MOSS enforces policy before AI agents act and signs every action with post-quantum cryptography. Free tier; paid plans from $99/month.
Researched and fact-checked by Bartu Cavusoglu · Updated October 26, 2026
MOSS, short for Message Origin Signing System, is control infrastructure for enterprise AI agents, built by IAMPASS Technologies Inc. It enforces a company's policies before an agent acts, then signs a permanent record of what the agent did. The goal is to let a business hand real work to AI while still being able to answer for every action it takes.
Unlike governance platforms that catalog, score, and report on AI, MOSS describes itself as the layer that prevents, stops, and proves what agents do in production. It signs actions with ML-DSA-44 post-quantum cryptography (FIPS 204) and maps to 170 regulatory frameworks and 264 specific obligations, so a record written today can still be verified years from now.
Each agent is registered and receives a signed passport, a tamper-evident identity. When the agent requests an action, the MOSS policy engine decides ALLOW, HOLD, or BLOCK in real time, before anything executes. Allowed actions are signed against the agent's passport, and the decision is written to the record.
Records are hash-chained and rolled into Merkle roots, so changing one entry breaks the chain. Anyone can verify a record offline, without an account. If an agent goes off-policy, the kill switch revokes its capability across every running session. Signed records and signals can be streamed to the SIEM and keys a company already runs.
The platform is organized as seven services: post-quantum signing, cross-org federation, execution envelopes, the policy engine, behavioral boundaries, compliance frameworks, and audit infrastructure. Behavioral boundaries check capability, constraints, fingerprint, and intent in real time. Execution envelopes record what each agent did and with what inputs.
Two features target oversight. The MOSS Governance Index turns governance posture into a single score from 200 to 900 across four dimensions. Adaptive governance, available on Enterprise configurations, watches agent behavior, finds policy gaps, and recommends changes with reasoning, evidence, and a confidence score. Applying a change is always a human decision, and every change is versioned and reversible.
MOSS, the Message Origin Signing System, is control infrastructure for enterprise AI agents from IAMPASS Technologies Inc. It enforces policy before an agent acts and signs a tamper-evident record of each action.
MOSS has a free forever Passport tier, Pro at $99 per month, and Team at $299 per month. Annual billing is $990 for Pro and $2,990 for Team, which is two months free. Enterprise is priced per deployment through sales.
Yes. The Passport plan is free forever for 5 agents and 1,000 signed actions a month, and all premium features are unlocked for the first 30 days. No credit card is required.
MOSS says it is not a governance dashboard. It describes itself as the layer that prevents, stops, and proves what agents do in production, and says it can work alongside governance platforms.
The sources say MOSS maps 264 obligations across 170 frameworks. Named frameworks include EU AI Act, DORA, ISO 42001, NIST AI RMF, SOC 2, and GDPR. The number of framework packs depends on the plan.
The sources name SIEM, Slack alerts, and webhooks on the Team plan. MOSS is described as working with any agent framework and deployment, with SDKs and documentation available for developers.
Yes, on Enterprise. The Sovereign configuration offers on-prem, air-gapped deployment with full bring-your-own-key support.
MOSS suits enterprises and regulated industries that run AI agents in production and need enforced policy and audit evidence. Smaller teams can start on the free tier.