A provable, independently verifiable record of every action your AI agents take — built for the audit problem regulated industries actually have, not just the attack problem the literature has been chasing.
sorrysThree primitives that together produce a verifiable receipt of every agent action.
Every agent tool call passes a gate that checks an Ed25519-signed capability token against the call arguments. Fail-closed by default. ALLOW or DENY decisions emit a cryptographic receipt; the gate's soundness is mechanised in Lean 4.
Each tool's security policy is verified by an SMT prover (Z3) to hold over every string the tool's JSON Schema admits — or a counterexample is extracted. The proof is content-addressed and cited by every capability token derived from it.
Receipts are signed under a key your organisation publishes. A regulator, a partner organisation's gate, or a downstream tool can verify any receipt offline — schema, policy proof, attenuation chain, signature, argument hash — without contacting you.
Reverse proxy in front of OpenAI, Anthropic, Azure, and Bedrock. Streaming SSE with minimal overhead. One endpoint for every provider.
Detects PII, credentials, API keys, NI numbers, NHS numbers, and IBANs in prompts, outputs, and tool arguments.
Which AI tools are in use across your organisation, by which department. Sanction, review, or block.
Three-layer pattern + heuristic + ML pipeline. One of the gate's verifications — not the headline.
Every agent action passes a gate whose decision is a signed, content-addressed receipt that any third party can verify offline.
A regulator, a partner organisation's gate, or a downstream tool can verify any receipt offline — checking signature, schema hash, policy proof, attenuation chain, and argument hash against the issuer's published material. No information asymmetry remains between the operator and the auditor.
The hero artefact, the same in every deployment, signed under the deploying organisation's own key. Two side-by-side examples below: one ALLOW receipt for an authorised action, one DENY receipt where the gate caught a scope violation by the same agent moments later.
{
"issuer": "acme.bank.kyc-platform",
"issuer_pubkey": "ed25519:MCowBQYDK2VwAyEA9f8e2a47b4c1…",
"schema_hash": "sha256:9f8e2a47bcd1…b4c1",
"policy_proof_hash": "sha256:4b78e687a3f1…203f",
"lean_theorem_id": "vcd_kyc_lookup_v1.policy_completeness",
"attenuation_chain": [
"root:acme.bank.root",
"tok_kyc_2026Q3",
"tok_session_a7f3b2"
],
"agent_id": "kyc-agent-prod-eu-west-1",
"tool": "crm.lookup_customer",
"call_args_hash": "sha256:8ba704819c2a…6c2a",
"decision": "ALLOW",
"decision_reason": "constraints satisfied",
"timestamp": "2026-05-27T08:15:22.041Z",
"signature": "ed25519:rJk7Q1xS3v…"
}crm.lookup_customer; the call's argument hash satisfies the token's constraint set; the gate admits the call and signs the receipt.{
"issuer": "acme.bank.kyc-platform",
"issuer_pubkey": "ed25519:MCowBQYDK2VwAyEA9f8e2a47b4c1…",
"schema_hash": "sha256:c769f3a2d40b…a8e7",
"policy_proof_hash": "sha256:4b78e687a3f1…203f",
"lean_theorem_id": "vcd_kyc_lookup_v1.policy_completeness",
"attenuation_chain": [
"root:acme.bank.root",
"tok_kyc_2026Q3",
"tok_session_a7f3b2"
],
"agent_id": "kyc-agent-prod-eu-west-1",
"tool": "payments.transfer_funds",
"call_args_hash": "sha256:e21d0a4f76b8…9c3b",
"decision": "DENY",
"decision_reason": "tool not in token's allowed-tool set; authorised: {crm.lookup_customer}",
"timestamp": "2026-05-27T08:15:24.137Z",
"signature": "ed25519:tF9pXyz2sW…"
}payments.transfer_funds; the gate refuses and signs the refusal. The denial itself is tamper-evident audit evidence.Five offline checks per receipt. No call to the bank. No call to Raucle.
schema_hash against the published schema registry — confirms the tool's contract was the published one, not a substituted variant.policy_proof_hash against the published policy registry — confirms the agent ran under an approved policy.lean_theorem_id closes — the soundness claim is machine-checked, not asserted.call_args_hash satisfies the policy's constraint set for the cited tool — the specific call really was authorised.Conclusion: the bank did exactly what its approved policy says, every action in the quarter, demonstrably and without information asymmetry between bank and regulator.
