Sengol

Signed, offline-verifiable evidence for AI agents in regulated institutions.

Sengol evaluates every agent response against a ControlBook (a regulation expressed as configuration), gates deployments in CI, and writes each verdict as an HMAC-signed, hash-chained, Ed25519-countersigned record. An auditor verifies the exported evidence pack months later, on a laptop, without Sengol: the gate verdict and the audit record are the same signed object.

Sengol is self-hosted and single-tenant: one install is one tenant, inside your own network. Nothing leaves it.

Regulations arrive as configuration: OSFI E-23, FINTRAC, PIPEDA, SR 11-7, EU AI Act, GDPR, HIPAA, NIST AI RMF, ISO 42001 and more, 29 cataloged total in sengol/policies/catalog.yaml; a custom internal policy is one more entry.

Fifteen-minute quickstart

make keys          # Ed25519 evidence signing key into .env
make demo          # Postgres + API + Console, seeded with a five-agent demo fleet, the OSFI E-23 ControlBook and a review queue
open http://localhost:8000
sengol gate --config sengol.yaml                      # verdict = signed record
sengol export --agent rag-advisor-001 --out pack.zip
# Published on PyPI (see docs/evidence/offline-verification.mdx):
pip install "sengol-verify>=2.1.0"
sengol-verify pack.zip --trusted-key "<key_id>=<appliance-key.pem>"   # verify without Sengol
# <key_id> and the Ed25519 public key come from the operator, not from pack.zip. Without
# --trusted-key the countersignature step is UNVERIFIABLE and the exit code is 3
# (see docs/evidence/offline-verification.mdx).

The full walk-through, Entra ID and SCIM setup, and the operator references are in docs/ (quickstart.mdx first). Product scope is in PRODUCT.md; current state in STATUS.md.

Licence

Sengol 2.0 is proprietary software. A signed licence file (SENGOL_LICENSE_FILE) is verified offline at boot against the public keys in sengol/governance/trusted_keys/; the API and sengol worker run refuse to start without one. The sengol CLI is otherwise an API client and needs no local licence. There is no free tier. A lapsed licence never costs access to evidence: export and verification keep working, including with the separate sengol-verify. Fourteen-day trials and licences are issued at https://sengol.io/signup.html.

A build trusts only the anchors it ships. From the first release carrying the 2026-09-prod anchor, production licences verify; releases cut before it have an empty trusted_keys/MANIFEST.json and verify nothing. Check STATUS.md for the release you are installing.

The verifier, sengol-verify, is Apache-2.0 and has no dependency on this package.

Development

uv sync --all-extras, then uv run pytest --timeout=60. Tests marked postgres need a live database (docker compose up postgres). Invariants and review rules are in AGENTS.md; session rules in CLAUDE.md.