Traefik Labs puts agent audit logs under witnesses the operator does not run

The threat model is the operator. A signed audit log settles nothing when the team running the gateway also holds the signing key, because that team can issue a shorter history and sign that too. Traefik's answer is witnesses administered separately from the platform team, so someone outside it can verify that previously witnessed history has not been rewritten or shortened ^[3]. "An auditor should be able to check the record without taking our word for it," said Emile Vauge, founder and CTO of Traefik Labs ^[11]. "An independent witness gives them a way to challenge a history that has been rewritten, even when the operator controls the log and its signing key," he said ^[12].

Cryptographic fingerprints of gateway logs and access logs go to a transparency log, and a verifier checks retained records against those commitments and signed checkpoints while the original log content stays in customer-controlled storage ^[4]. Those commitments detect tampering with the decisions that passed through the gateway ^[2].

Delegate exchanges credentials through the organization's identity provider using ID-JAG, the draft IETF grant behind Okta's Cross App Access, with the identity provider controlling which permissions are issued ^[5]. That authorization half is where this departs from prompt-level control. Because the assertion names both the person and the agent, an agent can be granted strictly less than the person it acts for ^[6]. Authorize then asks the customer's own policy engine over OpenID AuthZEN whether a given API request or MCP tool call is permitted, and enforces the answer before forwarding it ^[7]. Enforcement covers the agent's tool call and the tool's own call to the backend API, the hop that executes the transaction ^[8].

Traefik says the backend remains responsible for transaction correctness ^[14], so a refund that policy allowed and the log proves was allowed can still be a bad refund. Approvals and refusals are both protected against undetected alteration, and Traefik's argument is that a refused action matters as much as a completed one when judging whether a control worked ^[17]. The evidence path is kept separate from incident telemetry so the audit record is unsampled, while the same log lines also feed the security team's SIEM ^[13][15].

Help Net Security published the announcement on September 15 ^[18], with general availability planned by September 30 ^[1], fifteen days out ^[19]. The interop named is Traefik's own testing: the RFC 8693 then RFC 7523 exchange against Okta Cross App Access and the self-hostable Janssen Auth Server ^[9], and enforcement against OpenFGA and Cerbos through AuthZEN middleware in the gateway ^[10]. Janssen being self-hostable closes the chain without a cloud identity service in the path. The announcement does not include pricing or named customers ^[20].

For anyone pointing agents at refunds or customer records, the question this is built to answer is the one Traefik puts to CISOs: who authorized the action, and which policy applied, without the platform team piecing the history together after the fact ^[16].