The evidence clearing house for AI infrastructure.
From the model to the credential to the hardware to the grid. Prove it to any auditor. Verify it anywhere.
Your models make decisions. Your agents authenticate with service accounts. Your hardware has a supply chain. Your data center consumes power. The Sovereign Witness Traceability protocol (SWT3) creates a tamper-evident record of every action across the full AI infrastructure stack -- anchored with SHA-256, mapped to 36 regulatory frameworks, and verifiable by any auditor without contacting you. One protocol. One fingerprint formula. One verification endpoint.
$pip install swt3-ai
$npm install @tenova/swt3-ai
$cargo add swt3-ai
$dotnet add package swt3-ai
$gem install swt3-ai
Three teams. Three jurisdictions. Three different regulatory requirements. Today, trust between AI systems is fragmented -- manual verification, incompatible audit formats, and no way to prove compliance across borders. Trust Mesh replaces that: every system proves its compliance posture before data flows.
There is no server in the middle. Verification happens locally, with cryptographic proof that survives any audit. SWT3 is an open protocol with Apache-licensed SDKs in 10 languages. Anyone can implement it. No vendor dependency. Every partner that connects speaks the same protocol. That is the network effect.
Four phases. No agents installed. No data retained. No central authority.
The SDK observes your AI inference at the point of execution. Evidence factors are captured and SHA-256 hashed locally. Raw prompts and responses never leave your infrastructure.
Factors are sealed into an SWT3 Witness Anchor -- a tamper-evident receipt binding evidence to a verdict at a specific moment in time. The fingerprint formula is locked and identical across 10 languages.
Any party can independently verify the anchor using the open-source library or a browser. No API keys. No vendor access. SHA-256 runs locally. Just math.
Policy-as-code rules declared in .swt3.yaml are evaluated at every tool call. Violations are recorded with full forensic context. The witness captures what happened and whether it matched policy.
Open protocol. Commercial platform. From solo developers to sovereign enclaves.
The evidence layer for AI systems. Cryptographic attestation for every inference. Trust Mesh for agent-to-agent verification. Policy-as-code governance for tool execution. 266 procedures mapped to EU AI Act, NIST AI RMF, CMMC, SR 11-7, and 32 more frameworks. Zero data retention. Three lines of code. SDKs in 10 languages. 22 integrations including OpenAI, Anthropic, Bedrock, LiteLLM, Ollama, vLLM, Cohere, Qdrant, LangChain, LangGraph, Google ADK, CrewAI, Microsoft AGT, and MCP.
Protocol Specification →The managed platform for AI compliance evidence. Your SDK sends anchors. We store them. Your auditor verifies them. Read-only auditor portal with finding register, completeness scoring, and decision chain visualization. Export W3C Verifiable Credentials for vendor due diligence -- self-verifiable, standards-compliant, interoperable with EU Digital Identity Wallet workflows. Framework-mapped evidence views for EU AI Act, NIST, CMMC, IMDA, and 24 more. Bring your own infrastructure scans via evidence ingestion. Cloud, on-prem, or air-gapped.
Explore the Dashboard →Every machine running your AI has a hardware fingerprint -- GPU model, CPU architecture, runtime environment. If a workload migrates to different silicon, a GPU fails silently, or your cloud provider live-migrates a node, your compliance posture just changed and nobody recorded it. The SWT3 Witness DaemonSet runs on every node in your cluster and creates a tamper-evident record of the hardware actually executing your models. One install command. Zero code changes. Works across AWS, GCP, Azure, and on-prem.
helm install swt3 oci://ghcr.io/tenova-labs/charts/swt3-witness --version 0.5.9AI assistants call external tools -- APIs, databases, code interpreters, file systems. Every tool call is a decision with compliance implications: what data was accessed, which model made the call, and whether policy allowed it. The SWT3 MCP server sits between your AI assistant and its tools, witnessing every call without changing how your tools work. 59 compliance tools and 2 audit resources. Works with Claude Desktop, Cursor, Windsurf, and any MCP-compatible client.
npx @tenova/swt3-mcpYou already sign containers, generate SBOMs, and enforce policy gates. None of that covers what your AI does after deployment. SWT3 fills the gap -- same pipeline, same attestation chain, one new stage.
