The Sovereign Trust Plane
Prove What Your Agents Did.
Your agents delegate authority, call tools, and move money. When an auditor asks what happened eighteen months later, a trace is not evidence. Traefik Hub turns every decision the gateway made into a record a third party can verify … including the ones where it said no.
Sovereign
Your identity provider grants the authority, your policy engine decides on it, and the whole stack runs on your infrastructure—air-gapped if you need it.
Trust
Where each action's authority came from and what was decided is kept in a record you can verify without taking our word for any of it.
Plane
API traffic, model traffic, and tool traffic run through a single in-path binary, so the record comes from one place instead of three.
TRAEFIK LABS IS TRUSTED BY LEADING ENTERPRISES WORLDWIDE
Scope
Who This is For
Security leaders who own the risk of agents acting on the organization's behalf.
Risk and compliance teams who will be asked to produce the evidence, months after the fact.
Product teams who will be asked why their agent did what it did, and need an answer better than a trace.
What This Answers
Who authorised this action, and through which hands did that authority pass?
Under which policy was it allowed or refused, and what was the reason?
Can you prove this record has not been altered since?
Built on open standards
OAuth 2.0 Token Exchange
(RFC 8693)
OpenID AuthZEN
Authorization API 1.0
Model Context Protocol
MCP
C2SP tlog-witness
c2sp.org · v1.0
Tessera [CC2]
Append-only log · v1.0
Three Things this Deliberately Is Not
Agent governance attracts overclaiming. It is worth being precise about where the boundary sits, because the value of the record depends on knowing exactly what it does and does not attest.
The Sovereign Trust Plane is
Not an Explanation of Why an Agent Acted
A model's emitted reasoning is another model output, not a trace of the computation that produced the decision. Behaviour can be recorded; cognition cannot be verified. Traefik records what the gateway did and on what basis.
Not an Observability Platform
Traces serve an engineer during an incident and are optimised for query and cost. Evidence serves an auditor much later and is optimised for completeness and integrity. Sampling and filtering are correct for the first and fatal to the second.
Not a Policy Engine
Traefik authors no policy and holds no rules. It asks your decision point over a standard API and enforces the answer inline. Swap the engine (e.g., OpenFGA, Keycloak, OPA, Cedar) and nothing about the gateway configuration changes.
How it works
An Audit Asks Three Questions
The gateway is built to answer three auditor questions, in order, on every call. And it keeps the answer in a form that survives being doubted.
Delegate
"Who authorized this?"
An agent handing work to another agent doesn't pass along its credentials; it exchanges them. Authority narrows at every hop, and what the second agent carries is a scoped token its identity provider minted, rather than a claim in a message the receiving agent has no way to check.
RFC 8693 token exchange
RFC 7523
Enterprise-Managed Authorization
Authorize
"Under what policy?"
The gateway asks your policy decision point whether this subject may take this action on this resource, and enforces the verdict inline. The decision, the policy that answered, and the reason it gave are written to the same tamper-evident record as the request.
OpenID AuthZEN
OpenFGA
Keycloak
OPA
Cedar
Prove
"How do I know you're not lying?"
Every decision enters an append-only transparency log. Any single entry can be proven present in a handful of hashes, the log can be proven append-only across time, and an independent witness cosigns each checkpoint so integrity does not rest on our signature alone.
Merkle transparency log
C2SP tlog-witness
A Complete Record
One Agent Action Crosses Three Boundaries
An agent reasons with a model, calls a tool, and hits an API. Each of those boundaries can be instrumented. But nobody can join them back up, because the three boundaries usually belong to three systems owned by three teams, and a decision record has clear seams where information has been stitched together. The seams are where an auditor looks.
The triple gate is less a bundling convenience, and more a precondition for correlation. One system sees the whole action, so you have one record rather than three that have to be reconciled later.
Refusals
A “No” Your Agent Can Act On, and Your Auditor Can Check
A bare 403 tells an agent nothing, so it retries or gives up. A refusal that names the limit and the policy behind it is something the agent can reason about, e.g., reduce the amount, request approval, escalate to a person, etc.
// what the calling agent receives { "error": "forbidden", "reason": "amount 2400.00 exceeds agent limit 500.00", "policy": "refund-cap-tier2" }
Denials are Evidence Too
Most audit trails record what happened. A regulator wants something harder to produce: evidence that the controls actually fired. Every refusal enters the same tamper-evident record as approvals, so you can show what your agents were prevented from doing, not only what they were permitted to do.
The reason text comes from your policy engine, not from us. We carry it, enforce it, and keep it, which means the account an auditor reads is written by the system that made the decision.
