Control plane + tamper-evident audit ledger for AI agents

Agents act fast. Provenant decides first.

Route critical actions through Provenant to enforce policy, budgets, and approvals before execution - then keep a verifiable record of every decision.

Start your free trial Explore the demo

30-day Team trial · no card required · read-only live demo, no account needed · self-host on any tier

Mandates · Policies · Approvals · Budgets · Audit ledger · Risk

payment.send · $1,250.00 · agent: invoice-bot

mandatepolicybudgetrate limitrisk

Allowed

Executed - and recorded.

Held

A human approves or denies.

Denied

Blocked before it happens.

Checks run in order; the most restrictive outcome wins. Every decision returns an explainable trail - you always see why.

The accountability gap

When agents move money and data, “we logged it” isn’t enough

Observability tools record what agents did, after the fact. Nobody governs what they're allowed to do - or can prove it. Five questions you can't answer today:

What is this agent allowed to do, and who decided that?
Did this payment stay within budget and policy?
Which actions require a human in the loop, and where is the queue?
Is this agent behaving anomalously versus its history and peers?
Can you produce a tamper-evident record of governed decisions and outcomes?

Provenant is the layer that answers these questions - and enforces the answers.

How it works

One decision pipeline for every governed action

1 · The agent proposes

Before it spends money, calls an API, or sends a message, the agent asks Provenant: an authorize() call from the SDK, or a request through the enforcing gateway.

2 · Your rules decide

The request is evaluated against the agent’s mandate, org policies, budgets, rate limits, and a behavioral risk score - the most restrictive outcome wins: allow, hold for a human, or deny.

3 · The ledger records

Every decision and outcome is appended to a per-organization, hash-chained audit ledger. Verify the chain in one click, export signed evidence, anchor chain heads to your own systems.

Cooperative SDK

const d = await provenant.authorize({
  type: "payment.send",
  resource: "vendor:acme",
  valueCents: 125_000,
});
if (d.status === "authorized") { /* act */ }

TypeScript and Python SDKs; plain HTTP API underneath
Integrates in an afternoon, framework-agnostic
Honest label: trust-on-cooperation - for first-party agents

Enforcing gateway

Agent never holds the credential

POST /v1/gateway/invoke
X-Provenant-Key: <agent key>

→ policy decides, THEN Provenant
  executes with its own credential

The call happens only after an allow - and the agent never holds the credential to go around it
MCP gateway: every tool call policy-gated
Or broker a scoped, short-lived credential bound to one authorized action

The platform

Everything a governed fleet needs

Mandates & policies

Each agent acts inside a mandate: allowed actions and resources, hard value caps, approval thresholds, rate limits. Org-wide policies layer on top - staged draft → shadow → active, simulated against recent traffic before they enforce, versioned with rollback.

Spend budgets

Cap spend for the org, a single agent, or a tag over daily, weekly, monthly, rolling or total windows - block or require approval on breach. Authorized value is reserved as a hold and reconciled on completion, so budgets fire on committed spend, not after the fact.

Human approvals

Actions over a threshold, over budget, or behaviorally anomalous are held for a person. Approvers decide from the queue or from signed out-of-band links - and the decision pipeline re-runs at approval time, so a rule tightened in the meantime still applies.

Tamper-evident ledger

Every decision and change lands in a hash-chained, checkpointed ledger. Verify retained history offline, and anchor chain heads to your own WORM store or SIEM for proof independent of Provenant.

Connectors & credential brokering

In enforced mode agents act through Provenant: the downstream credential stays server-side and the call happens only after an allow. For one-shot actions, the broker mints a scoped, short-lived credential bound to that single authorization.

Deploy anywhere

Use the hosted platform, or self-host on your own infrastructure. Self-hosting is open to everyone: with no license key the deployment runs the Free tier, and a signed key - verified locally, no phone-home - activates any paid plan.

Everything above is in the docs.

Tamper-evident by construction

Don’t take our word for it. Verify the math.

Every retained ledger entry is cryptographically chained to the previous one, per organization. Retention cuts leave signed checkpoints; altering retained entries breaks the chain.

One-click verification in the app re-derives the whole chain.
Signed exports verify offline with the SDK - your auditor needs no Provenant account and no live access to check the chain themselves.
Anchor signed chain-heads (hashes only, never contents) to your own WORM store or SIEM - history you anchored can’t be rewritten, even by us.
The ledger records everything: agent actions, configuration changes, sign-ins, approvals. Streamed CSV/JSON export - your evidence is never hostage.

#1041allow

hash: 9f3a…c21e

prev: 71bd…e04d

#1042hold

hash: 5d18…77af

prev: 9f3a…c21e

#1043allow

hash: e6c2…09b3

prev: 5d18…77af

Chain verified independently

Each entry's prev repeats the previous entry's hash - edit any entry and every later hash stops matching.

