SWT3 - Sovereign Witness Protocol for AI

Don't audit the agent's thoughts. Audit the agent's actions.

The Problem

AI agents are making production decisions: approving loans, triaging patients, managing infrastructure, writing code. In 2026, 65% of firms reported AI agent security incidents. Only 14.4% of agents go live with full security approval. When something goes wrong, there is no tamper-proof audit trail. Logs are mutable. Metrics are averaged. Nobody can prove what the agent actually did.

GPAI transparency obligations are enforceable now. EU AI Act high-risk enforcement begins December 2, 2027. NIST AI RMF, SR 11-7, and CMMC impose similar obligations. 72% of enterprises believe they have AI governance but lack actual control. Most teams have nothing but dashboards and hope.

The Protocol

SWT3 (Sovereign Witness Traceability) is a deterministic witness protocol for AI systems. It intercepts AI actions, hashes the evidence, and anchors cryptographic proof to an immutable ledger. Your code gets the full response. The auditor gets tamper-proof evidence. Raw prompts and responses never leave your infrastructure.

• Deterministic, not probabilistic. The witness engine uses fixed logic, not AI, to evaluate compliance.
• Zero data retention. Configurable clearing levels strip sensitive content before it leaves your environment.
• Framework-mapped. Every anchor maps to EU AI Act articles, NIST AI RMF functions, and federal controls.

Try It (10 Seconds, No Account)

Python

pip install swt3-ai
python -m swt3_ai.demo

TypeScript

npm install @tenova/swt3-ai
npx swt3-demo

No API keys. No account. No network calls. You will see the full witnessing pipeline run locally.

Three Lines to Production

from swt3_ai import Witness
from openai import OpenAI

witness = Witness(endpoint="https://sovereign.tenova.io", api_key="axm_live_...", tenant_id="YOUR_TENANT")
client = witness.wrap(OpenAI())

# Every inference is now witnessed. Your code does not change.
response = client.chat.completions.create(
    model="gpt-4o",
    messages=[{"role": "user", "content": "Summarize this contract"}],
)

Works with OpenAI, Anthropic, AWS Bedrock, Vercel AI SDK, LangChain, LiteLLM (100+ providers), and any OpenAI-compatible endpoint (vLLM, Ollama, Azure OpenAI).

K8s Hardware Attestation

AI compliance doesn't stop at the model layer. Regulators want to know what hardware ran the inference, whether it was authorized, and whether the compute environment changed between audit periods. Today, no platform provides cryptographic proof of which silicon processed which workload. SWT3 does.

Deploy a DaemonSet that discovers accelerator hardware on every node and mints AI-HW.1 attestation anchors. Zero application code changes. One Helm install.

helm install swt3-witness oci://ghcr.io/tenova-labs/charts/swt3-witness \
  --set config.endpoint="https://sovereign.tenova.io" \
  --set config.apiKey="axm_live_..." \
  --set config.tenantId="YOUR_TENANT"

The DaemonSet auto-discovers 6 accelerator types per node:

Each node reports its silicon vendor, topology, memory, and per-accelerator detail. Non-accelerator nodes produce a valid anchor attesting "no accelerator detected" -- absence of hardware is also auditable evidence. Mixed-silicon clusters (NVIDIA + TPU + AMD in the same cluster) are fully supported.

What this proves to your auditor:

• Which hardware ran each AI workload (EU AI Act Art. 15(4), NIST 800-53 SI-7)
• Whether the compute environment changed between assessments (drift detection)
• That inference didn't silently migrate to unauthorized or unqualified silicon
• Full hardware provenance from silicon to model, combined with AI-HW.3 (TPM attestation)

The witness context includes silicon_vendor, discovery_method, and accelerators[]. All device identifiers are SHA-256 hashed before leaving the node. Serial numbers, UUIDs, and bus IDs are never transmitted in plaintext.

See the Cross-Silicon K8s Attestation Guide for GKE, EKS, AKS, and on-prem deployment patterns.

What Gets Witnessed

Each inference produces anchors across 108 AI procedures spanning 56 namespaces:

Plus 70 additional procedures covering fairness, explainability, inference volume, model drift, human oversight, cybersecurity, supply chain, content marking, agent lifecycle, financial transactions, and cross-border routing. See the full procedure registry.

View an Anchor

A Level 1 anchor for AI-INF.1 (Inference Provenance). This is what reaches the witness ledger. No prompts, no responses, just cryptographic proof.

{
  "procedure_id": "AI-INF.1",
  "factor_a": 1,
  "factor_b": 1,
  "factor_c": 0,
  "clearing_level": 1,
  "anchor_fingerprint": "c059eb5938c0",
  "anchor_epoch": 1774800000,
  "fingerprint_timestamp_ms": 1774800000000,
  "ai_prompt_hash": "315f5bdb76d078c4",
  "ai_response_hash": "a1b2c3d4e5f60718",
  "ai_latency_ms": 842,
  "ai_model_id": "gpt-4o",
  "ai_context": {
    "provider": "openai",
    "guardrails": ["content-filter", "pii-redaction"]
  }
}

The anchor_fingerprint is computed from SHA256("WITNESS:{tenant}:{procedure}:{fa}:{fb}:{fc}:{ts}"). Anyone with the factors can independently verify the math. Trust is a vulnerability. Math is the remedy.

Clearing Levels