Record
Capture the accountable official, purpose, limits, term, protected boundary, and required evidence in a versioned authority record.
Explore the platformSix questions everyone asks. One nobody does.
The agent-trust playbooks now circulating all list the same six questions to answer before allowing a sensitive agent action:
- Is this a human or an agent?
- Which agent is it?
- Who is it acting for?
- Is it allowed to do this?
- Is the agent, or its principal, risky?
- Should this action be trusted right now?
All six are answered from the session. The seventh is answered from the lifetime of the grant:
- Who authorized this actor, is that authority still standing, and did execution stay inside it?
An organization can answer all six and still have no idea that the service account behind its nightly batch was approved in 2021 by a manager who left in 2023, was never re-affirmed, and picked up two extra roles along the way that nobody signed for.
Observability shows what happened. Authority provenance proves it was allowed.
Free tenant reach sheet
Start with your own number, this afternoon.
The first run needs one read-only app registration and one consent click, and no Defender add-on. You run it in your tenant. Nothing leaves it. There is no licence and no engagement attached to it.
- Who holds privileged roles in your tenantUser accounts and service principals, by role, from the directory as it stands.
- Which consents are tenant-wideThe admin-class grants that reach every mailbox, file and record.
- What a privileged session can reachThe reach number, and when you add Vulnerability Management later, the CVE sheet adds the device column on top.
The operating arc
Record. Observe. Preserve.
Observe
Normalize what directory, cloud, delegation, and execution sources report without letting a collector decide what the facts mean.
Inspect the evidencePreserve
Seal the conclusion with its sources, timing, and coverage limits so a third party can inspect the record without the engine.
See offline verificationPlatform
Sealed in your tenant. Verifiable offline. Four surfaces, one record.
Declared authority remains the standard. Evidence sources report what they saw, and accountable people make the consequential calls.
- 01 / RECORD
NHA Ledger
What each account and agent was allowed to do, and what it did.
- 02 / PRESERVE
Proof bundle
The signed file you hand an assessor.
- 03 / VERIFY
Offline verifier
Checks that file with no network and no Cerydora in the room.
3 questions asked of every action on record
4 verification results, kept separate
0 network calls to verify a bundle
Published in the open
The criteria are published, and so is the evidence format.
Any auditor, and any competitor, can check the result.
- Open specification and reference verifierApache-2.0 for the verifier · CC BY 4.0 for the specificationgithub.com/csingcloud/authority-provenance
- Verifiable approval records v0.1Minimum contents for standing authority behind non-person actor actions · November 3, 2026doi:10.5281/zenodo.23933521
- Authority Provenance bundle v0.1Specification, field tables and test vectors · October 23, 2026doi:10.5281/zenodo.23601519
- Authority exposure v0.1Standing authority reachable by undeclared input · October 12, 2026doi:10.5281/zenodo.23318689
Going forward vs. on the record
Your identity platform manages who owns an agent from today on. Cerydora proves every action on record.
| Managing ownership, going forward | Proving each past action |
|---|---|
| A sponsor or owner is assigned to each agent | Who granted it. Recorded by immutable directory identity, on the grant itself, not in a mutable owner field. |
| Sponsorship moves to a manager when someone leaves | Was it still standing. At that instant the answer is attested, unattested with its reason, or not evaluated with its reason. Never a blank. |
| Grants expire and access is decided at the point of access | Did it stay inside. What the actor did, compared with what was declared, not with a live role assignment. |
| One audit trail inside the vendor's console | Checked offline. A sealed record a reviewer verifies with a standalone verifier, without Cerydora in the room. |
A transferred sponsorship is not a review. The record shows the difference.
Offerings and pricing
Buyable this quarter. Priced in the open.
Cerydora runs inside your tenant. Nothing leaves it. Start free, prove it on your own estate under one fixed engagement price, and keep going on the platform.
Free
Who holds privileged roles in your directory, user accounts and service principals, and what a privileged session can reach. Read-only identity you create and can revoke at any time. Runs in your tenant; results stay there.
Run the free reach sheet$32,500fixed
A defined-scope engagement to record, observe, and preserve accountable authority for a named set of AI systems and non-human actors. Collectors, onboarding, the authority-exposure baseline and your first evidence pack, in six to ten weeks. Fixed, under Florida's competitive-solicitation threshold; other states quoted to their threshold. One price, no metering surprises.
