EVE Proof & verification

AI Compliance Evidence

Reviews and audits ask a simple question: show me what your AI system decided, and prove the record is real. EVE supports evidence collection for governed decisions — signed, verifiable records that a reviewer can check independently — and it produces records useful for review rather than assertions you have to take on faith.

What EVE provides for reviews

Signed decision records — each governed decision can emit an evidence envelope bound to the decision (ECDSA P-384 production, HMAC-SHA256 fallback).
Independent verification — reviewers verify records offline in Python, Node, or the browser with the public key.
Deterministic, reproducible decisions — because no LLM is in the decision path, a decision can be reproduced from the same input and policy version.
Control mapping — red-team and policy artifacts can map controls to frameworks to help organize review, described as mappings, not certifications.

SDK example

from eve_coreguard import CoreGuardClient, verify_decision_record

client = CoreGuardClient(api_key="eve_sk_...")
result = client.evaluate(
    request_id="sess_6",
    tenant_id="org_abc",
    proposed_action={"type": "approve_claim", "claim_id": "clm_88", "amount": 12000},
    model_output={"decision": "approve"},
    context={"principal_id": "adjuster_2", "session_id": "sess_6"},
    policy_set="insurance_v1",
    include_evidence=True,
)
record = result.signed_governance

# A reviewer verifies without trusting EVE:
assert verify_decision_record(record, public_key_pem=pubkey).valid is True

Readiness

Signed evidence and offline verification are SUPPORTED. The governance decisions the evidence describes are PILOT_READY. Red-team and artifact subsystems that help produce review records are customer-pilot ready at supported boundaries.

Limitations

Evidence attests authenticity and integrity of the record, not the correctness or legal sufficiency of the decision.
Control-to-framework mappings are descriptive and are not a certification; EVE does not by itself make a system compliant with any standard.
Independent verification requires the ECDSA P-384 public key; the HMAC fallback is symmetric and not independently verifiable.

Next step

Run a pilot and collect signed evidence on your own decisions; verify a sample offline before any review.