A2a Trustgate

a2a-trustgate

Compliance for AI systems in production.

You put an AI agent in production. Now prove it's safe — to your auditor, your regulator, your board.

A2A TrustGate screens every action an agent takes *before* it runs, and writes the decision to an immutable, SIEM-ready audit trail. Not a policy document that says agents *should* behave — a control that stops the ones that don't, and the evidence to prove it.

• Enforced, not promised. Every agent action passes a 4-gate firewall before it executes. Out-of-policy actions are blocked in milliseconds, not flagged after the fact.
• An audit trail an auditor will accept. Every decision — allowed or blocked, with reasoning — lands in an append-only, OCSF-native log that drops straight into Splunk, Sentinel, Chronicle or Elastic.
• Mapped to the frameworks you're measured against. Export the same evidence against EU AI Act, SOC 2, NIST AI RMF, HIPAA and academic-integrity controls — article by article, control by control.
• Provable scope. Each agent may act only within the permissions it was granted. Deny-by-default, and every boundary is in the log.

Who it's for: compliance and risk teams putting AI into regulated production — financial services, healthcare, network operations, creative/IP rights, enterprise AI adoption, and research institutions. If someone can ask you *"prove your AI is safe,"* this is the answer.

*Agent proposes an action, the gate screens it, the decision lands in the audit trail — watch the full demo.*

The audit trail an auditor will accept

Most "AI governance" is a PDF that describes intentions. A2A produces evidence. Every screened action becomes a genuine OCSF Detection Finding — the same schema your SOC already ingests — with a tamper-evident content hash and the full decision reasoning:

a2a audit                          # recent decisions, allowed and blocked

a2a audit export --format ocsf # OCSF Detection Findings — straight into your SIEM a2a audit export --format csv # hand a spreadsheet to an auditor

• OCSF-native (schema 1.1.0). Not a bespoke JSON blob labelled "OCSF" — real Detection Findings that Splunk / Sentinel / Chronicle / Elastic parse without a custom connector.
• Tamper-evident. Every record carries a content hash; the export is append-only. You can prove the log wasn't edited after the fact.
• Framework-mapped exports. The same underlying events export against the control set you're being audited on:

EU AI Act deployer? Read the EU AI Act compliance reference — an article-by-article crosswalk (Art. 12 record-keeping, Art. 14 human oversight, Art. 26 deployer obligations) with citations to the official EUR-Lex text. The Regulation becomes generally applicable 2 August 2026.

Enforced before it runs — the 4-gate firewall

Compliance you can prove starts with a control that actually stops things. Every action passes four gates before it's allowed to execute:

• Gate 1 — deterministic rules. Pattern and policy screening in milliseconds: destructive operations, secret exfiltration, injection signatures. No model call.
• Gate 2 — self-evaluation. For anything Gate 1 can't clear outright: *should this run, given the context and the tenant's policy?*
• Gate 3 — behavioral analysis. Abuse patterns across a run — bursts, probing, escalation — not just the single action in isolation.
• Gate 4 — scope enforcement. Per-agent permissions: each agent may act only within the scope it was granted. Out-of-scope actions are denied by default.

The firewall only ever *tightens* a decision — allow → review → block. A safe action stays fast; a risky one is stopped and recorded with the reason.

For developers — screen an action in one command

The whole control is a CLI (and an MCP server). Wrapping a risky step is one line, and exit codes make it scriptable:

a2a eval "rm -rf ./build"          # ✓ ALLOWED   (exit 0)

a2a eval "rm -rf /" # ✗ BLOCKED (exit 1) — filesystem destruction pattern a2a eval "command" --context ctx # add decision context (exit 2 = needs review)

Works with: Claude Code · Cursor · Cline · Windsurf · Aider · Codex · any MCP client.

Install

npm install -g a2a-trustgate

The npm package is a2a-trustgate; the command is a2a.

Quick Start

# Create a tenant (agent-first — human activates the key)

a2a signup my-company --local

Screen a command — exit 0 = allowed, 1 = blocked, 2 = needs review

a2a eval "rm -rf ./build"

✓ ALLOWED

a2a eval "rm -rf /"

✗ BLOCKED: filesystem destruction pattern

See plan, usage, limits

a2a status

Full reference

a2a --help

Your key is issued immediately but returns 402 until you start your 7-day free trial ($0 today) — a2a signup prints the activation link. Cancel before day 7 and you're never charged.

The eval call has a few knobs, and it's scriptable — wrap any risky step:

a2a eval "command" --gate2 self    # self-evaluate (default)

a2a eval "command" --gate2 skip # Gate 1 only (fast path) a2a eval "command" --pipeline ID # route through a named pipeline

if a2a eval "rm -rf ./build" --json 2>/dev/null; then rm -rf ./build fi

Built for six kinds of team

A2A screens the same way for everyone and produces the same audit trail — but the surface each team touches, and the framework they're measured against, is different. Pick yours.

Network operations — a gate in front of every device

Your agents run commands against routers, switches, and sites. A2A registers each device, enforces a per-device policy, and gives you a killswitch that stops every agent at once.

a2a device add --name core-rtr-1 --host 10.0.0.1 --vendor cisco

a2a device policy DEVICE-ID --mode strict --require-approval --max 5 a2a device lock DEVICE-ID # freeze a single device a2a killswitch # freeze every agent, everywhere a2a device import --file hosts.csv # bulk onboard (name,host,vendor,model,role,siteCode)

*Watch the full clip: network-ops →*

AI agents — agent-to-agent, screened and signed

Multi-agent systems where one agent's output is another's input. A2A gives them scoped workspaces and HMAC-signed channels, so a rogue or injected message can't cross a boundary you didn't grant.

a2a workspace create "research-swarm"

a2a workspace WS-ID add-agent --name planner --role expert a2a workspace WS-ID enforce --agent planner "command" # screen an agent's action a2a channel create ops-bus a2a channel CH-ID send "interface frozen — you're clear to build" # HMAC-signed

*Watch the full clip: ai-agents →*

Regulated industries — an immutable, exportable audit trail

Every decision — allowed or blocked, with reasoning — lands in an append-only log you can export for an auditor. OCSF-native Detection Findings, EU AI Act aligned.

a2a audit                          # recent decisions

a2a audit export --format ocsf # OCSF Detection Findings → your SIEM a2a audit export --format csv # hand to an auditor (csv/json) a2a approvals # human-in-the-loop queue a2a approve TASK-ID a2a reject TASK-ID "out of policy" # reason recorded in the trail

*Watch the full clip: regulated →*

Creative & IP owners — licence before access

Register your catalogue, mint scoped licences, and every agent that reaches for an asset is checked against a rights log. Access is granted by licence, not by scraping.

a2a catalogue create "The Back Catalogue"

a2a catalogue licence create --catalogue CAT-ID --email studio@label.com --scope read a2a catalogue access-log # who reached for what, and whether it was licensed a2a catalogue content-sources

*Watch the full clip: creative →*

IP aggregators & distributors — onboard an entire catalogue in one command

Represent many rights holders? A distributor or aggregator holds one provider key and onboards every artist's repertoire in bulk — each work stamped with an ownerRef (the artist's stable id in *your* system) so reads and writes are hard-scoped per rights holder. The same integration works for one artist or a million.

Export your catalogue as CSV (CD Baby, DistroKid and most distributors already do), then:

# One-time: get a provider key from your A2A partner account, t