Auto-Enrollment

Evaluate the governance protocol

72-hour trial · 5 canonical leaves · no credit card required. Dashboard, REST API, or JavaScript SDK — all three produce cryptographically identical canonical leaves.

72h trial 5 leaves No card required

Start your governance chain

Sign in securely via Cloudflare Access. Your email is verified before a trial tenant is provisioned — your cryptographic governance identity is generated automatically.

Sign in with Cloudflare Access →

Verified email login via one-time PIN. No password required. No credit card.

Three paths to your first canonical leaf
Dashboard REST API JavaScript SDK
Sign upClick above — email or GooglePOST /auto-registerPOST /auto-register
First leafAutomatic (60 sec)POST /governance/evidenceagts.evidence({...})
VerifyClick leaf hash in dashboardGET /log/proof?leaf_hash=...agts.verify(leafHash)
Compliance reportCompliance tab → ExportGET /governance/report/:hashagts.report()
Time to first leaf~60 seconds~5 minutes~10 minutes
Code requiredNoneFour curl commands~15 lines JavaScript
Best forEvaluation, compliance officersBackend integration, CI/CDEmbedded real-time governance
Step 1 of 4

Register your account

~30 seconds

Send your email address. No other information is needed. The API instantly creates a trial tenant — a self-contained governance identity with its own API key and node ID. You will get back everything you need to start submitting governance evidence.

FieldRequiredWhat to put here
emailrequiredYour email address. Used only to send your magic link. Not stored for marketing.
What you get back
  • tenant_id Your organisation's identifier on the clearinghouse — prefix tn_
  • api_key Bearer token for all subsequent API calls — prefix agts_live_ — keep this private
  • node_id Your governance node's cryptographic identity — a 64-char hex SHA-256 of your SPKI
  • log_url The transparency log endpoint where your leaves will be admitted
  • dashboard Direct link to your clearinghouse dashboard with tenant context pre-loaded
bash — POST /auto-register
curl -X POST https://protocol-worker.vlegelsw.workers.dev/v1/register \ -H "Content-Type: application/json" \ -d '{"email": "you@example.com"}' # Response: { "tenant_id": "tn_a7f3c2...", "api_key": "agts_live_...", "node_id": "3b8f1c...", "log_url": "https://log.obligationsign.com/agts/v1/log", "dashboard": "https://app.obligationsign.com/?t=tn_a7f3c2..." }
Step 2 of 4

Submit your first governance evidence

~2 minutes

This is the core protocol call. You are telling the clearinghouse: "I evaluated this AI system, here is the evidence across five governance gates, and I authorise this action." The clearinghouse assembles a Proof Bundle, runs the validator quorum, wraps it in a Governance Envelope, and admits the result as a canonical leaf in the transparency log.

You need to provide a result for each of the five gates (G1–G5) and four cryptographic hashes that commit to your evaluation artefacts. The gate evidence table below explains each field.

FieldRequiredWhat to put here
Top-level
subject_idrequiredA unique string identifying the AI system and version being governed. Use a format like system-name:component:version. This appears in your compliance report and replay walkthrough.
G1 — Semantic Validity (H ≥ 0.40)
resultrequiredPASS or FAIL
confidence_interval_lowerrequiredLower bound of your performance confidence interval. A number between 0 and 1. Example: 0.80
confidence_interval_upperrequiredUpper bound. Must be ≥ lower bound. Example: 0.95
G2 — Financial Validity (C ≥ 0.40)
resultrequiredPASS or FAIL
causal_attributionrequiredtrue if you have evidence the improvement is attributable to your change (A/B test, ablation). false if correlation only.
G3 — Operational Validity (E ≤ 0.60)
resultrequiredPASS or FAIL
protected_metricsrequiredObject of metric names and their current values. Example: {"toxicity_score": 0.02, "refusal_rate": 0.98}. Empty object {} is accepted for initial trials.
G4 — Policy Admission
resultrequiredPASS or FAIL
evidence_classrequiredHow your evaluation was produced: INSTRUMENTED (internal audit log — use this for trials), HOOKED (external harness), or ATTESTED (secure enclave).
G5 — Cryptographic Finalization
resultrequiredPASS or FAIL
operator_idrequiredThe person or system role authorising this action. Your email address is fine. This is recorded in the canonical leaf and appears in the compliance report.
Evidence hashes — four SHA-256 commitments to your evaluation artefacts
dataset_provenance_hashrequiredSHA-256 of your evaluation dataset, test suite, or prompt template. Run sha256sum your-eval-dataset.jsonl in your terminal. This proves which data you evaluated against.
evaluation_trace_hashrequiredSHA-256 of your full evaluation output log. Run sha256sum your-eval-results.log. This proves what results you saw.
ablation_execution_log_hashrequiredSHA-256 of your A/B test or ablation log. If you have no ablation study yet, hash your safety test output file.
capability_certificate_hashrequiredSHA-256 of your model card, benchmark result, or capability specification document. This commits to the model version being governed.
Generating the hashes on the command line

On macOS: shasum -a 256 your-file.txt
On Linux: sha256sum your-file.txt
The hash is the first 64 characters of the output. These are commitments — you keep the originals. The hashes prove the artefacts existed at governance time.

