Your AI has permission. That doesn’t mean it’s safe.
HAIEC shows what your AI can really reach, what it actually did, and where the evidence stops — so you can prove what’s true and be clear about what isn’t.
This is not hypothetical.
Publicly disclosed incidents keep repeating the same shape: individually legitimate capabilities connecting into an unintended consequential path.
Public input → private data → public output
A malicious public issue influenced an AI agent that could read private repositories and create public pull requests. Individually valid capabilities formed a data-leak path.
Trusted tools can create an untrusted sequence.
Illustrative pattern. HAIEC evaluates whether a comparable path exists in your system.
Publicly disclosed pattern · Invariant Labs, May 2025Email → internal context → external leak
A crafted email could influence an enterprise AI assistant and cause internal data to leave through an external channel, without the user intentionally sharing it.
The input itself can become an instruction source.
Illustrative pattern. HAIEC evaluates whether a comparable path exists in your system.
Publicly disclosed pattern · Microsoft Security Insider, 2025Agent → production data → destructive action
An AI coding agent deleted app database data during development; the platform later strengthened development/production isolation.
Natural-language intent is not the same as enforced authority.
Illustrative pattern. HAIEC evaluates whether a comparable path exists in your system.
Publicly disclosed pattern · Replit, July 2025These are publicly disclosed patterns, not HAIEC findings. HAIEC does not claim to have detected or prevented any named incident. The assurance question is whether a comparable influence, reach, authority, and consequence path exists in your system, and what the evidence establishes about it.
See the paths a checklist cannot show.
HAIEC expands the agent into the system around it: what can influence it, what it can reach, what controls the path, whether another route leads to the same effect, and what the evidence actually proves.
Influence
User input, knowledge, memory, tool output, peer agents, runtime configuration
Reach
Tools, APIs, data, identities, cloud, workers, external services
Control
Authentication, authorization, tenant scope, approval, validation
Paths
Canonical path, async workers, direct tool calls, webhooks, retries, legacy fallbacks
Consequence
Data change, money movement, access change, production change, external communication
Evidence
Established, partial, unknown, or not assessed — with inspectable proof and an explicit frontier
What does the evidence actually prove?
No vulnerability does not mean no consequential capability. A perfectly valid tool, called through a valid API, using a valid service identity, can still produce an action the organization never intended the AI to choose.
Permission is not delegation. Security controls answer whether an identity is permitted to do something. They do not necessarily establish whether the AI was delegated the consequential choice it made.
Permission
An identity policy that allows an action. Establishes what is permitted, not what was authorized by a human decision.
Delegation
Whether a human or process with authority actually delegated the consequential choice to the AI. Distinct from permission. Not always established by available evidence.
HAIEC does not claim delegation violations are currently proven unless evidence establishes them. The distinction between permission and delegation is a structural insight, not an automatic finding.
1. Requested
What the request asked the AI to do
2. Policy Authorized
What policy and configuration permit
3. Effectively Granted
What credential evidence establishes
4. Code Capable
What the application can technically do
5. Observed
What runtime evidence establishes was observed
These are evidence questions, not a causal proof chain. A gap between any two is a finding, not a safe state. Not every question currently has a native evidence producer.
Asked for
reroute_traffic on netops.example.comquery_records on customer-db.example.comexport_report to s3://ops-reportsAllowed by policy
narrower than the plane abovereroute_traffic on netops.example.comquery_records on customer-db.example.comGranted by credentials
narrower than the plane abovereroute_traffic on netops.example.comPossible in code
no declarations in evaluated sourceSeen in evidence
includes a host nothing authorizedreroute_traffic on netops.example.comreroute_traffic on attacker-node.example.comdivergencequery_records on customer-db.example.comThe planes are independent evidence planes — what was asked, what policy allows, what credentials grant, what code can do, and what was observed. They are not a guaranteed sequence.
Permission is not delegation. Delegation is not authority. Authority is not observed behavior. HAIEC evaluates each plane and shows where they diverge.
Capability chain
What a task requires vs. what the agent can actually do. Unmet requirements, unobserved grants, and capabilities exceeding the request render as distinct gap types.
Delegation chain
Whether authority actually narrowed at each hop — scope monotonicity and chain continuity. A break is surfaced, never averaged away.
DAI comparison
Four independently-evidenced facts per surface — delegated, code-capable, granted, observed — compared side by side. Divergence is shown, not reconciled silently.
Alternate paths
Expected path
Request → approval → action. The mediated route reviewers expect the AI to take.
Alternate path
A background worker, fallback handler, or direct tool path that reaches the same effect through a different route.
Finding one approval does not prove every route to the action is protected.
From repository to decision.
A bounded lifecycle for evidence-bound assurance of consequential AI systems.
Define
Select the AI system and assurance question
Connect
Connect evidence sources: repo, APIs, and infrastructure
Collect Evidence
Source, identity, access, policy, capability
Assure
Deterministic evaluation within explicit scope
Verify
Decision Receipt with SHA-256 integrity
Monitor
Ongoing evidence from supported runtime sources
Monitor is bounded to supported evidence and runtime sources. Not every connected asset has a native evidence producer. Evaluated Scope is currently structured at the contract level; structured scope binding is under development.
Capability state as of build v1.0.0 — auditable in the repository.
Built for different buyers.
Standards-informed. Evidence-decided.
Grand Challenge Winner
MunichTech EXPO 2026
Evaluated against KestrelVoice, a real multi-tenant AI SaaS: 44/44 action paths met criteria, 1,322 evidence traces, 555 verified checkpoints — jury score 8.7/10.
Deterministic evaluation
No LLM in the canonical detection or assurance path — same input, byte-identical digests.
Open evidence formats
STIX 2.1 indicators for SOC interchange; OTLP intake for runtime telemetry.
Integrity by construction
SHA-256 digests on receipts and case artifacts — recomputable, never edited.
Public samples
Evaluated sample systems are public — read the report, the constellation, and the forensic case yourself.
Different questions. HAIEC connects the answers.
| Buyer question | Scanner | Governance | IAM | HAIEC |
|---|---|---|---|---|
| Does the path exist? | Pattern | Policy | Access | Path + consequence + evidence |
| What influences the choice? | — | Partially | — | Yes — influence chain |
| What's the consequence? | — | Policy text | — | Yes — consequence graph |
| What does the evidence prove? | Findings count | Compliance % | Access logs | Established / partial / unknown + frontier |
| Where does proof stop? | — | — | — | Yes — evidence frontier |
These tools answer different questions — this is not a claim that any of them are wrong. HAIEC connects their answers to the consequential path.
Mapped to standards. Not defined by them.
HAIEC maps evidence to recognized frameworks and regulations. This is evidence mapping, technical evaluation, readiness, and assurance support. Framework mapping is not the same as assurance. A green or source-established fact is not the same as safe.
AR-01
Instruction-Like Pattern in Model Context
AR-22
Prompt / Context Attack Signal
AR-69
Handover Outside Declared Scope
Framework mapping ≠ certification. Standards inform. HAIEC evaluates.
Browse all framework mappingsHAIEC supplies evidence and analysis. The qualified firm, CPA, certification body, or assessor retains professional judgment and issues the applicable attestation, certification, or assessment outcome. Framework mapping does not equal assurance.
What can this AI actually cause?
One bounded system. One primary assurance question. Explicit evidence boundary. Decision-grade technical and executive output.