AI complianceAI compliance is a question about evidence
AI compliance is less about a policy document and more about whether you can show what an agent did, under what rule, and prove the record was not changed. What that actually takes, and where tooling stops.
Security & GovernanceHow do you prove what your AI agent actually did?
When an AI agent touches production, a log is not enough. The security case for witnessed, tamper-evident evidence: what happened, when, by whom, and a record a third party can verify.
Security & GovernanceWhat Stops an AI Agent Going Around Its Governance?
The question every security team asks about AI agent governance, answered in three layers: credential custody, deny-by-default scope, and the honest edge of any control plane.
StandardsNow you can verify our facts, not just read them
facts.json now ships with a signed WARD receipt: a hash, a chain position, and a signature you can check offline, with no account and no call to us. What that actually proves, and what it doesn't.
ResearchBeyond tamper-evident receipts: why AI evidence needs an independent witness
A hash chain proves a set of records is internally consistent; it does not prove that set of records is the one that existed yesterday. That gap between the two claims is where the interesting attack lives, and better hashing does not close it.
StandardsThe fourth draft: WARD is at the IETF
In February we filed three Internet-Drafts and left the fourth at home, because it was not ready and the site said so. This weekend we audited WARD, found a real defect, fixed it properly, and filed the whole family.