What you get back
  • leaf_index Position of this leaf in the transparency log (integer, starts at 0)
  • leaf_hash The canonical leaf hash — save this, you use it to verify and replay this decision
  • artifact_hash Hash of the full governance envelope — use this to retrieve your compliance report
  • sth.tree_size Current size of the Merkle tree after your leaf was admitted
  • sth.root_hash Current Merkle root — any monitor can verify this independently
  • sth.log_signature Log operator's ECDSA signature over the tree head — cryptographic proof of admission
bash — POST /governance/evidence
curl -X POST https://protocol-worker.vlegelsw.workers.dev/v1/evaluate \ -H "Authorization: Bearer agts_live_..." \ -H "Content-Type: application/json" \ -d '{ "subject_id": "my-ai-system:response-policy:v1.0", "gate_results": { "G1": { "result": "PASS", "confidence_interval_lower": 0.80, "confidence_interval_upper": 0.95 }, "G2": { "result": "PASS", "causal_attribution": true }, "G3": { "result": "PASS", "protected_metrics": { "toxicity_score": 0.02 } }, "G4": { "result": "PASS", "evidence_class": "INSTRUMENTED" }, "G5": { "result": "PASS", "operator_id": "you@example.com" } }, "evidence": { "dataset_provenance_hash": "<sha256 of your evaluation dataset>", "evaluation_trace_hash": "<sha256 of your evaluation output log>", "ablation_execution_log_hash": "<sha256 of your ablation or safety test log>", "capability_certificate_hash": "<sha256 of your model card or benchmark result>" } }' # Response: { "leaf_index": 42, "leaf_hash": "8f3a1b...", "artifact_hash": "c7d9e2...", "sth": { "tree_size": 43, "root_hash": "...", "log_signature": "..." } }
Step 3 of 4

Verify your leaf is in the log

~30 seconds

Use the leaf_hash you received in Step 2 to request a Merkle inclusion proof from the transparency log. The proof is a list of sibling hashes you recompute locally — no trust in ObligationSign is required. You can also paste the leaf hash into the browser verify page and the proof is computed in your browser with WebCrypto.

FieldRequiredWhat to put here
leaf_hashrequiredThe leaf_hash string from the Step 2 response. 64-character hex string.
What you get back
  • audit_path Array of sibling hashes from your leaf to the Merkle root — recompute locally to verify
  • tree_size The tree size the proof is valid for
  • root_hash The Merkle root — must match the STH you received in Step 2
bash — GET /log/proof — or paste into /verify
# Option A — curl (verify by recomputing Merkle path yourself) curl "https://log.obligationsign.com/agts/v1/log/proof?leaf_hash=8f3a1b..." # Option B — browser (WebCrypto verification, no install required) # Open this URL and the proof is computed in your browser: https://obligationsign.com/verify?leaf=8f3a1b...
Step 4 of 4

Retrieve your compliance report

~30 seconds

Use the artifact_hash from Step 2 to retrieve your AGTS_COMPLIANCE_REPORT_V1. The report maps your governance record to six regulatory claims (covering EU AI Act, DORA, Basel III, and ISO 42001). On the free tier the report is generated and viewable — export to JSON or Markdown requires L2.

FieldRequiredWhat to put here
artifact_hashrequiredThe artifact_hash string from the Step 2 response. This is in the URL path, not a query parameter.
AuthorizationrequiredYour API key from Step 1, formatted as Bearer agts_live_...
What you get back
  • claims[0..5] Six regulatory compliance claims, each with status, mapped articles, and the gate evidence that satisfies it
  • leaf_hash Back-reference to the canonical leaf this report covers
  • generated_at ISO timestamp of report generation
  • conformance_level L1 on trial — upgrades to L2+ with paid tier
bash — GET /governance/report/:artifact_hash
curl -H "Authorization: Bearer agts_live_..." \ "https://protocol-worker.vlegelsw.workers.dev/v1/report/c7d9e2..." # Returns: AGTS_COMPLIANCE_REPORT_V1 — 6 claims, 17 sub-articles # Maps your gate evidence to: EU AI Act Art.12/13 · DORA Art.8 · Basel III Pillar 2 · ISO 42001
Step 1 of 3

Register your account and get your API key

~30 seconds

Same as the REST API path. Send your email address to get a tenant_id, api_key, and node_id. You can do this via the sign-up form at the top of this page, or via curl.

bash — POST /auto-register
curl -X POST https://protocol-worker.vlegelsw.workers.dev/v1/register \ -H "Content-Type: application/json" \ -d '{"email": "you@example.com"}' # Save api_key from the response — you will use it in the script tag below
Step 2 of 3

Add the SDK to your page

~2 minutes

Drop a single script tag into your HTML page. No npm, no build step, no dependencies. The SDK loads the protocol client and exposes an AGTS.Client constructor globally.

