Rütli

Inspiration

Agentic AI is moving into regulated settings — public administration, finance — where "the agent did the right thing" isn't good enough. What's needed is non-repudiable proof of why it was allowed to take an action in the first place, not just a log that it happened afterward. That's the actual guarantee the EU AI Act's Article 12 logging requirement is reaching for, and it's a guarantee most of today's LLM tooling doesn't give you.

The name comes from the 1291 Rütli oath that founded the Swiss Confederation — a mutual-trust pact between parties who each neede others kepttheir word. That's exactly what an audit ledger does for an agent and i what it did,and the ledger proves it can't lie about it afterward.

What it does

Rütli wraps an Apertus 1.5 agent runner with a policy gate (Eunomia, thirpend-only,hash-chained event ledger. Every prompt, policy decision, tool call, and, replayable,tamper-evident event — PromptReceivedEvent → PolicyEvaluateedEvent →ModelOutputEvent, each carrying a hash chained to its parent.

Measured againine on ascripted task set (legitimate calls, unauthorized calls, prompt-injecti 100% ofunauthorized and injection attempts versus the baseline's 35.7% — the bas mostovertly-worded unauthorized requests (71%) but 0% of injection attes written tolook authorized, which a surface-level prompt-only policy can't see throalresource/scope tuple instead of the prompt text, so wording doesn'

A naive tamper of the time by hash-chain verification alone — but a more sophisticated tamper (rewritry downstreamhash) fools that check completely. Only a separate append-only WOnst the primary ledger, catches it — also at 100%.
How it was built
Eight ADRs drove the architecture, each one a real decision pointon:

Decoupled policy engine over a synchronous proxy gate is a seddleware, so it can be audited and evolved independently of the r- Event-sourcet trail is thesource of truth, not a side effect of logging. - Crypto-shreda subject'sdata gets erased by destroying their decryption k by mutating ditabilitystop being in tension. - WORM backupsophisticated-tamper case the hash chain alone ca catch.
A human-in-the-loop self-review layer that period mines the leinjectiontasks, false-block drift, and latency outliers — writes its olass auditableevent, never silently.
Mentor feedback (Oliver Grognuz, 2026-10-05) shapedconcrete pivotitor trackalone rather than splitting effort across a second Sovereign-Agenallenge — isthis actually differentiated from LiteLLM, the LLM gateway everyone alreaoduced a real, citable answer: LiteLLM has an open, unresolved feature request (Berriexactly thehash-chained, independently-verifiable audit receipts Rütli already themaintainers' words, "operator-controlled and cannot be independently t trust theoperator's infrastructure." That gap, plus the missing GDPR-erasure mr, becameSection 7 of the technical report instead of a hand-wave.

Challenges

The honest ones, not the flattering ones:

The headlineinisticdev-stub backends (StubApertusAgent, ScopePolicyGate), not live Apegeunomia-server — the harness, ledger, and metrics code are real andmodel and alive policy server together is the single biggest remaining ga
The WORM mirror's immutability enforcement is host-dependedegrades to aplain file on non-Linux hosts or filesystems without thcapability, t, so theactual submission machine has to be checked, not assumed.
A naming collision caught mid-build: "Rütli," "Eunomia"(the third-petes" (anunrelated Powerworks product, formerly also "EUnomia") are three dirred together — worth a dedicated naming note in the README so nobody, including fu
Latency numbers aren't representative yet — the in-process ss the harness's own overhead, not a real networked policy-check round-trip. What's left fooped ratherthan oversold: wiring the real model and policy setogether, expa the full 30–50 target with model-generated edge cases instead of hand-authored rs hold up — aone-click compliance-dossier generator straight from the ledger.