Verify every agent request. Prove every decision.
Originary verifies agent requests, applies policy, and returns signed records you can prove later. PEAC is the open standard underneath.
Logs stay local. Records travel.
POST /api/bookings
Authorization: Bearer <agent-token>
// Originary evaluates
-> agent identity: verified
-> policy matched: bookings.default
-> decision: allow
// Signed record returned
PEAC-Receipt: eyJhbGciOiJFZERTQ...
// Ed25519 · portable · offline-verifiableEvidence of execution
When an agent calls your API or tool, can you answer who acted, what policy applied, and prove it later?
Most systems do not make agent request decisions explicit. What teams usually lack is a verifiable interaction record of how the request was evaluated, what policy was applied, and what decision was made.
When an agent hits your API, tool, or MCP server, three things matter:
- Who sent the request
- What policy applied
- What record exists afterward
Originary gives you that record without asking you to replace the rest of your stack.
Built for verification, not vendor dependency
Self-hostable
Run verification on your own infrastructure. No external service dependency.
Offline verification
Verify any record using the public key alone. No API calls, no network required.
Exportable records
Verifiable interaction records your team can inspect, share, archive, and use in disputes.
Open standard, no lock-in
Built on PEAC Protocol (Apache-2.0). Records are portable across systems and vendors.
Enterprise ready
Why teams trust this
Verifiable evidence
Every agent interaction produces a signed record with Ed25519 signatures. Third parties can verify independently.
No vendor callback
Verification uses public keys via JWKS. No API call to Originary or any other service required.
Audit and dispute ready
Records are portable, timestamped, and exportable. Use them for compliance, procurement evidence, or dispute resolution.
Built for operators, not just builders
Originary is built first for teams running the systems that agents access. If your stack receives agent requests, Originary gives you the verification layer.
APIs receiving agent traffic
Evaluate incoming agent requests, apply rate and access policy, return signed records of every decision.
MCP servers and tool hosts
Add verification middleware to any tool endpoint. Signed records travel with the response.
Platforms exposing actions to agents
Policy sits at the boundary. Records prove what was allowed, denied, or challenged.
Security and compliance teams
Exportable, portable records for audit, disputes, and procurement review. Offline-verifiable.
Works with your existing gateway, auth, payments, and observability stack.
How it works
Evaluate the request
An agent calls your API or tool. Originary checks who is calling and what they want.
Apply policy
Your rules decide: allow, deny, rate-limit, charge, or require approval.
Emit the record
A verifiable interaction record is returned. Your team can inspect, verify, and export it later.
Request lifecycle
Evaluate
Classify inbound request using available signals
Apply policy
Your rules determine the access decision
Emit record
Signed record returned and exportable
Evaluate
Classify inbound request using available signals
Apply policy
Your rules determine the access decision
Emit record
Signed record returned and exportable
Works with the signals you have today. More signals produce stronger decisions and more complete records.
Logs show what happened. Originary proves it.
Logs and traces help with debugging. They do not replace explicit policy decisions or exportable records.
Originary adds:
- Evaluate requests before action is taken
- Apply explicit policy decisions
- Keep exportable records for review and disputes
Debug system behavior
Make access decisions
Keep an exportable record
Support cross-team review
Open standard underneath
| Need | Logs / traces | Originary |
|---|---|---|
| Debug system behavior | Yes | Partial |
| Make access decisions | Limited | Yes |
| Keep an exportable record | No | Yes |
| Support cross-team review | Weak | Yes |
| Open standard underneath | No | Yes |
Not another observability product
Logs stay inside your system. Records travel.
An agent calls your API. What can another party verify?
Use the product. Keep the record portable.
Originary is the product you deploy. PEAC is the open standard that keeps your records portable across systems and vendors. No lock-in.
Ed25519 signatures, verified offline with a public key
28 packages on npm, 6,443 tests
Offline-verifiable with public key alone
Apache-2.0, self-hostable, vendor-neutral
Frequently asked questions
See it for yourself
Open a real signed record, inspect every claim, and verify the signature. No account required.
Not a developer? Talk to us about enterprise deployment · Security and procurement · Press