Verification
A Log You Can Check Without Taking Our Word For It
A signed log proves the operator signed it. It does not stop the operator from quietly rolling it back and signing again. So you add an independent witness, which cosigns each checkpoint and attests that it saw this history at this size and time. Verifying the log means checking the proofs and the witness's signature, not trusting Traefik. The verifier is open, and it runs on your machine.
Deployment
All of it Runs on Your Own Soil
Sovereignty that depends on somebody else's cloud isn't sovereignty. There is no SaaS control plane in the request path and no vendor you must stay connected to. The whole stack runs air-gapped, with zero egress, on an isolated network, indefinitely.
The Gateway
Yours
Self-hosted and offline-capable, with a self-hosted manager on your own PostgreSQL.
The Identity Provider
Yours
Keycloak or any OIDC provider you already run. It mints the authority; we never do.
The Policy Engine
Yours
OpenFGA, Keycloak, OPA or Cedar. Whichever you run, it speaks a standard API.
The Transparency Log
Yours
A plain POSIX filesystem is enough. Object storage is an option, not a requirement.
The Verifier
Yours
Open, and it runs on your machine. You check the proof rather than requesting it from us.
The Only Thing That Ever Leaves is a Hash
A witness must be independent or it proves nothing — which sounds like it reintroduces the dependency you just removed. It doesn't, because of what a checkpoint contains.
// the entire payload crossing your boundary old 184203 logs.yourbank.internal 184203 Ilb9V0s7j...jJQL40wm0= — logs.yourbank.internal tZ3TC14t...xwLDmQQ= — witness.example.org x101AAAA...S1ATmkmk=
Your logs never move, and the witness learns nothing about what they say. You also choose who witnesses: the protocol is open, several witnesses can cosign the same log, and adding one is a line of configuration. In a regulated deployment the most interesting option is often the obvious one: let your auditor be your witness.
Airgapped deployments lose nothing. The chain, the proofs, and the verifier all run inside the enclave. A witness adds independence: someone outside your team confirms the log is intact, so the platform team isn't vouching for its own records. Your risk function can witness for your platform function, or your auditor can hold the key.
Cosignature needs a narrow two-way path, since a signature has to come back. If your environment only allows data out, publish the root hash somewhere append-only and outside your control. That still proves the log existed in that state at that moment.
You Don't Get to Decide Later That You Needed the Record
The EU AI Act Article 12 record-keeping requirement was delayed to December 2027, and what counts as a high-risk system is still being argued about. Neither of those facts helps, because both get settled long after the decisions have already been made and recorded.
Most teams read the high-risk definition, decide it is someone else's problem, and move on. But classification gets settled in 2027 and 2028 by regulators, and it applies to systems already in production. If it lands the other way, the missing record is the finding, and you cannot backfill a log you never wrote.
That is the asymmetry. Turning it on costs a config change. Turning it on retroactively is impossible.
The second reason has nothing to do with regulation. Accountability does not travel with the work. You hand a task to an agent, that agent hands it on, and who is responsible never leaves your org. The gateway sees every hop. Nothing else does.
RECORDKEEPING: A ONE-WAY CLOCK
December 2, 2027
Recordkeeping obligation applies.
EU AI ACT ARTICLE 12 · ANNEX III
August 2, 2028
Embedded in regulated products.
ANNEX I
Later
Classification settled, not only by you.
SUPERVISORY INTERPRETATION
Can it be backfilled?
No.
The record starts when you start, not when the finding lands.
Availability
All Three Pillars Ship Together
Delegate, Authorize, and Prove are available on the Traefik Hub release train. They ship as early access by choice: two of the standards underneath them are still moving drafts, and we would rather track them closely than freeze on a version that changes underneath you.
Available
Delegate
Traefik Hub v3.21.0-ea.1
OAuth 2.0 token exchange (RFC 8693)
JWT bearer and On-Behalf-Of exchange (RFC 7523)
Chained exchange for Enterprise-Managed Authorization, so the gateway can carry the flow for clients that cannot perform it themselves
Task-based access control driven by claims from your identity provider
Available
Authorize
Early access
AuthZEN policy enforcement for APIs
AuthZEN policy enforcement for MCP, with COAZ mapping
Configurable deny responses carrying the reason and the policy that fired
Works with OpenFGA, Keycloak, OPA and Cedar
Remains early access while the COAZ drafts settle
Available
Prove
Early access
Transparency log over gateway decisions
Inclusion and consistency proofs
Independent witness cosignature, with your choice of witness or ours
Reference verifier, with production tooling to follow
Attest joins as a fourth pillar in a later release
Underneath all three: one binary carrying API, model, and tool traffic, deployable air-gapped, with FIPS 140-3 and hardened images for regulated environments.
What Users Have to Say
Start Recording Decisions Before It’s Too Late
A config change today. Impossible to backfill tomorrow.