Compare
Rig separates human sessions from AI agents borrowing the same identity.
Cyphrex is the decide-and-prove layer: every action checked, every decision recorded in a trail you can verify.
Rig admits the seat. Cyphrex proves the act: who approved, what was touched, and what stayed blocked.
Rig
A platform for identity teams who need one view of human, non-human, and AI identities, a way to tell an agent session from the person whose credentials it borrowed, and a block that stops the agent without locking out the employee.
Inventory → correlate → distinguish → endpoint enforce.
Cyphrex
A decide-and-prove layer for teams who will instrument an agent or route its MCP traffic, and who need each decision kept as tamper-evident evidence.
Enforce the action → tamper-evident evidence.
| Capability | Rig | Cyphrex |
|---|---|---|
| Tell human vs AI agent on the same credential | Strong fit (session attribution) | Not the primary job |
| Identity inventory / graph across environments | Strong fit | Per-agent identity you register |
| Endpoint block of an agent without locking out the person | Strong fit | Policy check before action in the SDK / gateway path |
| Identity posture (blast radius, toxic access, remediation) | Strong fit | Not an ISPM suite |
| Runtime policy on agent actions you instrument / route | Adjacent | check() + MCP gateway |
| Tamper-evident, independently verifiable decision record | Account and session visibility for identity teams | Ed25519-signed packages + public verify |
| Who approved / what touched / what stayed blocked | Identity of who acted | Compliance receipt for auditors, insurers, legal |
Rig answers who is in the seat. Cyphrex answers what that actor was allowed to do, and proves it. The two jobs are different, and they can sit on the same estate.
Every Cyphrex evidence package is signed with Ed25519 and bound with SHA-256. On /verify, someone can check it without a Cyphrex login.
Evidence artifacts map toward SOC 2 / EU AI Act / HIPAA / SR 26-2 style reporting — not certification; details on Trust.
Cyphrex signs what flows through the SDK check() or the MCP gateway. It does not invent coverage for a path it never saw. Cyphrex is not your auditor.
Often a complement. Rig tells you who is in the seat. Cyphrex records what that actor was allowed to do, and proves it. Cyphrex does not replace Rig.
No. That is Rig’s job. Cyphrex checks policy before each action you instrument or route, and records the decision.
Yes. Allowed or blocked is part of the decision record, with the agent, action type, resource, rule, and timestamp.