Kevros — Agentic Identity Trust

Verify an action against policy bounds before executing it. Returns ALLOW (proceed), CONSTRAIN (proceed with modified values; emitted on the wire as the legacy value CLAMP - both refer to the same verdict, CONSTRAIN is the public name), or DENY (stop). Every verification is recorded in a hash-chained provenance ledger. Cost: $0.01 per call.

Create a hash-chained provenance record for an action you've taken. Each attestation extends the append-only evidence chain. The hash can be independently verified by any third party. Cost: $0.02 per call.

Declare an intent and cryptographically bind it to a command. Proves that the command was issued in service of the declared intent. Use verify-outcome after execution to close the loop. Cost: $0.02 per call.

Verify that an executed action achieved its declared intent. Closes the loop: intent -> command -> action -> outcome -> verification. Free (included with bind).

Generate a certifier-grade compliance evidence bundle. Contains hash-chained provenance, intent bindings, PQC attestations, and verification instructions. Independently verifiable without Kevros access. Cost: $0.05 per call.

Check the governance gateway health status. Free.

Check your current usage and quota: calls used, calls remaining, tier, rate limits, and billing status. Free.

Check another agent's trust score and governance history. Returns trust score (0-100), chain length, attestation count, and tier. Free, no API key needed.

Verify a release token from another agent. Confirms the token is authentic and was issued by the Kevros gateway. Free, no API key needed.