Provenza

Provenance for every AI action.

See and govern every AI in your company — with provable accountability.

From an employee pasting into ChatGPT to autonomous agents acting on their own —

watch it, control it, and prove every decision was authorized. Self-hosted, no external SaaS.

👀 Live demo · 🚀 Deploy · ✨ Why it's different · 🧩 Features · 📖 Docs

AI entered your company through every door at once — shadow AI on laptops, autonomous agents delegating to each other, and no way to prove who authorized what. Most governance tools watch one door. Provenza covers them all, under one set of rules.

👀 Try the live demo

stickstock.lol — organization demo, e-mail demo@stickstock.lol, password provenza-demo. A read-only login to a demo bank: agents with their own keys, a signed delegation chain, denied and held actions, a refused privilege escalation, AI tools found on employees' laptops. In Agent activity → Live Map, click a delegation and check its signature in your browser. The data is made again every night.

🚀 Deploy on your server

Requirements: Linux with systemd (Ubuntu 24.04+, Debian 13+, RHEL/Rocky 9.3+ or Fedora), 4 GB RAM, a domain pointing at the server. The installer sets up Podman itself.

git clone https://github.com/kironovlaziz-del/provenza.git /opt/provenza
cd /opt/provenza
sudo ./install.sh

The installer asks for your domain and the first administrator, generates every secret, runs the stack as rootful Podman containers managed by systemd (Quadlet), gets an HTTPS certificate and schedules a daily backup. It also puts the egress proxy and the endpoint agent on the server, with their keys - nothing to copy from the interface; add --sensor for the eBPF egress sensor. Upgrades are one command, sudo provenza upgrade: it backs up first and rolls back if the new version does not come up. Full guide: docs/self-hosting.md.

Connect an agent from the interface: Agents → New agent → Connect an AI client gives one command for the machine where Gemini CLI, Claude Code, Cursor or any OpenAI-compatible client runs. The agent's keys are made there and never leave it.

Govern egress on another Linux host: Runtime → Register sensor gives a one-line command that downloads the sensor from your Provenza (no Go, no git there).

Just looking? On your own computer, not a server (demo password, development secrets): docker compose -f docker-compose.dev.yml up --build - or podman compose with Podman - then http://localhost:3000 with organization demo, admin@demo.com / demo12345 (development guide).

✨ What makes it different

🔐 Verifiable Agent Governance

When one AI agent delegates a task to another, the delegating agent signs the handoff — the delegated capabilities, the TTL, a single-use nonce and a timestamp — with Ed25519, or with a post-quantum hybrid key (Ed25519 and ML-DSA-65, FIPS 204), where both signatures must verify. With agent-held keys, Provenza stores only the public key, so it cannot sign in the agent's name. Recorded agent actions are signed the same way and bound to the policy check that allowed them.

Proof that does not depend on trusting Provenza: download the evidence for any delegation or action and check it offline with tools/provenza_sign.py or plain OpenSSL, against the key fingerprint the agent's owner gave you. On the live delegation map, click an edge to run the same check in your browser.

This is the kind of verifiable accountability the EU AI Act asks for — made clickable (how it works). What it does and does not guarantee is spelled out in the security model.

🟦 active agent 🟥 policy violation — verified delegation ┈ blocked chain ✓ verified in your browser

📸 Screenshots

Live delegation map

Agents, delegations, violations — signatures verified in-browser

Dashboard

Gateway calls, incidents and approvals at a glance

Connections

Manage AI providers — keys encrypted, never returned by the API

🧩 Features

🎯 Governance — default

• Governed LLM gateway — agents reach OpenAI, Anthropic, Groq, Azure OpenAI or a self-hosted model through one OpenAI-compatible gateway, under the same rules. Every call is recorded as metadata (model, outcome, tokens, time) — the prompt and the answer are never stored. "Self-hosted providers only" is one switch.
• Policy hierarchy and approvals — one policy at three levels (organization → team → agent; lower levels only tighten), visual agent rules, and a person's approval for risky agent actions (policy hierarchy).

👁️ Shadow AI — unsanctioned AI

• Endpoint agent finds local models and AI agents (Claude Code, Cursor, Copilot, Aider, CrewAI, n8n, …), including unknown ones by their behavior.
• Browser extension warns before a secret is pasted into an AI tool.
• Passive network discovery — read-only; nothing is connected automatically.
• Everything lands in one Sightings list, with an AI domain catalog and device inventory (collectors).

🤖 Agents — autonomous AI

• Registry with scoped tools, delegation limits, teams and role templates.
• Governed MCP gateway — clients see only the tools an admin approved, and every call is checked and recorded. Desktop clients (Claude, Cursor, Gemini CLI, VS Code) start it as uvx provenza-mcp (SDK).
• Signed delegations and actions, offline-verifiable (above).
• Workload attestation — Kubernetes, GitHub Actions, Google Cloud, Azure, GitLab, SPIFFE: each agent bound to its workload (docs).
• One way out — an egress proxy that holds the credentials and checks every outbound call (egress lockdown), and an eBPF sensor daemon that contains each governed workload's network in the kernel: allowed destinations only, DNS filtered, blocks reported (sensor).
• Behavior and circuit breakers — baselines and self-protection.
• Kill switch in levels: agent → team → all agents → all AI traffic, with exact undo (docs).
• SDKs for Python, JavaScript and Go.

📜 Identity and evidence

• Single sign-on (OpenID Connect) and SCIM — people switched off at the identity provider lose their sessions, and their agents' keys are revoked (docs).
• Tamper-evident audit log — append-only, hash-chained, signed Merkle checkpoints with RFC 3161 time-stamps; any record provable offline with tools/provenza_audit.py (docs).
• Incidents, notifications (e-mail, webhooks) and a compliance view.

📖 Documentation

Start at docs/README.md. The user guide (oʻzbekcha) walks through the UI; the development guide covers running from source, configuration and tests.

Contributing

Bug reports, feature requests and pull requests are welcome. Please read CONTRIBUTING.md first.

• Code of Conduct
• Security policy — report vulnerabilities privately
• Changelog

License

Apache License 2.0 — see LICENSE.

Copyright 2026 Laziz Kironov.

Featured in