Security practices

Real controls, not badge walls

Auth & MFA - scrypt password hashing; authenticator apps and passkeys (a passkey is a complete passwordless sign-in); admins can require a second factor on every password sign-in.
Enterprise identity - OIDC single sign-on with JIT provisioning, plus SCIM user provisioning and deprovisioning.
Secret encryption - connector secrets encrypted at rest with AES-256-GCM under a per-organization key and never returned by the API - or keep them in your own HashiCorp Vault, AWS, Azure, or GCP manager, referenced at call time and failing closed.
Signed & hardened - webhooks and approval links are signed; sessions ride HttpOnly, Secure, SameSite=Strict cookies (CSRF-resistant), never localStorage.

Run it your way

Hosted or self-hosted - same product

Hosted platform - sign up and start governing today; we run upgrades and operations.
Self-hosted - your infrastructure, your network, your database. Free tier needs no license key; a signed key (verified locally, no phone-home) activates any paid plan. License lapse → grace period → Free limits. Ledger capping is off by default; operators can opt into plan-bound capping with warnings and signed checkpoints.
Same dashboard, same SDKs, same decision engine either way. Self-hosting docs

Pricing

Transparent, published pricing

Every plan runs the same control plane and full decision engine - tiers differ in scale, retention, and identity features. Prices in USD; checkout presents your local currency. New organizations start a 30-day Team trial, no card required.

Yearly

Free

Govern a couple of agents and try every core control.

Up to 3 agents
5,000 governed actions / mo
5 policies · 3 budgets
2 team members
7-day data retention

Start free

Recommended

Team

For teams putting agents into production.

$99.00/mo

Up to 25 agents
250,000 governed actions / mo
50 policies · 50 budgets
15 team members
Webhooks
90-day data retention

Start Team trial

Scale

High-volume fleets with stricter controls.

$499.00/mo

Up to 200 agents
5M governed actions / mo
500 policies · 500 budgets
100 team members
Webhooks
1-year data retention

Choose Scale

Enterprise

Unlimited scale, enterprise identity, and compliance support.

$999.00/mo

Unlimited agents & actions
Unlimited policies, budgets & team members
OIDC SSO & SCIM
2-year retention & signed DPA
Priority support

Choose Enterprise

Yearly billing saves about two months, and any tier can also be self-hosted - the Free tier needs no license key. Every plan includes ticket support through the support portal, with priority handling for Enterprise. Questions about Enterprise, procurement, or a DPA? [email protected]

FAQ

The questions engineers actually ask

What happens when my trial ends?

Your organization moves to the Free tier and its 7-day retention window applies to operational records and the audit ledger. Ledger cuts are announced before they happen so you can export first, and every cut leaves a signed checkpoint. You can upgrade any time from Billing.

Can I self-host without paying?

Yes. Anyone can self-host, and without a license key the deployment runs the Free tier. Paid tiers activate with a signed license key your instance verifies locally - no phone-home, no network call. When a key expires there is a grace period before limits revert to Free.

Can my agents bypass Provenant?

We recommend never giving agents downstream credentials. Route protected actions through Provenant instead: it holds the credential and calls the resource only after an allow. On that controlled path, the agent has nothing to bypass. Cooperative SDK mode remains trust-based, and credentials or paths outside Provenant remain outside its control.

How do I know the ledger hasn’t been tampered with - by an agent, an insider, or you?

Provenant's ledger write path never edits retained entries: it appends new entries, while retention removes only checkpointed prefixes. Chain verification detects changes or gaps, and customer-controlled anchors provide proof independent of Provenant's infrastructure.

Do you train models on my data?

No. We do not use customer data to train machine-learning models, and we never use one customer’s data to improve anything for another. That commitment is in the Privacy Policy - not a setting you have to find and switch off.

Are you SOC 2 or ISO 27001 certified?

Not yet - we’re early and won’t claim badges we haven’t earned. What we offer instead is verifiable: an audit ledger you can independently verify offline, scrypt password hashing with MFA and passkeys, per-organization encryption of stored secrets - and if your policy requires data on your own infrastructure, self-host on any tier.

Which agent frameworks does it work with?

All of them, because Provenant integrates at the SDK and API level, so it stays framework-agnostic - but it also ships drop-in adapters: governTool (TypeScript) and govern_tool (Python) wrap any tool used by the Vercel AI SDK, LangChain, CrewAI, or LangGraph so every call is authorized, executed, and completed with no change to how the framework invokes the tool. Prefer no SDK at all? Point any MCP client at the MCP gateway, where every tool call is policy-gated. If your agent can make an HTTP request, it can ask Provenant first - or act through the enforcing gateway so it can’t skip the question.

Allow. Hold. Deny. Every decision recorded.

Start your free trial Explore the demo

30-day Team trial · no card required · read-only demo needs no account