Your AI agents do real work.
Mira makes it provable.
Mira sits between your AI agents and the decisions they make. Every step is cryptographically signed the moment it happens, faults are frozen mid-run before they spread, and the workflow recovers on a healthy model — with an audit trail that stands up years later.
- Ed25519 signatures
- Hash-chained records
- Merkle Mountain Range
- C2SP signed checkpoints
- OpenTelemetry-native
Three guarantees, one control layer
Agentic AI fails silently: a run that looks successful can leak data or drift off policy, and nobody finds out until an auditor does. Mira turns “trust us” into evidence.
Proof
Every model call, tool call and agent-to-agent handoff is canonicalized, hash-chained and signed the moment it happens. Anyone can re-verify every signature, live — you can always show exactly what happened, in what order.
Protection
Runtime checks inspect every output. A leaked identifier or degenerating loop freezes the workflow between agents — before downstream steps consume it — then a verified context snapshot recovers the run on a healthy model, even from a different provider.
Permanence
The record is tamper-evident: change one byte of history and verification fails, pinpointing the record. After the retention window, heavy diagnostics archive into small signed summaries that remain fully verifiable.
From span to signed evidence in five steps
- 01
Instrument
Mira consumes the OpenTelemetry spans your agent framework already emits — LangGraph, LangChain and friends — so governance arrives without rewriting your workflow.
- 02
Sign
Each step becomes a canonical, hash-chained record sealed with an Ed25519 signature and committed to a Merkle accumulator — in microseconds of measured overhead, off your agents’ critical path.
- 03
Guard
Every output is checked before the next agent consumes it. A protected-identifier leak or a degenerating loop freezes the run at the boundary and records the intervention as signed evidence.
- 04
Recover
A snapshot of clean context — verified against its own signed record — is re-injected into a substitute model, even from a different provider. The run completes, and the incident lives inside the same audit trail.
- 05
Audit
Years later, paste one transaction id into the vault and Mira reconstructs the entire run: timestamps, the exact model versions, the policies applied, and signatures proving the history was never altered.
The vault, reconstructing a governed decision — including the interdicted fault and the cross-provider recovery — from signed records alone.
measured signing overhead per governed step in the sandbox — shown live in the console, not claimed on a slide
one run, two model providers — recovery hot-swaps mid-workflow with verified context continuity
storage drop in the sandbox scenario when the retention window archives hot diagnostics into signed, still-verifiable stubs
configurable hot retention with the EU AI Act six-month floor enforced, then automatic archival
Evidence, not attestations
Every compliance claim in Mira maps to a cryptographically signed record you can re-verify on demand. Reports are generated from the ledger itself — regulator-grade decision records, internal incident reports, and an executive compliance passport.
EU AI Act
Annex III high-risk uses (e.g. credit scoring)Art. 12 automatic event recording, FRIA inputs and Art. 86 explanations are produced as signed artifacts on every run. Under the Act as amended by the 2026 Digital Omnibus, Annex III high-risk obligations apply from 2 December 2027 — evidence pipelines take time to stand up, and Mira gives you that lead.
SR 26-2 / OCC 2026-13
2026 US interagency model-risk guidanceThe 2026 interagency guidance explicitly places generative and agentic AI outside its model-risk coverage — the controls are yours to build. Mira is built for exactly that gap: per-step model identity, oversight events and incident records, all signed.
ECOA / Reg B + FCRA
Adverse action & credit decisionsSpecific principal reasons derive from the factors your agents actually scored — never generic strings — and each reason is hash-linked to the signed record of the step that produced it.
ISO/IEC 42001 + NIST AI RMF
AI management systemsEvent-logging, provenance and post-deployment monitoring controls map to evidence you can hand to an auditor: a requirement → control → signed-record table generated per decision.
Deploy it your way
Start in the cloud in minutes, or run the whole control layer inside your own perimeter.
Cloud console
Available nowMulti-tenant SaaS at app.sorol.ai — sign up and put your first governed workflow on the record today.
- Per-workspace ledgers and signing keys — tenants never share cryptographic material
- Enforced two-factor authentication and full access logging
- Live console, audit vault and generated regulatory reports
- Configurable retention with automatic signed archival
Self-hosted
Docker ComposeThe entire control layer ships as one container image plus an optional TLS/backup profile — run it inside your own network.
- Single-process deployment; SQLite ledgers on your disks
- Automatic HTTPS via the bundled Caddy profile
- Streaming off-site ledger replication (Litestream, S3-compatible)
- Same console, same cryptography, your infrastructure
Enterprise
Your cloudFor regulated estates with their own key management, identity and data-residency requirements.
- KMS/HSM-backed master keys (the key vault is a single swap-in seam)
- SSO-ready identity model (OIDC / SAML)
- Data residency and deployment reviews with our team
- Roadmap partnership — shape the control layer you need
Put your agents on the record.
Run a governed workflow in the sandbox, watch an interdiction and a cross-provider recovery live, then verify every signature yourself.
Open the console