One control layer over every agent you run. Policy is enforced before an action executes, and every action is signed the moment it happens.
Register an agent and MOSS issues it a cryptographically signed passport — a permanent, tamper-evident identity. Every action it takes is signed against it, and anyone can verify the agent and its record without an account.
Signed with ML-DSA-44 post-quantum cryptography (FIPS 204). Issued automatically on registration, renewed automatically, and public by default.
See how it works →When an agent goes off-policy, revocation reaches every running session in milliseconds, not just its next request.
See enforcement →The MOSS Governance Index scores your entire AI estate from 200 to 900, tracked over time and defensible in a security review.
How the score works →Evidence is collected continuously as every action happens. Each obligation maps to the cryptographic proof behind it, so you can export a signed, regulator-ready package the moment it’s asked for.
Every proof is signed with post-quantum cryptography (ML-DSA-44, FIPS 204), because evidence you keep for seven years has to still verify seven years from now.
Explore the vault →One AI action, from the moment it’s requested to the signed proof you can hand an auditor. Every stage runs on the same engine.
When your agent operates inside another company’s environment, or spawns one that does, MOSS proves who delegated what, with a signature at every hop and scope that only narrows. Competitors govern one org. MOSS governs the boundary between them.
Enterprise configurations add adaptive governance: a continuous-learning system that watches how your agents actually operate, detects behavioral patterns and policy gaps, and recommends specific policy changes with reasoning, evidence, and a confidence score. It finds where policy is too tight, too loose, or missing.
Always under human oversight. Every recommendation is reviewed, every applied change is versioned, and anything can be rolled back.
Available on all Enterprise configurations →Governance platforms mostly document, assess, and monitor your AI. MOSS acts on the agent in real time: it prevents a wrong action before it runs (ALLOW, HOLD, or BLOCK), stops a misbehaving agent in milliseconds, proves every action with tamper-evident post-quantum signatures, and gives you what you need to fix what went wrong. Live control and evidence, not a registry.
No. Governance platforms catalog, score, and report on your AI. MOSS is the layer that prevents, stops, and proves what your agents actually do in production. It is autonomy infrastructure, not a governance dashboard, and it works alongside the governance, identity, and SIEM tools you already run.
Identity and access control decide whether an agent may connect. MOSS governs what an agent does once it is running and produces signed proof of each action. Accountability, not just access. Why access control isn’t accountability →
Yes. The policy engine evaluates each action before it runs and returns ALLOW, HOLD for human approval, or BLOCK. Enforcement and the signed record are part of the same step, so the evidence reflects exactly what was permitted.
Every action is signed with ML-DSA-44 (post-quantum, FIPS 204) into a receipt that verifies offline with a public key, with no access to MOSS required. You can reproduce verification from the developer docs.
MOSS maps signed evidence to control obligations across frameworks such as the EU AI Act, NIST AI RMF, and DORA. Framework alignment is not a certification or a guarantee of compliance. See how mappings work.
Deployment and assurance: Enterprise · Trust. Plans and the free tier: Pricing.