The technical layer of a workspace shared by several parties

The infrastructure of a dossier shared by several parties, open to your agents.

Plug in your agent runtime over MCP, REST or the SDK. Every act is written to a record each party recomputes offline, under delegated authority an agent never exceeds — and that never includes signing or consenting.

Create a developer account Read the protocol
@val-protocol/demo
$npx @val-protocol/demo
✓chain minted - 5 acts, floor B
✓verify: integrity / lineage / scope - green
✗attack: byte flipped - CAUGHT
✗attack: history rewritten - CAUGHT (floor B -> A)
✗attack: signatures stripped - CAUGHT
○attack: silent truncation - NOT caught, and it tells you

One command. It mints a live authority chain on your machine, verifies it offline, then attacks it four ways: a byte edit, a full history rewrite, a signature strip, a silent truncation. Three are caught. The fourth is not — and it tells you so rather than hiding it.

ASSIGNMENTACCESSMUTATIONCOMMUNICATIONCONSENT ✓

Independent verification

The full chain recomputes on your machine.

The verifier is an open-source, vendor-neutral npm package. It re-derives every link of the authority chain from the raw bytes — with no call to RIGA. If we lied about a single action, verification would fail on your machine.

View the package on npm

Then wire it into your own stack:

verify.ts
import { RigaClient } from '@riga-solutions/sdk';

const riga = new RigaClient({
  baseUrl: 'https://backend.riga.solutions',
  apiKey: process.env.RIGA_API_KEY,
});

// Pull the authority chain and re-derive it offline — no trust in RIGA.
const chain = riga.audit.export(dataroomId);
const result = await chain.verify();

console.log(result.ok);           // → true  (every link re-derived from raw bytes)
console.log(result.rowsVerified); // → how many links were checked

Verified offline — no call to RIGA, no trust required.

One integration, every surface

Wire your agent runtime. We provide the primitives.

MCP, REST, SDK, signed webhooks, OAuth and the chain verifier — wire them to whatever runtime you run (Claude, n8n, your own backend). The Stripe model: we ship the building blocks, you orchestrate.

MCP server

Model Context Protocol · 29 tools

Two servers expose RIGA primitives as native tools to any MCP-capable agent. Every agent-reachable verb also ships on REST — never MCP-only.

REST API

/v1 · 13 resources · 46 routes

datarooms, documents, folders, parties, records, tasks, Q&A, resolutions, sends, mediations, audit, usage. Stripe-shape error envelope, idempotent by key.

TypeScript SDK

@riga-solutions/sdk · 11 resources

Typed client, ESM + CJS. Streams an audit export as an AsyncIterable and verifies the chain inline.

Signed webhooks

HMAC signature

Chain events delivered and signed; verify authenticity on receipt.

OAuth

RFC 9470 · Step-Up

Delegated authorization with step-up auth for sensitive actions.

Verifier CLI

@val-protocol/chain-verifier-cli

Validate an entire chain from the terminal or your CI — no dependency on RIGA.

How it works

Delegate, act, verify.

01

Delegate

A human grants the agent bounded authority — scope, reach, expiry. The delegation is anchored in the chain.

readuploadgrounded Q&Aproposesigndestroy
02

Act

The agent calls MCP, REST or the SDK. Each action writes a link hash-chained to the delegation that authorized it.

MUTATION principal: agent:sa_… · mandat: user:… · hash lié
03

Verify

Anyone — you, your client, a regulator — re-derives the chain offline and proves the agent never exceeded its authority.

integrity GREEN lineage GREEN scope GREEN

A protocol, not just a product

We published the standard.

VAL — Verifiable Authorization Lineage — is an open specification. The verifier, webhook receiver and CLI are published under the neutral @val-protocol scope, Apache-2.0 licensed. No lock-in: if you ever leave RIGA, your proofs stay verifiable forever.

Protocol repository val-protocolnpm packages@val-protocol/*@riga-solutions/sdk
LicenseApache-2.0 · vendor-neutral

Product reference

What the interaction layer guarantees, in detail.

Delegation under a signed mandate, acts reserved to people, proof levels, offline verification, closing, hosting. The product page says what it is; this section says how.

The neutral space

Operating the room grants no power over the record.

Whoever commissions it — one side, both, even us — there is one record, the same for every party; no one can rewrite it unnoticed, and any party can verify it without trusting the others, or us. Inside it, the work and the automation continue: humans, and the AI agents acting for them, under authority that is delegated, revocable, that an agent can never exceed — and that never includes signing or consenting.

