One question, one verdict, one receipt: a tour of ArtzAIn

Your agents are already making decisions. Some of those decisions send email, move money, change records, open tickets, or call other agents. The question every Security, Compliance and Finance lead eventually asks is the same one: who said that was allowed, and can we prove it later?

ArtzAIn is the model-agnostic agent control plane, and it exists to make that question boring. This post is a plain tour of what it does today, what it plugs into, and the four ways you can run it. No roadmap, no futures. Everything below is shipped and documented.

The whole product in one request

An application or an agent asks one question and gets one verdict back.

pythonimport artzain

d = artzain.decide(
    action="send_email",
    target="crm:contact:123",
    payload=draft_email_text,
    kind="model_output",
)
if d["outcome"] == "allow":
    actually_send()

The engine answers allow, deny or review. By the time you have the answer, the decision has already been hash-chained and Ed25519-signed into an append-only audit record, together with every enforcer's vote and the exact policy version that ruled. The receipt exists before the response does.

That ordering is the design principle behind everything else: if the engine cannot record, it does not decide. A degraded audit log trips a circuit breaker and the Decision API returns 503 audit_unavailable rather than handing out verdicts nobody can later verify.

We govern the action, never the model. ArtzAIn sits in front of whatever model your agents run on and whatever framework they were built in. Swap the model tomorrow and the receipts still line up.

The local guards are free

The artzain SDK ships under Apache-2.0. It is pure Python with no mandatory dependencies, and the guards run offline on your machine with no account and no API key.

bashpip install artzain

What you get for nothing: prompt defence, injection screening, the destructive-action guard, PII detection, tool-call contracts and a kill switch. With no API key set, artzain.decide() runs the same guards locally, so you can wire governance into an agent on a laptop and only connect it to the hosted engine when you want sealed decisions.

We made this split on purpose. The guards are the floor every agent should have, so they cost nothing. The receipt is what we sell.

Signed policy, shadowed before it bites

Policy lives in versioned, Ed25519-signed bundles that move along a draft, shadow, active, retired ladder. The deploy gate rejects anything unsigned, signed by the wrong key, addressed to the wrong team, or tampered with in transit. Promoting a bundle writes its own entry into the audit log, because a policy change is a decision too.

Before a bundle goes live you can run it in shadow. The engine re-evaluates live traffic against the candidate off the request path, records where the verdicts would have diverged, and shows you a shadow report. You see the blast radius before you flip the switch, with zero added latency for callers.

You can author bundles from the artzain policy CLI for CI and GitOps, or from the dashboard, which signs in the browser with WebCrypto so private keys never leave your machine.

Evidence packs you can verify with the network unplugged

Four first-party compliance bundles sit on top of the same policy machinery: EU AI Act, NIST AI RMF, ISO 42001 and SOC 2 AI controls. A team adopts one with a single extends line. The engine merges that framework's overlay into its decisions, and a machine-checkable evidence gate refuses to activate the bundle unless the deployment actually meets the framework's floor (for the EU AI Act, that means seven-year retention, a Postgres system of record, and the seal cadence Article 12 expects).

When your assessor asks for evidence, you export it.

bashartzain audit export --profile eu-ai-act --out eu-evidence.zip
artzain audit verify eu-evidence.zip     # exit 0 = intact

verify recomputes every leaf hash, chain link, Merkle root and signature with zero network access and zero trust in the server that produced the bundle. It is the artifact you hand to an auditor, and the auditor can check it on their own laptop.

These bundles are not certifications, and CogNEXUS does not certify anyone. They assemble the sealed record, the bundle history, the promotion trail and the control-mapping documents your program needs so that you can pursue certification with an independent assessor. Evidence supports a program. It is not a certificate.

Seeing every agent you actually have

Governing agents you know about is the easy part. The Agent Catalog discovers the ones you do not, across twelve sources: Anthropic Claude workspaces and Claude Code fleets, Microsoft Entra Agent ID, the M365 Copilot catalog, Microsoft Foundry, Copilot Studio, Salesforce Agentforce, LangGraph, n8n, OpenClaw gateways, MCP servers, Kubernetes workloads and CI/CD pipelines.

An agent that several sources can see is recorded once. Identity correlation links the sightings over strong vendor keys such as Microsoft app GUIDs and agent DIDs, every link is itself a sealed decision, and the catalog keeps per-source provenance intact so you can always see who reported what. Linkage, never merge.

Instances that no scanner can reach, a laptop or a home-lab gateway for example, can announce themselves through the same sealed gate.

Reaching the systems your agents touch

Twenty-three connectors are live today: Gmail, Google Drive, Outlook, OneDrive, Slack, Microsoft Teams, GitHub, Salesforce, HubSpot, Pipedrive, Microsoft Dynamics 365, DocuSign, Adobe Sign, PandaDoc, Shopify, Square, Stripe, Fathom, Linear, Jira, Confluence, ServiceNow and Workday. Tokens are encrypted at rest, refreshed proactively, and shareable at the team level.

Orchestrators are a different shape. n8n, OpenClaw and Zapier are not connector cards; they call the Decision API or the governance envelope over HTTP. There are n8n nodes and an OpenClaw plugin in the open cognexus-tools repository if you want to skip the wiring, alongside the Python SDK and the TypeScript client, @cognexuslabs/artzain.

Four ways in

Hosted. Sign in at app.cognexuslabs.ai and start on the free Open tier. Google sign-in, Stripe billing, KMS-wrapped audit keys, running on AWS with continuous deploy from main.

SDK. pip install artzain for Python, npm install @cognexuslabs/artzain for TypeScript. The Python package works fully offline until you give it an API key.

In your boundary. One command installs the GPU-free core engine plus the local dashboard from public, digest-pinned, cosign-signed images:

bashcurl -fsSL https://cognexuslabs.ai/install.sh | sh

Windows PowerShell users run irm https://cognexuslabs.ai/install.ps1 | iex. Day two is artzain local status, doctor, upgrade and down. Details on the install page.

Private, sovereign or air-gapped. The same engine runs inside your perimeter under a file-based entitlement licence. artzain licence request, install and attest handle the lifecycle without the engine ever needing to call home.

What you pay for

Hosted plans meter signed decisions per calendar month. Not seats, not agents, not API calls that did not result in a verdict. You pay for the receipt, not for the people reading it.

The reasoning is simple. A seat model punishes you for giving more people visibility into what your agents are doing, which is the opposite of what a control plane should encourage. Metering the sealed decision ties the bill to the one thing that actually carries value: a verdict someone can later prove.

The honest summary

ArtzAIn will not make your agents smarter. It will make every consequential thing they do answerable: checked against signed policy before it runs, sealed into a record nobody can quietly edit, and exportable as evidence an independent party can verify without trusting us.

That is the whole product. Herd, and guard.

bashpip install artzain       # the open guards, offline, today
artzain quickstart        # local chat GUI to see the layers in action

Capabilities described reflect the ArtzAIn engine and the artzain SDK (0.5.x) as of September 2026. Connector and discovery-source counts change as integrations ship; the operator dashboard shows the live list. Compliance bundles produce evidence in support of a program and are not a certification, attestation, or legal advice.