a2a-trustgate

# a2a-trustgate

[![npm version](https://img.shields.io/npm/v/a2a-trustgate.svg)](https://www.npmjs.com/package/a2a-trustgate)
[![EU AI Act](https://img.shields.io/badge/EU_AI_Act-aligned-14b8a6)](https://a2ainfrastructure.com/compliance)
[![OCSF audit](https://img.shields.io/badge/audit-OCSF_native-14b8a6)](#the-audit-trail-an-auditor-will-accept)
[![MCP](https://img.shields.io/badge/MCP-49_tools-blue)](https://a2ainfrastructure.com/quickstart/mcp)

# Compliance for AI systems in production.

**You put an AI agent in production. Now prove it's safe — to your auditor, your regulator, your board.**

A2A TrustGate screens every action an agent takes *before* it runs, and writes the decision to an immutable, SIEM-ready audit trail. Not a policy document that says agents *should* behave — a control that stops the ones that don't, and the evidence to prove it.

- **Enforced, not promised.** Every agent action passes a 4-gate firewall before it executes. Out-of-policy actions are blocked in milliseconds, not flagged after the fact.
- **An audit trail an auditor will accept.** Every decision — allowed or blocked, with reasoning — lands in an append-only, OCSF-native log that drops straight into Splunk, Sentinel, Chronicle or Elastic.
- **Mapped to the frameworks you're measured against.** Export the same evidence against EU AI Act, SOC 2, NIST AI RMF, HIPAA and academic-integrity controls — article by article, control by control.
- **Provable scope.** Each agent may act only within the permissions it was granted. Deny-by-default, and every boundary is in the log.

**Who it's for:** compliance and risk teams putting AI into regulated production — financial services, healthcare, network operations, creative/IP rights, enterprise AI adoption, and research institutions. If someone can ask you *"prove your AI is safe,"* this is the answer.

[![a2a demo — screen an agent action in one command](https://prodmedia.tyga.host/public/tyga.cloud/landing/a2ainfrastructure.com/a2a-hero-1200.gif)](https://a2ainfrastructure.com/#demo)

*Agent proposes an action, the gate screens it, the decision lands in the audit trail — [watch the full demo](https://a2ainfrastructure.com/#demo).*

---

## The audit trail an auditor will accept

Most "AI governance" is a PDF that describes intentions. A2A produces evidence. Every screened action becomes a genuine **OCSF Detection Finding** — the same schema your SOC already ingests — with a tamper-evident content hash and the full decision reasoning:

```bash
a2a audit                          # recent decisions, allowed and blocked
a2a audit export --format ocsf     # OCSF Detection Findings — straight into your SIEM
a2a audit export --format csv      # hand a spreadsheet to an auditor
```

- **OCSF-native (schema 1.1.0).** Not a bespoke JSON blob labelled "OCSF" — real Detection Findings that Splunk / Sentinel / Chronicle / Elastic parse without a custom connector.
- **Tamper-evident.** Every record carries a content hash; the export is append-only. You can prove the log wasn't edited after the fact.
- **Framework-mapped exports.** The same underlying events export against the control set you're being audited on:

| Framework | What you can hand over |
|---|---|
| **EU AI Act** | Article-by-article evidence of screening, logging and human oversight (Art. 12, 14, 26, 53) |
| **SOC 2** | Control-mapped decision log (CC-series) |
| **NIST AI RMF** | GOVERN / MAP / MEASURE / MANAGE evidence |
| **HIPAA** | Security & Privacy Rule access decisions |
| **Academic integrity / QAA** | Research-ethics and responsible-AI trail |

> **EU AI Act deployer?** Read the [EU AI Act compliance reference](./docs/eu-ai-act.md) — an article-by-article crosswalk (Art. 12 record-keeping, Art. 14 human oversight, Art. 26 deployer obligations) with citations to the official EUR-Lex text. The Regulation becomes generally applicable **2 August 2026**.

## Enforced before it runs — the 4-gate firewall

Compliance you can prove starts with a control that actually stops things. Every action passes four gates before it's allowed to execute:

- **Gate 1 — deterministic rules.** Pattern and policy screening in milliseconds: destructive operations, secret exfiltration, injection signatures. No model call.
- **Gate 2 — self-evaluation.** For anything Gate 1 can't clear outright: *should this run, given the context and the tenant's policy?*
- **Gate 3 — behavioral analysis.** Abuse patterns across a run — bursts, probing, escalation — not just the single action in isolation.
- **Gate 4 — scope enforcement.** Per-agent permissions: each agent may act only within the scope it was granted. Out-of-scope actions are denied by default.

The firewall only ever *tightens* a decision — allow → review → block. A safe action stays fast; a risky one is stopped and recorded with the reason.

