Regulators no longer accept policy documents as proof. They ask who did what, under which authority, with what data, and can you show the signed record. This system answers that at the call, every call.
The EU AI Act, sectoral data-residency rules, and every internal audit share one demand: reconstruct any AI action after the fact, with attribution and data lineage. Three obligations you carry:
This is not a pilot with a wrapper. It is a live workforce mapped like-for-like onto the real ACME org, running under deny-by-default zero-trust policy on GCP.
Source: registry (367 agent tenants, postgres-backed) · fleet_runner.py, 360 agents mapped dept × role-family across all 28 departments · personas.json 7-agent 14-edge DAG.
There is no side door. A governed job cannot reach data without minting a capability, being evaluated deny-by-default, and being written into the signed audit chain. The path is the control.
Source: governed request flow (one job) — X-Tiresias-Api-Key + X-Capability-Token required; policy deny-by-default; SoulKey Ed25519 audit chain to CP.
Nothing here is illustrative. Each item is a live endpoint, store, or key you can inspect during the walkthrough.
Source: Plane 3 (PEP), Plane 4 (data), Plane 1 (identity), Review/analyst console — ARCHITECTURE ground truth.
The PEP signs every governed call into a hash-linked chain using an Ed25519 SoulKey. Any alteration breaks the chain, and the review console verifies it independently. This is what turns "we log things" into evidence.
Each call: the acting agent tenant, the api-key + capability-token presented, the policy decision, and the forwarded action — chained to the prior entry so the sequence itself is attested.
Durable write-ahead log at /data/audit-wal on the PEP, shipped to the CP audit home (postgres-backed, survives restart). Verification runs from the analyst console at /admin — audit/verify.
Source: Plane 3 — signed audit chain (SoulKey Ed25519), WAL /data/audit-wal, ships to CP; Review console /admin/* audit/verify.
Every agent is its own soul-svc tenant. In acme_soul, Row-Level Security is FORCED: even the postgres role is subject to it. An agent physically cannot read another agent's memory, regardless of application bugs.
Source: Plane 4 — per-agent isolation, FORCE RLS on _memories/_soul_api_keys, SET ROLE service_role for cross-tenant ops.
Policy is not attached to anonymous service accounts. The real ACME directory is synced into the control-plane identity store, and each principal's department becomes a policy segment. Authority has provenance.
Source: Plane 1 — 325,154 principals (120,120 humans + 205,034 NHI), 28 depts / 10 regions / 626 roles; sync_ldap.py → tzt_principal; segment:<dept> → policy.
ContentInspection runs in enforce mode on the data plane. A write is rejected unless it carries both source_type and authored_by — so every stored fact answers "where did this come from" and "who authored it" before it is ever retrieved or acted on.
source_type — the provenance class of the content.
authored_by — the attributable author.
Missing either → the write does not land.
It closes the provenance gap that makes AI outputs un-auditable. Downstream, every memory carries its lineage, so a regulator's "where did the model get this" has a stored answer.
Source: Plane 4 — ContentInspection (enforce) requires source_type + authored_by on writes to acme_soul.
Attribution is the record; SoulWatch is the live guard. Behavioral drift triggers automatic quarantine, and every event streams to your SIEM in standard syslog — so oversight is continuous and exportable, not a quarterly review.
Source: Plane 3 (SoulWatch, deny-by-default, RFC5424 syslog → Promtail:1514 → Loki:3100) · Plane 5 · acme-change-svc :8085.
Because every call is metered through the PEP into tzt_usage, the evidence trail doubles as verifiable economics — the self-host-versus-API answer, observed, not estimated.
| Model tier | Observed $/call | |
|---|---|---|
| opus-4.8 (paid) | $0.19 | |
| sonnet-4.5 (paid) | $0.03 | |
| deepseek-v4-pro | $0.002 | |
| gpt-oss:120b | $0.0015 | |
| Llama-70B (HF) | $0.0012 | |
| gemma:free | $0 |
Source: ROI dashboard (uid acme-roi-economics) — observed per-model $/call from tzt_usage; Grafana :3000.
A signed, tamper-evident chain for every call. Data isolation the database forces. Every action traced to a real principal across 325,154 identities. Provenance required before a fact is stored. When the regulator asks, the answer is already written down — and signed.