Request the scopeSee a sample SOWFlorida deliverable · 60GG-2 Evidence Pack
60GG-2 Evidence Pack
Control-by-control evidence for Rule 60GG-2's identity, authorization, and monitoring subset, shaped for the July 31 gap assessment and the triennial risk assessment.
Review the named subsetfrom$75,000per year
Continuous authority provenance across your estate, tiered by the number of non-human actors under governance. Agency, multi-agency and statewide options.
See the four surfacesHow to buy
Cerydora LLC is a registered MyFloridaMarketPlace vendor. The $32,500 engagement sits under Florida's Category Two threshold, so an agency issues a purchase order. The platform tier is quoted for a competitive solicitation or an alternate contract source.
Services: AI policy stand-up · Managed authorization review
Talk to us about your estate
Prices in USD for public-sector entities. Statewide and cooperative-contract pricing on request.
Public sector
The July 31 gap assessment, evidenced control by control.
Every Florida agency files a July 31 gap assessment with the Florida Digital Service or its successor; Cerydora's sheets lead with PR.AC-1, PR.AC-4 and PR.IP-11. Those are account management, least privilege and personnel-change handling, for human and non-human actors alike. Cerydora runs in the agency's own tenant, inside the FTI boundary. It reaches on-prem Active Directory, Entra ID, and host-local Linux and Windows accounts.
- IRS Publication 1075: also evidenced by reference, safeguard sections beside NIST SP 800-53 Rev. 5 identifiers, with no control text reproduced.
- CJIS Security Policy: the same authorization record and evidence serve the CJIS audit; CJIS identifiers are not yet carried by reference.
Florida · 60GG-2 Evidence Pack
Control-by-control evidence for the identity, authorization and monitoring subset.
The Cerydora 60GG-2 Evidence Pack generates control-by-control evidence from recorded authority and observed activity. It shows what each actor was authorized to do, who granted it, whether it was still in force, and whether execution stayed inside it. Each sheet states whether the cited evidence holds, does not hold, or was not evaluated; it never issues a satisfied or not-satisfied verdict. It states plainly which neighboring identifiers the evidence cannot yet reach.
Agencies also re-authorize systems through a triennial risk assessment; the sheets fit its authorize-and-monitor steps. Output is shaped for the gap assessment, System Security Plan authorization-boundary sections, and after-action reports, each artifact signed and verifiable offline. Each sheet is a dated, signed file an assessor can cite in the evidence column on sight.
Coverage is the identity, authorization, and monitoring subset. It does not replace the agency's plan, training, network controls, or the information security manager's judgment.
Latest
Latest from Cerydora
Verifiable approval records
A companion note. A claim of approval is not evidence of approval. The note states what an approval record must carry for an assessor to tell, without the system that produced it, who approved, whether they held the authority then, what they approved and until when, and which action ran under it.
Read the publicationPublicationThe Seventh Question
Detection tells you an agent acted. It does not tell you who let it. The six questions every agent-trust playbook asks, and the seventh, answered from the lifetime of the grant rather than the session.
Read the essayPrint the one-pagerEssayAuthority Provenance bundle v0.1
The open specification for the sealed evidence record: what a record asserts and what it does not, the field tables, the evaluation states, and the test vectors the reference verifier is checked against.
Read the publicationPublicationCompany
Founder-led. Built in Tallahassee.
Cerydora LLC is based in Tallahassee, Florida. Its founder, Cliff Singletary, CISSP, is an identity, endpoint and compliance practitioner in regulated public-sector environments, and a contributor to IETF (WIMSE, SCITT, OAuth), OpenID and NIST AI control-overlay work.
Operational boundaries
What the product does—and what it refuses to claim.
Decision authority remains human.
Cerydora never approves an activity. It makes the responsible person's decision precise, durable, and checkable.
Evidence sources report; the engine determines.
Evidence sources do not judge their own findings. The declared authorization remains the standard.
Missing evidence remains visible.
Silence, gaps, and stale observations are recorded as such. They are not treated as evidence that the boundary held.
Working state and examiner evidence are distinct.
Internal detail stays separate from curated evidence views, while omissions and coverage limits remain explicit.
Synthetic corpus
Every example on this page comes from a fictional state agency, a fully synthetic agency with 2025 source dates. It runs end to end: grants and their authorizers, the day an approver's account is deleted, the receipts actors keep producing, internal and examiner views, and a bundle the offline verifier checks.
Demonstration · State of Trescott Department of Transportation (fictional)
Review the departed-approver case in five minutes.
Trace one authorization from the approving official through the day the directory deleted their account, the receipts the actors kept producing, and the four separate offline verification results.