OFFICIAL NORMATIVE PROVIDER

TrustLayers × Google CAGE

TrustLayers is the production normative provider named in the source code of the Cybernetic Agent Governance Engine (CAGE), Google's open-source runtime governance engine for agentic AI. If your organization deploys CAGE, TrustLayers supplies the independent legal baselines, external FRIA validation and immutable evidence sealing your deployment needs.

Verify it yourself

Open src/gateway/governance/normative_provider.py and src/integrations/trustlayers/ in the official Google repository. TrustLayers is the named production provider — activated with CAGE_NORMATIVE_PROVIDER=trustlayers.

View the CAGE repository on GitHub →

What TrustLayers provides to your CAGE deployment

Normative Data Supply

GET /legal-baseline/{region}

GET /legal-baseline/{region} — Region-specific legal baselines (EU AI Act, DORA, ISO 42001, NIST AI RMF) fetched at boot and refreshed every 6 hours via ETag. Your compliance rules stay current without redeploying.

External FRIA Validation

POST /validate/fria

POST /validate/fria — A synchronous, independent gate for transactions in the confidence boundary. TrustLayers admits or rejects with documented findings, outside the system being governed.

Immutable Evidence Sealing

GET /evidence-chain/{thread_id}

GET /evidence-chain/{thread_id} — Every governed execution is sealed into a cryptographic hash chain held independently by TrustLayers. Tamper-evident, audit-ready, verifiable by third parties.

Why an external provider

Evidence generated inside the system it governs can be altered by that system. TrustLayers generates and holds runtime evidence outside the execution — an independent architecture, not another framework. That independence is what regulators and auditors accept.

Get started

1 · Request sandbox access

Free, no commitment. We issue an isolated sandbox API key (30 days) so your team can run live integration tests against our endpoints with the EU_ECB baseline.

2 · Configure your deployment

Three environment variables. No code changes — the connector already ships inside CAGE:

CAGE_NORMATIVE_PROVIDER=trustlayers
CAGE_NORMATIVE_ENDPOINT=https://trustlayers.eu/api/cage
CAGE_NORMATIVE_API_KEY_SECRET=<your-key>

3 · Go to production

When your tests pass, we provision your production key, your organization and dashboard accounts for your compliance team, with SLA. Enterprise plans from €30,000/year per deployment.

Request access

Tell us about your CAGE deployment and we'll issue sandbox credentials, typically within one business day.