Your agents are already messaging customers. Prove what they said.

Kanvo sits between your AI agents and the channels they send on. Before a message goes out it checks the agent's authority; after it goes out it writes a signed, tamper-evident record of who sent it, on whose authority, under which policy, and whether it disclosed itself as AI.

Permission slips before. Receipts after.

A company's AI assistant messages a customer: “Hi, your order arrives tomorrow.” Later, someone asks who sent that — and whether the company ever gave the assistant permission to say it. Today there is usually no answer. The log records that a message went out, and nothing about who was behind it.

The obligation arrived before the tooling

EU AI Act Article 50 became enforceable on 2 August 2026. Interactive AI must disclose itself and synthetic content must be machine-readably marked, with penalties reaching EUR 15M (roughly $16M) or 3% of worldwide turnover — and it binds any deployer whose AI output reaches the EU, not only EU companies.

The obligation is already live

EU AI Act Article 50 became enforceable on 2 August 2026. Interactive AI must disclose itself and synthetic content must be machine-readably marked, with penalties reaching EUR 15M (roughly $16M) or 3% of worldwide turnover — and it binds any deployer whose AI output reaches the EU, not only EU companies.

The primitives got standardised

Between October 2025 and February 2026 agent identity acquired a wire format: RFC 9421 message signatures over Cloudflare's Web Bot Auth draft, Visa's Trusted Agent Protocol, and AP2's signed mandates. Building this in 2026 is assembly rather than invention — and that was not true a year ago.

The agents are already sending

Gartner expects 40% of enterprise applications to carry task-specific agents by the end of 2026, against agentic AI spending of roughly $202B. The messages are going out now; the record of who authorised them is not being kept.

Every application is growing an agent of its own

The same Gartner figure read from the other side: if 40% of enterprise applications carry a task-specific agent by the end of 2026, then a working person is about to have a dozen assistants, each behind a different tab, each with its own history and its own idea of who they are. That is the fragmentation messaging spe…

The buyer already has the budget

Regulators collected more than $2B from over 100 firms for unarchived business messaging. The sweep ended but the recordkeeping rules did not change, and FINRA now surfaces the same violations in routine exams and has barred individuals personally.

Eight layers between your agent and the wire

Each one is a control your reviewers can inspect and your recipients can verify without taking Kanvo's word for anything.

Attested send

Every outbound message emits a signed envelope: actor type (human or agent), the principal it acted for, the mandate it used, model and version, policy version, disclosure state, channel and content hash. Built on the same HTTP message-signature format the agent ecosystem already uses, so one identity serves messaging…

Disclosure engine

Detects agent-originated messages and enforces AI disclosure per channel and per language, recording the result in the attestation. This is the part of Article 50 compliance a messaging platform is uniquely placed to solve, and the deadline has already passed.

Agent mandates

A named human grants an agent bounded authority — which contacts, which channels, volume ceilings, expiry, whether it may send unattended. Modelled as a W3C Verifiable Credential so it is revocable, offline-checkable and independently verifiable, and aligned with the signed-mandate pattern in AP2.

Approval lane

Risk-scored agent drafts route to a human approver instead of the wire when they touch a new contact, financial content, or the edge of a mandate. Agents execute and humans approve is the dominant enterprise pattern in 2026, and the approval is itself signed.

Evidence ledger

Attestations are hash-chained and summarised into a periodically published root. The export becomes a Communications Evidence Pack: every message with its actor, mandate, disclosure, approver, model and inclusion proof. Archiving vendors can prove a message existed; only the system in the send path can prove who wrote…

Public verifier

A free, unauthenticated page where a recipient — or their bank, or their lawyer — checks whether a message genuinely came from that brand's agent, when, and under whose authority. The RCS verified checkmark, except cross-channel, agent-aware and not owned by a carrier.

Post-quantum attestation

Hybrid classical and ML-DSA signatures with an algorithm identifier in every envelope. The quantum-urgent asset here is not message confidentiality but signature longevity: an attestation is evidence for years, and a signature that becomes forgeable later retroactively voids everything signed today.

Independent anchoring

Publish ledger roots and the agent signing-key directory to a public, append-only medium so the ledger's integrity can be checked without trusting Kanvo, and a silent key substitution is detectable. This is the one place decentralisation genuinely earns its cost.