Same artefact, different verifier. Receipts replace code review as the scope-adherence check.
policy_proof_hash whose corresponding policy AppSec has reviewed and signed off.policy_proof_hash must appear in the approved registry. Any unknown hash blocks release.call_args_hash satisfies the cited policy. (It always does — the gate enforced it — but the verifier can prove it independently.)Conclusion: AppSec audits scope adherence without reading the agent's code. The dev team ships faster because the scope check is automated and objective, not a manual review queue.
Same primitive. Two buyers. The regulator who has to audit your AI in production. The AppSec team who has to govern the AI your developers are shipping. Both verify the same signed receipt against the same published policy registry. The audit, the governance, and the evidence trail collapse into one cryptographic artefact.
Whether a tool call is admitted or denied, Raucle emits a capability receipt — citing the issuer's key, the verified policy, the Lean theorem, the attenuation chain, and a hash of the actual arguments. The audit trail you hand to a regulator is built by your agents in real time, not reconstructed from logs months later.
policy_proof_hash 7f3a…; deploy-bot tool=shell_exec not in token's allowed-tool set.
policy_proof_hash 4b78…; research-agent tool=http_post recipient host not in allowed_hosts.
schema_hash 9f8e…; MCP tool file_reader presented mismatching schema — possible rug pull.
attenuation_chain root → s-1 → s-2; code-assistant attempted child-broader permission — structurally impossible.
policy_proof_hash c769…; analytics-bot 847 calls/3s within token's rate envelope but flagged for review.
policy_proof_hash 8ba7…; support-agent tool=search_knowledge_base args match in-force token.
policy_proof_hash 4b78…; email-drafter tool args bound at mint time disagree with model-emitted call.
Latest release: v0.17.0
The core engine that powers Raucle is the open-source raucle-detect library — released under AGPL-3.0-or-later, with a commercial licence available for licence-incompatible uses. It ships the SMT-backed policy prover, the Ed25519 capability primitives, the gate, and the audit chain. The commercial platform adds the multi-tenant management layer, a dashboard surfacing the receipt graph, the audit-export PDF that a regulator can consume, and managed key rotation.
What's new in v0.17.0: Internal, Scope & claims (read before citing), Security fixes (fail-open paths closed), ⚠️ Breaking / stricter-by-default. Read the changelog →
The Raucle commercial platform builds on the open-source engine with the dashboard, audit-export PDF, and managed deployment regulated industries need.
Star on GitHubRaucle is a sidecar, not a framework. It composes with the platforms enterprises are already deploying — including Microsoft's. The capability-receipt artefact is what makes coexistence work: raucle emits the audit primitive your framework's policy engine doesn't produce, without displacing what your framework already does.
A drop-in FunctionMiddleware that runs at Microsoft's documented (context, call_next) hook. One line at agent construction. Verified against agent-framework 1.6 with 9 / 9 tests passing. pip install raucle-detect[agent-framework].
Composes alongside AGT's in-process policy engine through the ExternalPolicyBackend Protocol. raucle's contribution at microsoft/agent-governance-toolkit#2610 — adding proof_artefact and verification_pointers carry-through — merged upstream on 2026-05-27, so high-assurance backends attach offline-verifiable evidence to the AGT audit chain.
Microsoft's AI gateway explicitly does not log tool traces. Raucle deployed as an APIM backend pool member fills exactly that gap — EU AI Act Article 12 evidence Foundry alone cannot supply.
Pattern · ships todayAlso in scope: LangChain runnables, AutoGen (subsumed by Agent Framework 1.0), Vercel AI SDK middleware, the OpenClaw plugin (shipped), and MCP servers via the gateway pattern. The next integration is whichever the contributor base prioritises — design docs and skeletons live in docs/proposals.
EU AI Act Article 12 (logging) and Article 26 (deployer obligations) require audit logs that survive independent scrutiny. FCA model-risk-management expects defensible evidence of model behaviour. Raucle produces it — exportable, content-addressed, signed, and verifiable by your regulator without contacting us.
Capability receipts satisfy the audit-logging obligations for high-risk AI systems, exportable to a national competent authority offline.
Defensible evidence of every model-mediated decision in regulated finance — what the agent did, by whose authority, against which verified policy.
Receipts and the issuer key stay in the jurisdiction you choose. No transatlantic transfers required to verify.
Auditable AI Management System artefacts — capability receipts, policy proofs, and the Lean development together form a ready-to-submit AIMS evidence pack.
Receipts your auditors verify offline. Policies your prover certifies. Soundness your reviewers can re-check in Lean 4. Be first to know when Raucle launches.