Source code is signed. Container images are verified with cosign. Build provenance meets SLSA Level 2. SBOMs are generated with Syft or Trivy. OPA or Kyverno gates admission. Everything is covered -- until your model serves its first prediction. After deployment, there is no attestation. Runtime AI decisions are a gap in your evidence chain.
Every AI decision in production mints a witness anchor with the same cryptographic rigor as your build signatures. Model version, input hash, output factors, policy verdict, jurisdiction, timestamp. The attestation chain extends from source commit to container image to runtime decision. No gap. Auditable end to end.
SWT3 fits into your existing CI/CD workflow as a stage, not a replacement. Gate deployments on witness coverage. Verify anchors in your admission controller. Export evidence chains for incident response. No application code changes required for transport-level witnessing.
# .github/workflows/deploy.yml — verify witness coverage before promotion
- name: Verify Witness Anchor
run: |
# $SWT3_ANCHOR is set by the witness SDK flush in a previous job,
# or read from a CI artifact (e.g. .swt3/last-anchor.txt)
FINGERPRINT=$(echo -n "$SWT3_ANCHOR" | cut -d'-' -f8)
curl -sf "https://sovereign.tenova.io/api/v1/verify?fingerprint=$FINGERPRINT" \
| jq -e '.verified == true' || exit 1
# Exit 1 blocks the deploy. No API key. Public endpoint. Just math.# .swt3.yaml — commit this to your repo. Same file works in any CI system.
require:
- AI-TOOL.1 # tool execution attestation
- AI-MDL.5 # model weight verification
- AI-INF.1 # inference provenance
min_coverage: 0.95
block_on_fail: true
clearing_level: 1 # L1 Standard — hashes only, no raw data leaves your infra# This is a witness anchor. One line. Grep it, index it, verify it.
SWT3-E-AWS-AI-TOOL1-PASS-1723891200-a4f8c92d0e17
│ │ │ │ │ │ └─ SHA-256 fingerprint (12 hex)
│ │ │ │ │ └─────────── epoch timestamp
│ │ │ │ └──────────────── verdict (PASS / FAIL)
│ │ │ └──────────────────────── procedure (AI-TOOL.1)
│ │ └──────────────────────────── cloud provider
│ └─────────────────────────────── deployment tier (E = Enclave)
└──────────────────────────────────── protocol prefixThe Witness Middleware wraps AI tool-call transports at the HTTP layer. Drop it into Express, Fastify, Rails, or any HTTP framework, including MCP (Model Context Protocol) servers. Every tool call is attested before it reaches your application code. No code changes. One wrapper, every call witnessed.
The SWT3 DaemonSet runs on every node and records the hardware actually executing your models. GPU model, CPU architecture, runtime environment. If a workload migrates or silicon changes, the attestation chain captures it.
A model drifts at 2am. Pull the anchor chain: which model version, which pipeline deployed it, which policy approved it, when drift started, which tool calls were affected. Export the forensic timeline and hand it to your security lead.
Declare attestation requirements in .swt3.yaml. Enforce minimum witness coverage before promotion to production. Same policy file works in GitHub Actions, GitLab CI, Jenkins, or ArgoCD sync hooks.
SWT3 anchors complement your existing supply chain attestation. They do not replace Sigstore, SLSA, or your SBOM toolchain. They extend your evidence chain into the one place those tools cannot reach: what your AI decided after you deployed it.
AI decisions are moving to phones, tablets, vehicles, and field devices. Governance evidence should follow, even when the network doesn't.
An AI model on a user's iPhone recommends a medical triage level, scores a credit application, or classifies a field defect. That decision happened on-device, and the evidence should be just as protected. The SWT3 Swift SDK signs every witness anchor using Apple's Secure Enclave, the same hardware that protects Face ID and Apple Pay. Core ML predictions are recorded with the device's location, the chip that executed the model, and the model version. The evidence is tamper-proof at the silicon level.
If the decision matters, the proof should be as secure as the decision itself.
Mobile Edge Attestation Guide →Most of the world's mobile devices run Android. In markets across Africa, Southeast Asia, and Latin America, AI governance is a mobile-first problem. The SWT3 Kotlin SDK brings compliance witnessing to Android applications and any JVM environment, with offline-capable evidence collection that synchronizes automatically when connectivity returns.
