Traefik Labs brings independent verification to AI agent governance

Traefik Labs has introduced the Sovereign Trust Plane (STP), a set of capabilities in Traefik Hub that brings verifiable evidence to AI agent governance, with general availability planned by September 30, 2026. STP connects delegated access, policy enforcement and protected records of what the gateway allowed and refused across model, tool and API traffic.

As agents begin issuing refunds, accessing customer data and changing business records, accountability reaches beyond the team that runs the platform. Security leaders must explain whose authority an agent carried, risk and compliance teams must show that controls worked, and product teams must investigate decisions made long after the conditions changed.

STP is built around those three responsibilities:

For CISOs, accountability that can withstand independent review. When an agent moves money, the CISO needs to establish who authorized it and which policy applied, without asking the platform team to piece together the history. STP brings delegation, enforcement and record integrity into one architecture. Separately administered witnesses let someone outside that team verify that previously witnessed history has not been rewritten or shortened.

For risk and compliance teams, evidence of what controls prevented. A refused action matters as much as a completed one when assessing whether a control worked. STP protects recorded approvals and refusals against undetected alteration. The record carries the decision, the policy that produced it, and both the person and the agent that acted. Its evidence path is separate from incident telemetry, so the audit record is unsampled.

For product and agent teams, a basis for understanding what happened. Investigating a bad action requires the request and relevant context recorded at the time. Today’s configuration cannot explain yesterday’s decision. STP connects gateway records to traces and extends enforcement to both the agent’s tool call and the tool’s call to the backend API, where money moves or data changes. Application records supply the business outcomes needed for a full investigation.

“An auditor should be able to check the record without taking our word for it,” said Emile Vauge, founder and CTO of Traefik Labs. “An independent witness gives them a way to challenge a history that has been rewritten, even when the operator controls the log and its signing key.”

Delegate. Authorize. Prove.

STP brings these responsibilities together through three capabilities:

• Delegate exchanges credentials through the organization’s identity provider to obtain access for the intended resource, implementing the IETF Identity Assertion JWT Authorization Grant (ID-JAG), the draft specification behind Okta’s Cross App Access. The identity provider controls the permissions issued, allowing organizations to constrain delegated authority as work crosses systems. Because the assertion names both the person and the agent, an agent can be granted strictly less than the person it acts for.
• Authorize asks the organization’s policy engine whether a particular API request or Model Context Protocol (MCP) tool call is permitted and enforces the answer before forwarding it. The OpenID AuthZEN interface lets teams connect compatible policy engines while retaining their own policies and decision logic.
• Prove commits cryptographic fingerprints of gateway logs and access logs to a transparency log. A verifier checks retained records against those commitments and signed checkpoints, making changes detectable while the original log content stays in customer-controlled storage.

Traefik Labs has verified the exchange end to end, RFC 8693 then RFC 7523, with Okta Cross App Access and the self-hostable Janssen Auth Server, so the chain closes without a cloud identity service in the path. It has also verified enforcement with OpenFGA and Cerbos through AuthZEN middleware built into the gateway.

Traefik Hub combines API, AI and MCP gateway capabilities in one runtime, deployable wherever enforcement is needed, and enforces business restrictions across models, tools and API paths, including the often overlooked connection from an MCP server to its backend. The backend remains responsible for transaction correctness.

One capture serves several consumers. The same log lines feed the security team’s SIEM and the evidence record, while traces and metrics support incident response.

Verification under the customer’s control

A signed log alone leaves a difficult question: could the operator discard recent entries and sign a different history? An independent witness answers it, by retaining a checkpoint and checking that every later checkpoint extends the history it already accepted. Reviewers can require witness signatures and check freshness when verifying the record.

The witness receives cryptographic checkpoints and proofs, without the underlying requests or log contents. Organizations can place it under a separate risk team or an auditor’s control, including inside a private or air-gapped network, under separate administration and key custody.

The gateway, evidence storage and verifier run on infrastructure the customer controls, with customer-selected identity and policy services. Offline deployment options support environments where governance must operate without a SaaS control plane in the request path.

“The real test of enterprise AI is whether we can trust it with work that matters,” said Sudeep Goswami, CEO of Traefik Labs. “That takes clear limits, accountability when something goes wrong, and evidence people can check. We want enterprises to put agents to work with those foundations in place from the start.”