Config fieldRequiredWhat to put here
apiKeyrequiredYour API key from Step 1. Prefix agts_live_...
subjectIdrequiredA string identifying the AI system being governed. Use the same format as the REST API: system-name:component:version
html — drop into your page
<script src="https://cdn.obligationsign.com/agts-sdk.min.js"></script> <script> const agts = new AGTS.Client({ apiKey: 'agts_live_...', // from Step 1 subjectId: 'my-chatbot:v2.0', // your system identifier }); </script>
Step 3 of 3

Wrap your AI inference call with governance evidence

~5 minutes

Before calling your AI model, collect the five gate results and call agts.evidence(). This assembles a Proof Bundle, submits it to the validator quorum, and admits the result as a canonical leaf — all before your inference call returns. The leaf hash is returned so you can attach it to the response for downstream verification.

The gate fields are identical to the REST API. See the gate evidence table below for field-by-field explanations.

What evidence() returns
  • leaf_hash Canonical leaf hash — include in your API response for clients to verify
  • compliance_url Direct URL to the compliance report for this governance decision
  • leaf_index Position in the transparency log
javascript — governed inference wrapper
async function governedInference(userPrompt) { // 1. Collect gate evidence from your evaluation pipeline const evidence = await agts.evidence({ G1: { result: 'PASS', confidence_interval_lower: 0.81, confidence_interval_upper: 0.95 }, G2: { result: 'PASS', causal_attribution: true }, G3: { result: 'PASS', protected_metrics: { toxicity_score: 0.02 } }, G4: { result: 'PASS', evidence_class: 'INSTRUMENTED' }, G5: { result: 'PASS', operator_id: 'ops@example.com' }, }); // 2. evidence.leaf_hash is now in the transparency log // 3. Attach leaf_hash to your response for downstream verification const result = await callYourInferenceAPI(userPrompt); return { ...result, governance_leaf: evidence.leaf_hash }; }
Gate evidence — field reference

Every governance submission — REST API or SDK — requires a result for all five gates. This table explains each field.

Gate What it represents Minimum fields How to satisfy it
G1 Semantic Validity H (entropy) ≥ 0.40 — semantic diversity firewall against monoculture collapse result, confidence_interval_lower, confidence_interval_upper Run your evaluation suite. Bootstrap or cross-validate. Report the CI bounds (0–1 range).
G2 Financial Validity C (compliance) ≥ 0.40 — financial and regulatory compliance threshold result, causal_attribution (bool) A/B test, ablation study, or before/after comparison that isolates the change.
G3 Operational Validity E (energy) ≤ 0.60 — bounds execution entropy, ensures no protected metric regresses result, protected_metrics (object) Run your regression test suite. Report the value for each metric you protect (e.g. toxicity, refusal rate).
G4 Policy Admission Classification of how your evaluation evidence was produced and its trustworthiness result, evidence_class INSTRUMENTED = internal audit log (use for trials). HOOKED = external harness. ATTESTED = secure enclave.
G5 Cryptographic Finalization Ed25519 signature and Merkle inclusion proof commit the decision to the append-only log result, operator_id The individual or system role that approved the deployment or action. Recorded immutably in the canonical leaf.
The four evidence hashes

These SHA-256 hashes commit to your evaluation artefacts at governance time. You keep the originals. If the decision is ever challenged, you produce the originals and anyone can recompute the hashes to verify they match the canonical leaf.

Hash field Commits to How to generate
dataset_provenance_hashYour evaluation dataset, test suite, or task distributionsha256sum eval-dataset.jsonl
evaluation_trace_hashThe full evaluation output log — what your system produced during testingsha256sum eval-output.log
ablation_execution_log_hashYour ablation study or A/B test execution recordsha256sum ablation-log.json
capability_certificate_hashYour model card, benchmark result, or capability specificationsha256sum model-card.pdf
For a chatbot — simplest valid case

Hash your prompt template file, your safety test output file (run twice for the ablation if you have no A/B test), and your model's README or spec sheet. These are four file hashes — one command each. The hashes prove those artefacts existed at governance time without uploading the files anywhere.

What the free tier includes
Capability Free (L1) Requires paid tier
Proof bundle generation (ECDSA P-256)✓—
Canonical leaves in shared log✓—
Merkle inclusion proof✓—
Compliance report (6 claims, 17 sub-articles)✓ view onlyExport (JSON/MD) requires L2
REST API + webhooks✓—
JavaScript SDK✓—
Replay (gate-by-gate walkthrough)✓ own leaves—
External validator quorum (3-of-4)✗L2+
Sovereign Authority signature✗L2+
Closed-loop (triple-leaf)✗L2+
Witness countersignature on STH✗L4
Insurance recognition✗L3/L4
See full pricing → Read the quickstart guide →