For teams running agent-facing systems

Verify every agent request.
Prove every decision.

Originary verifies agent requests, applies policy, and returns signed records you can prove later. PEAC is the open standard underneath.

Open sourceSelf-hostableOffline verificationDownloads
The real question

Who called. What happened. Where's the proof?

Most systems do not make agent request decisions explicit. What teams usually lack is a verifiable interaction record of how the request was evaluated, what policy was applied, and what decision was made.

When an agent hits your API, tool, or MCP server, three things matter:

Who sent the request
What policy applied
What record exists afterward

Originary gives you that record without asking you to replace the rest of your stack.

Logs vs. decisions

Logs show what happened. Originary proves it.

Logs and traces help with debugging. They do not replace explicit policy decisions or exportable records.

Signed recordPortable proof
Issuer: tools.vendor.com
Type: org.peacprotocol/access
Policy: sha256:3f8a...c7e1 ✓
Signature: Ed25519, valid
Verify: local, no callback
Verifiable by any party, offline.
Internal logsLocal only
14:23:01Agent invoked tool: check_inventory
14:23:01External API call: GET /api/v2/inventory
14:23:02Policy: tools.check_inventory → allow
14:23:02Result returned to agent
Useful for debugging. Not portable.

Debug system behavior

LogsYes
OriginaryPartial

Make access decisions

LogsLimited
OriginaryYes

Keep an exportable record

LogsNo
OriginaryYes

Support cross-team review

LogsWeak
OriginaryYes

Open standard underneath

LogsNo
OriginaryYes

Originary adds:

Evaluate requests before action is takenApply explicit policy decisionsKeep exportable records for review and disputes
Who this is for

Built for operators, not just builders

Originary is built first for teams running the systems that agents access. If your stack receives agent requests, Originary gives you the verification layer.

API operators

An agent books a resource through your API

You need to know who authorized it, under what policy, and prove the decision later when the charge is disputed.

MCP server hosts

An MCP tool call modifies production data

The tool host needs a signed record of what was requested, what was allowed, and what the agent actually did.

Platform teams

A partner asks for proof of an agent interaction

You export a portable record they can verify independently, offline, without calling your systems.

Security and compliance

An auditor reviews agent-driven transactions

Compliance needs exportable evidence tied to the policy that applied at decision time, not just logs.

Works with your existing gateway, auth, payments, and observability stack.

Why this matters now

Agent traffic is exploding. Controls are not.

01

Agents are crossing boundaries

APIs, tools, and MCP servers handle agent traffic from organizations they do not control. Standard proof is missing.

02

Compliance is catching up

EU AI Act transparency obligations apply from August 2, 2026. Auditable records of automated decisions will be expected.

03

Logs are not enough

Internal observability helps you debug. It does not help a partner, auditor, or regulator verify what happened.

Why trust Originary

Built for verification, not vendor dependency

Every record is self-contained. Verification is local. No dependency on Originary at verification time.

01

Self-hostable

Run on your own infrastructure. No external dependency.

02

Offline verification

Verify with the public key alone. No network required.

03

Exportable records

Inspect, share, archive, and use in disputes.

04

Open standard

PEAC Protocol, Apache-2.0. Portable across vendors.

05

Ed25519 signatures

Every record is cryptographically signed and verifiable.

06

Audit and dispute ready

Timestamped evidence for compliance and procurement.

Open standard

Deploy Originary. Keep your records portable.

Originary is the product you deploy. PEAC is the open standard that keeps your records portable across systems and vendors. No lock-in.

Ed25519 signatures, verified offline with a public key

28 packages on npm, 6,443 tests

Offline-verifiable with public key alone

Apache-2.0, self-hostable, vendor-neutral

FAQ

Frequently asked questions

A verifiable interaction record is a portable, cryptographically signed artifact that proves what an agent did, what policy applied, and what decision was made. It can be verified by anyone with the public key, with no network call required.

See it for yourself

Open a real signed record, inspect every claim, and verify the signature. No account required.

Not a developer? Talk to us about enterprise deployment · Security and procurement · Press