---

## For developers — screen an action in one command

The whole control is a CLI (and an MCP server). Wrapping a risky step is one line, and exit codes make it scriptable:

```bash
a2a eval "rm -rf ./build"          # ✓ ALLOWED   (exit 0)
a2a eval "rm -rf /"                # ✗ BLOCKED   (exit 1) — filesystem destruction pattern
a2a eval "command" --context ctx   # add decision context   (exit 2 = needs review)
```

| Code | Meaning |
|------|---------|
| 0 | Allowed — safe to execute |
| 1 | Blocked — do not execute |
| 2 | Needs review — Gate 2 self-evaluation required |

**Works with:** Claude Code · Cursor · Cline · Windsurf · Aider · Codex · any MCP client.

## Install

```bash
npm install -g a2a-trustgate
```

The npm package is `a2a-trustgate`; the command is `a2a`.

## Quick Start

```bash
# Create a tenant (agent-first — human activates the key)
a2a signup my-company --local

# Screen a command — exit 0 = allowed, 1 = blocked, 2 = needs review
a2a eval "rm -rf ./build"
# ✓ ALLOWED

a2a eval "rm -rf /"
# ✗ BLOCKED: filesystem destruction pattern

# See plan, usage, limits
a2a status

# Full reference
a2a --help
```

> Your key is issued immediately but returns **402** until you start your **7-day free trial** ($0 today) — `a2a signup` prints the activation link. Cancel before day 7 and you're never charged.

The eval call has a few knobs, and it's scriptable — wrap any risky step:

```bash
a2a eval "command" --gate2 self    # self-evaluate (default)
a2a eval "command" --gate2 skip    # Gate 1 only (fast path)
a2a eval "command" --pipeline ID   # route through a named pipeline

if a2a eval "rm -rf ./build" --json 2>/dev/null; then
  rm -rf ./build
fi
```

## Built for six kinds of team

A2A screens the same way for everyone and produces the same audit trail — but the surface each team touches, and the framework they're measured against, is different. Pick yours.

### Network operations — a gate in front of every device

Your agents run commands against routers, switches, and sites. A2A registers each device, enforces a per-device policy, and gives you a killswitch that stops every agent at once.

```bash
a2a device add --name core-rtr-1 --host 10.0.0.1 --vendor cisco
a2a device policy DEVICE-ID --mode strict --require-approval --max 5
a2a device lock DEVICE-ID           # freeze a single device
a2a killswitch                      # freeze every agent, everywhere
a2a device import --file hosts.csv  # bulk onboard (name,host,vendor,model,role,siteCode)
```

| Agent screens a command | Human sees the device-lock |
|---|---|
| [![network-ops terminal cast](https://prodmedia.tyga.host/public/tyga.cloud/landing/a2ainfrastructure.com/icp/network-ops-cast.gif)](https://prodmedia.tyga.host/public/tyga.cloud/landing/a2ainfrastructure.com/icp/network-ops.mp4) | [![network-ops dashboard](https://prodmedia.tyga.host/public/tyga.cloud/landing/a2ainfrastructure.com/icp/network-ops-plate.png)](https://a2ainfrastructure.com/use-cases/network-ops) |

*Watch the full clip: [network-ops →](https://prodmedia.tyga.host/public/tyga.cloud/landing/a2ainfrastructure.com/icp/network-ops.mp4)*

### AI agents — agent-to-agent, screened and signed

Multi-agent systems where one agent's output is another's input. A2A gives them scoped workspaces and HMAC-signed channels, so a rogue or injected message can't cross a boundary you didn't grant.

```bash
a2a workspace create "research-swarm"
a2a workspace WS-ID add-agent --name planner --role expert
a2a workspace WS-ID enforce --agent planner "command"   # screen an agent's action
a2a channel create ops-bus
a2a channel CH-ID send "interface frozen — you're clear to build"  # HMAC-signed
```

| Agent-to-agent evaluate | Human sees the block + audit |
|---|---|
| [![ai-agents terminal cast](https://prodmedia.tyga.host/public/tyga.cloud/landing/a2ainfrastructure.com/icp/ai-agents-cast.gif)](https://prodmedia.tyga.host/public/tyga.cloud/landing/a2ainfrastructure.com/icp/ai-agents.mp4) | [![ai-agents dashboard](https://prodmedia.tyga.host/public/tyga.cloud/landing/a2ainfrastructure.com/icp/ai-agents-plate.png)](https://a2ainfrastructure.com/use-cases/ai-agent-platforms) |

*Watch the full clip: [ai-agents →](https://prodmedia.tyga.host/public/tyga.cloud/landing/a2ainfrastructure.com/icp/ai-agents.mp4)*

### Regulated industries — an immutable, exportable audit trail

Every decision — allowed or blocked, with reasoning — lands in an append-only log you can export for an auditor. OCSF-native Detection Findings, EU AI Act aligned.

```bash
a2a audit                          # recent decisions
a2a audit export --format ocsf     # OCSF Detection Findings → your SIEM
a2a audit export --format csv      # hand to an auditor (csv/json)
a2a approvals                      # human-in-the-loop queue
a2a approve TASK-ID
a2a reject TASK-ID "out of policy" # reason recorded in the trail
```

| Command screened | Human exports the audit |
|---|---|
| [![regulated terminal cast](https://prodmedia.tyga.host/public/tyga.cloud/landing/a2ainfrastructure.com/icp/regulated-cast.gif)](https://prodmedia.tyga.host/public/tyga.cloud/landing/a2ainfrastructure.com/i