A field worker uses an AI-powered inspection tool with no cell signal. A banking app runs fraud detection locally before the transaction clears. An agricultural platform classifies crop health from a camera image in a rural district. These decisions happen where networks are unreliable, but the governance evidence is never lost. It collects on-device and flushes when the connection comes back.
Edge Attestation Guide →An AI model runs on a phone. It classifies an image, approves a transaction, recommends a diagnosis. Then the app closes. The decision existed only in device memory. When a regulator, auditor, or affected person asks "what happened and why?", there is nothing to show them.
Every on-device inference creates a witness anchor signed by the device's secure hardware. Which model ran. What chip executed it. Where the device was. What the output was. The evidence collects offline and synchronizes when connectivity returns. Months later, any auditor can verify exactly what happened and confirm the record was never altered.
AI does not run in a vacuum. It authenticates with service accounts, runs on hardware with supply chains, and consumes enough electricity to reshape power grids. The same protocol that proves your model followed the rules now proves your credentials are governed, your hardware supply chain is documented, and your energy consumption is independently attested.
AI agents authenticate to APIs, databases, and other agents using service accounts, API keys, and OAuth tokens. These machine credentials outnumber human users 45-to-1 in a typical enterprise. When the auditor asks "how many service accounts does your AI use?", most organizations have no answer. Six new witness methods create an independent record of credential scope, rotation, delegation, and revocation -- without replacing your identity provider.
NHI Governance Guide →The EU Battery Regulation requires digital passports for every battery above 2 kWh -- including thousands of UPS batteries in AI data centers. The Cyber Resilience Act requires hardware bills of materials. The Energy Efficiency Directive requires PUE reporting. Ten new witness methods cover hardware inventory, component lifecycle, battery health, supply chain provenance, and end-of-life disposition.
HBOM / Battery Passport Guide →AI training runs consume as much power as small cities. When the grid operator sends a curtailment signal, settlement disputes run six figures because there is no independent attestation of what actually happened. Six new witness methods cover the full demand response lifecycle: grid signals, baseline measurement, actual curtailment, financial settlement, and carbon credit provenance.
ADR Demand Response Guide →A single EU data center faces the Energy Efficiency Directive (PUE reporting), EU Battery Regulation (digital passports), Cyber Resilience Act (hardware BOMs), CSRD/ESRS (sustainability disclosure), and NIS-2 (credential governance). Five regulations, five compliance teams, five evidence formats -- until now. One SDK covers all five with the same fingerprint formula, the same clearing engine, and the same verification endpoint.
Data Center Compliance Guide →Cross-border trust requires cross-border privacy. The clearing engine strips sensitive content before it leaves your jurisdiction. The proof survives. The data doesn't.
Full context: hashes, factors, model ID, provider, guardrails. For internal R&D and pre-deployment testing.
Default. Hashes and factors only. No raw prompts or responses cross the wire. Production-grade privacy.
Hashes, factors, model ID only. No provider metadata. Built for healthcare, legal, and PII workloads.
Numeric factors only. Model ID hashed. Zero metadata. Built for defense, sovereign cloud, and air-gapped environments.
Native mapping to the frameworks that matter. Not a crosswalk bolted on after the fact.
Read-only, time-limited, cryptographically verified. The auditor sees exactly what they need and nothing they should not.
Auditors annotate findings with severity classification (Major / Minor / Observation) per EU AI Act Article 43. Every finding is linked to SWT3 anchors.
Multi-agent decision chains with cryptographic proof at every node. Swimlane visualization showing human, orchestrator, and worker interactions. Policy violations flagged inline.
One-click Annex V conformity report. Pulls findings, checklist status, and corrective actions into a print-ready document with its own SWT3 anchor.
Sit between your app and the model. Can be bypassed. Cannot see inside private enclaves. Store prompts and responses on their servers. Single point of failure. Cannot operate cross-border without a central server.
Embedded in your execution logic. Cannot be bypassed. Works inside private enclaves, air-gapped networks, and sovereign clouds. Stores only cryptographic proofs. Agents verify each other directly. No central server. No borders.
Start with the protocol. Scale with the platform. Every path leads to auditor-grade evidence.
Click through a live audit portal with real compliance evidence. No signup, no sales call. If the evidence speaks for itself, install the SDK or reach out to engineering. The protocol is free and open.