No key escrow
We never hold, derive, or read your encryption keys. The relay routes opaque bundles it cannot open. Compromising us does not compromise your data — and that isn’t a policy promise, it’s an architectural one enforced in our test suite.
Capability Assertion Protocol
Authority you can prove.
And take back.
Every system you run hands out bearer tokens — strings that mean “trust whoever holds this.” They can’t be un-issued, they can’t say what they’re for, and they were designed for a browser with a human in it. Richdale Sigilex replaces them with short-lived capability certificates: bound to a key, scoped to an action, checked on every single call, and revocable the moment you change your mind.
No redirects. No key escrow. Every decision independently verifiable — including by people who don’t trust us.
The problem
The token model breaks the moment the caller isn’t a person.
Access control was built around a human at a browser, clicking through a redirect once an hour. That assumption is now false in four expensive ways.
- A bearer token is a password that travels. Anything that copies it — a log line, a proxy, a compromised dependency — becomes you, with your full authority, and nothing downstream can tell the difference.
- You can’t un-issue one. Revocation means waiting for expiry and hoping. The window between “this credential is compromised” and “this credential stops working” is the whole incident.
- Redirect-based SSO assumes a browser and a human. An autonomous agent has neither. So it gets handed a long-lived secret instead — the exact anti-pattern SSO existed to eliminate.
- Nothing records what the authority was for. When an AI agent calls a tool on someone’s behalf, the token can’t say which tool, for how long, or whose authority it’s acting under. Afterwards, you can’t prove what happened.
How it works
Issue a capability. Verify it at the edge. Prove it afterwards.
A capability certificate names the key that holds it, the action it permits, and when it dies. It is checked on every call — not once at login.
-
Issue
A certificate is minted against your tenant key, scoped to specific actions and a short lifetime. It names the holder’s public key, so a copied certificate is useless without the private key that never left the device.
-
Verify
The gateway checks the signature and the live revocation state on every call, then fails closed. There is no session to hijack and no cached “already logged in” state to ride.
-
Prove
Each decision is appended to a signed, tamper-evident log. Anyone can pull a single entry and verify it against the signed root in their own browser — no access to our systems required.
What makes it different
Four properties we designed around, not bolted on.
Revocation that lands
Kill a certificate and the entire delegation tree beneath it goes with it. Because enforcement happens per call rather than per session, the next request is already denied — you’re not waiting out a token’s lifetime.
Audit you can check
The log is an append-only Merkle structure with a signed root. Pull any entry and verify the proof client-side. An auditor doesn’t have to believe our dashboard — they can do the maths themselves.
Built for agents
Hand an AI agent a narrow slice of your authority — specific tools, a short window, nothing more. Every call it makes is verified against that slice and recorded, so “what did the agent actually do” has an answer.
The part nobody else offers
Don’t trust us. Check.
Most security products ask you to believe their dashboard. Sigilex publishes a signed root of its audit log, and ships the verifier to your browser. If our records ever disagreed with the cryptography, the cryptography would say so — in your hands, not ours.
- Per-entry inclusion proofs, verified client-side
- Tamper-evident by construction — an altered entry breaks the chain
- Exportable evidence for auditors and incident review
chain integrity intact
entries 4,182
signed root 9f2c…a71d
leaf 4182 VERIFIED ✓ client-side
method in-browser (WASM)
trusted party none required
Products
One protocol. Three ways in.
Sigilex is the platform. You don’t have to adopt all of it at once — most teams start with whichever edge hurts most.
Sigilex Identity Mesh
The core: capability issuance, delegation, per-call verification and the provable audit trail — with an admin console for the humans who have to run it and answer for it.
Sigilex for MCP
Put your MCP tool servers behind CAP. Agents get scoped, expiring authority instead of a shared API key, every tool call is verified independently, and the whole session is reconstructible afterwards.
Sigilex SSO
A standards-compliant OpenID Connect provider, so the applications you already run can authenticate against CAP without knowing anything about capability certificates.
Early access
Running agents against systems that matter?
Sigilex is deployed and running in production for early-access customers. If you’re handing autonomous software real authority — and you need to prove afterwards exactly what it was allowed to do — we should talk.