What makes a space neutral

—

No one arbitrates. We are party to nothing: we record who did what, under whose authority. Opening the space grants no control over the record — nor does paying for it.

—

Every party can verify. The record recomputes on your machine, with no account and no connection, with an open-source verifier published under a name independent of us. It outlives the matter, the software, and us.

—

Authority is bounded and traced. Every action traces to a person who authorised it. A delegated assistant never exceeds its delegator; restricting the delegator restricts the assistant from its next action; and it neither signs nor consents — ever.

—

The same pieces, on both sides. What is exchanged has no private version: each party sees what was sent to it, asked of it, answered to it — and can respond.

—

An ending that belongs to you. When the room closes, every signatory of the outcome walks away with the same file — the terms, the consents, the full history, a report that verifies itself — sealed so that each copy proves its own authenticity. We host an encrypted copy for a limited period, and never delete it before every entitled party has provably taken theirs. Your copy is the record.

—

Automatable at every depth. Use the space as it is; plug your assistant into it; or embed it entirely in your workflow through API and MCP. Three depths, one workspace — a link in your chain, not another portal.

Delegation

Each party delegates its own agent, under a signed mandate.

Bring your agent from Claude, Cowork or any compatible MCP client, and delegate it in one click. An agent never exceeds the rights of the person who delegated it: what it can do is recomputed at every act, from its delegator's actual rights at that instant.

Over-delegation has no effect. Restricting the delegator's access restricts the agent from its next action; extending it requires a new signed delegation. Anyone can revoke their own agent, at any time.

Mandate — Claire T.'s agent

Signed delegation

by Claire Tricat · Tricatel party

Profile B

The mandate composes:

readuploadgrounded questionsproposesigndestroy

Recomputed at every act · isolated to its party

Revoke

Agent surface — tools/list (excerpt)

✓ document_read · document_upload
✓ task_propose · qa_answer
✓ resolution_propose
∅ consent — no tool, on any surface
∅ sign — no tool, on any surface

The human boundary

Some acts remain human, by construction.

  • —Consent, sign never delegable, at any mandate level;
  • —Ratify or retract an act — reserved to the delegator;
  • —Destroy or dispose only under an express, separate mandate;
  • —Close the room seals after every party's consent.

No mandate, at any level, composes these acts for a machine.

Profiles A / B / C

Each instrument carries its proof level — exact, never rounded.

Each instrument — a delegation as much as a consent — carries its own conformance profile, enforced the moment the instrument is born: a mandate below the organization's floor is refused, with a typed error.

The chain reports the weakest profile present and declares the key's nature: device-bound, syncable, or unattested.

A — operator-attestedB — device-signed (WebAuthn)C — eIDAS qualified signature

Response — conformance floor

{ "error": {
    "type": "invalid_request_error",
    "code": "grant_profile_below_floor",
    "message": "Grant conformance profile A is below
      this organization's minimum profile floor (B)."
} }

The floor applies at the instrument's birth, before any act.

Independent verification

The full chain verifies offline, by anyone.

Export the chain to a file and verify it with the VAL protocol's public tooling — open (Apache-2.0), runnable without a single call to us. If we lied about a single act, verification would fail on your machine.

Timestamp anchoring (RFC 3161) is validated by the same verifier, down to the CMS signature — proven against real TSA tokens, including forged ones. An unanchored chain verifies fully; an anchor verifies or is reported absent, never assumed. Anchor issuance ships in the substrate, behind an activation gate.

$npx @val-protocol/demo

Closure

And it ends.

When the room closes, every signatory of the outcome walks away with the same file — the terms, the consents, the full history, a report that verifies itself — sealed so that each copy proves its own authenticity. We host an encrypted copy for a limited period, and never delete it before every entitled party has provably taken theirs. Your copy is the record.

If you lose your copy, any signatory's copy — including the other party's — restores the file: authenticity does not depend on who holds it; every copy re-hashes to the identical value against the seal.

Platform

An infrastructure of authority and proof. Hosting: France + European Union.

Encryption

One key per room, retired at closure

AES-256-GCM per room. Closure retires the key from service; it is destroyed after a 30-day retention — cryptographic erasure.

Residency

Documents in France, chain in the EU

Encrypted documents are hosted in France; the chain and metadata in the European Union.

Proof portability

The proof leaves the infrastructure

The exported chain verifies outside any infrastructure, with the protocol's public tooling.

Build on authority you can prove.

Create a developer account View on GitHub