The Agent Oversight Layer
AI leaders are publicly asking to slow down over losing control of autonomous agents. The gap they describe already has a number: 72% of organizations can’t trace an agent’s actions back to a human sponsor. We can — cryptographically, verifiable by anyone, from $0.05.
The evidence — verified 18 sep 2026, sourced below
72%
of organizations cannot trace an agent's actions back to a human sponsor across all environments.
Cloud Security Alliance, 2026 survey
$17M
Series A raised by Vouched, an AI agent identity verification platform — real capital already flowing into this exact gap.
2 Dec 2027
EU AI Act high-risk obligations — including Article 12 (record-keeping) and Article 14 (human oversight) — now apply from 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I), after the Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 Jul 2026. Article 50 transparency has applied since 2 Aug 2026. A fixed date, and audit trails take time to build.
Singapore’s IMDA Model AI Governance Framework for Agentic AI (Jan 2026) requires every agent to carry a verifiable digital identity and an audit trail of who authorized what. NIST’s AI Agent Standards Initiative (Feb 2026) names the same gap: agents are “treated as generic service accounts, without dedicated identity, authorization, or accountability controls.”
Not a new product — five you already run in production
Every card below is live, signs with Dilithium-3 (ML-DSA-65, NIST FIPS 204), and settles real payments via x402. Click through to the real page.
KYA — Agent identity
A verifiable digital identity for every agent
Singapore IMDA · NIST AI Agent Standards
OpenBlack Box — Continuous audit trail
Who did what, when, under whose authorization
Singapore IMDA governance framework
OpenAI Notary — Decision-level proof
Re-verifiable proof of one specific decision
EU AI Act Art. 12 · SR 11-7
OpenCityLedger — Public-sector receipts
Auditable algorithmic decisions, citizen-verifiable
EU AI Act Art. 12 · due process
OpenProvenance — AI-content marking
Machine-readable mark on AI-generated output
EU AI Act Art. 50
OpenWhat this proves — and what it doesn’t
✓ Proves
- A declared agent identity signed this decision, unaltered since
- A human operator is cryptographically bound to the agent
- Any tampering with the audit trail after the fact is detectable
- Resistance to known classical & quantum attacks (NIST FIPS 204) — not “unbreakable”
✗ Does not certify
- That the agent’s decision was correct, fair, or lawful
- Automatic regulatory compliance — you remain responsible for your own assessment
- That the declared operator is a legitimate entity (separate operator KYC)
- Future agent behavior — only what already happened and was signed
Pre-pilot. Every product above is usable today, free tier included.