quadlet), gets an HTTPS certificate and schedules a daily backup. It also puts the egress proxy and the endpoint agent on the server, with their keys - nothing to copy from the interface; add --sensor for the eBPF egress sensor. Upgrades are one command, sudo provenza upgrade: it backs up first and rolls back if the new version does not come up. Full guide: docs/self-hosting.md.

First time? The quickstart goes from this install to Claude Code calling a tool through Provenza: checked, refused by one line of policy, and proven offline.

Connect an agent from the interface: Agents → New agent → Connect an AI client gives one command for the machine where Gemini CLI, Claude Code, Cursor or any OpenAI-compatible client runs. The agent's keys are made there and never leave it.

Govern egress on another Linux host: Runtime → Register sensor gives a one-line command that downloads the sensor from your Provenza (no Go, no git there).

Just looking? On your own computer, not a server (demo password, development secrets): docker compose -f docker-compose.dev.yml up --build - or podman compose with Podman - then http://localhost:3000 with organization demo, admin@demo.com / demo12345 (development guide).

✨ What makes it different

🔐 Verifiable Agent Governance

When one AI agent delegates a task to another, the delegating agent signs the handoff — the delegated capabilities, the TTL, a single-use nonce and a timestamp — with Ed25519, or with a post-quantum hybrid key (Ed25519 and ML-DSA-65, FIPS 204), where both signatures must verify. With agent-held keys, Provenza stores only the public key, so it cannot sign in the agent's name. Recorded agent actions are signed the same way and bound to the policy check that allowed them.

Proof that does not depend on trusting Provenza: download the evidence for any delegation or action and check it offline with tools/provenza_sign.py or plain OpenSSL, against the key fingerprint the agent's owner gave you. On the live delegation map, click an edge to run the same check in your browser.

Agent Manifest. Provenza also issues a signed Agent Manifest for every agent (AgenTrust specification v0.2, hybrid Ed25519 + ML-DSA-65, both signers required), binding the agent's approved MCP tools and the audit-log root. It is listed in AgenTrust's integrations, with a verifier you can run offline.

This is the kind of verifiable accountability the EU AI Act asks for — made clickable (how it works). What it does and does not guarantee is spelled out in the security model.

🟦 active agent   🟥 policy violation   — verified delegation   ┈ blocked chain   ✓ verified in your browser

🧩 Features

🎯 Governance — default

• Governed LLM gateway — agents reach OpenAI, Anthropic, Groq, Azure OpenAI or a self-hosted model through one OpenAI-compatible gateway, under the same rules. Every call is recorded as metadata (model, outcome, tokens, time) — the prompt and the answer are never stored. "Self-hosted providers only" is one switch.
• Policy hierarchy and approvals — one policy at three levels (organization → team → agent; lower levels only tighten), visual agent rules, and a person's approval for risky agent actions (policy hierarchy).

👁️ Shadow AI — unsanctioned AI

• Endpoint agent for Linux, Windows and macOS finds local models and AI agents (Claude Code, Cursor, Copilot, Aider, CrewAI, n8n, …), including unknown ones by their behavior. One command from the console installs it as a service; Intune, Group Policy and Jamf are covered.
• Browser extension (Chrome, Edge) reports visits to AI services, closes the ones your organization blocks and offers the approved ones instead. Deployed by policy, it also tells who uses what.
• DNS and proxy logs — upload a log (Squid, BIND, dnsmasq, Windows DNS, Zeek, Cisco Umbrella, Zscaler, …) or stream it with a log forwarder: AI use on every device on the network, without installing anything. Only the lines that reach an AI service are kept.
• Passive network discovery — read-only; nothing is connected automatically.
• Everything lands in one Sightings list, with an AI domain catalog, who uses each service, and device inventory (collectors).

🤖 Agents — autonomous AI

• Registry with scoped tools, delegation limits, teams and role templates.
• Governed MCP gateway — clients see only the tools an admin approved, and every call is checked and recorded. Desktop clients (Claude, Cursor, Gemini CLI, VS Code) start it as uvx provenza-mcp (SDK).
• Signed delegations and actions, offline-verifiable (above).
• Workload attestation — Kubernetes, GitHub Actions, Google Cloud, Azure, GitLab, SPIFFE: each agent bound to its workload (docs).
• One way out — an egress proxy that holds the credentials and checks every outbound call (egress lockdown), and an eBPF sensor daemon that contains each governed workload's network in the kernel: allowed destinations only, DNS filtered, blocks reported (sensor).
• Behavior and circuit breakers — baselines and self-protection.
• Kill switch in levels: agent → team → all agents → all AI traffic, with exact undo (docs).
• SDKs for Python, JavaScript and Go.

📜 Identity and evidence

• Single sign-on (OpenID Connect) and SCIM — people switched off at the identity provider lose their sessions, and their agents' keys are revoked (docs).
• Tamper-evident audit log — append-only, hash-chained, signed Merkle checkpoints with RFC 3161 time-stamps; any record provable offline with tools/provenza_audit.py (docs).
• Incidents, notifications (e-mail, webhooks) and a compliance view.

📖 Documentation

Start at docs/README.md. The user guide (oʻzbekcha) walks through the UI; the development guide covers running from source, configuration and tests.

Contributing

Bug reports, feature requests and pull requests are welcome. Please read CONTRIBUTING.md first.

• Code of Conduct
• Security policy — report vulnerabilities privately
• Changelog

License

Apache License 2.0 — see LICENSE.

Copyright 2026 Laziz Kironov.

Featured in

• AgenTrust integrations: Provenza Agent Manifest issuer (community tier)
• 
•