Found in example source
Reachable handler
A selected code path supports a possible refund operation. A real finding links its source and version.
HAIEC · Evidence-Bound AI Assurance
Go beyond checking AI components. Understand and assess the consequential actions they enable.
Your security scans, access controls and governance policies each answer important but separate questions. HAIEC connects them to the actions AI agents can actually reach – including indirect paths through tools, code and connected systems – so you can investigate real exposure and move AI forward with evidence you can defend.
Deterministic AI Action Assurance. Source-backed findings first. Five independent evidence views. Delegated Action Integrity.
Four-word starting goal
Run HAIEC AI AssuranceConnect once in a compatible MCP-enabled IDE or AI agent, using a scoped key and an authorized source. A goal phrase alone does not install MCP or authorize access.
HAIEC · Why another check isn’t enough
An action-aware assurance layer across existing tools
01 · The Consequence Gap
Each tool checked its part. Who checks the whole action?
Security
No selected finding in scan scope
IAM
Valid API credential
Governance
Approved operating policy
Separately valid viewsConsequential path
AI agent
MCP tool
Worker
Payment API
Potential financial consequence identified from a supported source path
Five independent evidence views
RequestedPolicyGrantedCodeObserved
DAI · A credential can permit the API. Who authorized the agent to choose the recipient?
Action-path exposure surfaced
Potential capability is distinct from a completed transaction. Qualify other evidence as needed for the decision.
Grand Challenge WinnerMunichTech EXPO · Autumn 2026Works with your development workflow GitHub App GitHub Action AI AppSec MCP Isolation MCP / IDEThe value of the first pass
A useful finding doesn’t need the whole picture.
Your code may already reveal an agent-to-API path that can move money, expose data or modify production. HAIEC can surface that candidate risk without waiting for every IAM integration, human decision record or runtime log. Missing evidence shapes how you interpret the finding – it does not erase the path.
First source finding · possible financial mutation
Fictional teaching exampleSupport AgentRefund ToolRefund HandlerPossible recipient change
Separate questions
Authorization and effect
Policy may already establish limits. Credential scope, discretionary choices and actual execution require separate evidence.
Next useful action
Investigate or assure
Review the path immediately. Add other evidence only to answer the specific operational decision.
A unified platform · independent capabilities
One platform. Six capabilities. Built around consequential AI assurance.
Explore each capability independently – none is a mandatory stage or an automatically installed control. Delegated Action Integrity sits beneath them all, comparing the authority behind consequential choices.
One platform. Six independent capabilities.
Evidence, authority and consequential actions, without guessing what is unknown.
AI System Workspace
Systems · Connections · Capability Map · Evaluations · Decisions
Choose the question that matters
01 · Discover
What consequential actions can this agent reach?
What HAIEC reveals
A source-linked agent → tool → handler path that could call a money-movement or data-changing API.
What you get
An inspectable potential consequence and a practical next investigation step, without requiring all evidence sources first.
Delegated Action Integrity · DAI
A credential may permit the action. Who gets to choose the consequence?
Policy, effective grants and delegated business choice are distinct. DAI compares them with code capability and relevant observations, without hiding the original finding.
RULE-GROUNDED: Approved policy and trusted transaction facts determine the original payment recipient, if the actual chosen value conforms. No independent discretionary recipient selection is necessary.
Explore Delegated Action Integrity → · Understand DAI methodology →
Shared deterministic evidence core
Source qualification · Five planes · Provenance · Explicit evidence frontier
The AI System Workspace connects systems, connections, the capability map, evaluations and decisions to six independently selectable capabilities: Discover, Evaluate, Authorize, Monitor, Protect and Verify. No capability is universally on; each applies only when its evidence prerequisites are met.
One Assurance system · Multiple entry points
Run HAIEC where your work already happens.
Use HAIEC from an AI coding agent, a connected GitHub repository, the Assurance API, or the HAIEC workspace. Supported paths converge into the canonical Assurance pipeline. Evidence coverage may differ by source mode, and unavailable evidence remains visible.
IDE / MCP
Let Cursor, Claude Code, Devin, Codex, or another MCP-capable agent run and explain HAIEC while the deterministic HAIEC pipeline remains the source of Assurance truth.
Use HAIEC from an AI agentGitHub App
Authorize selected repositories without giving HAIEC a personal access token. Verified Source Assets can feed remote source analysis.
Connect GitHubAssurance API
Start Evaluations, poll exact run state, retrieve deterministic summaries, Agent Audit, reports, Passports, and supported evidence outputs programmatically.
Explore the APIRuntime & Evidence
Add logs, telemetry, structured evidence, and authorized runtime tests when the Assurance question requires evidence beyond source code.
Connect evidenceTelemetry and runtime testing are optional. A static Assurance Evaluation does not require them.
Ask your AI agent. HAIEC runs the evaluation.
Four chapters: connect HAIEC MCP with a scoped key, surface a first source-level finding, run a deterministic assurance evaluation, and inspect the canonical report. Start with Run HAIEC AI Assurance.
- ▸Deterministic, not AI-grading-AI. The same evidence produces the same Evaluation – the agent asks, HAIEC decides.
- ▸UNKNOWN stays visible. Missing evidence is reported as missing – never smoothed into a pass.
- ▸Declared ≠ observed. What your agent says it can do and what it actually does are preserved as separate facts.
- ▸One Evaluation, one truth. The same result renders in your IDE, the API, the dashboard, and the PDF.
IDE Agent · MCP
❯ Run HAIEC AI Assurance
▸ haiec_preflight → check access and readiness
▸ haiec_run_assurance → authorized evaluation
▸ haiec_get_master_report → exact evaluation
SOURCE CAPABILITY supported in scanned code
POLICY CONTEXT when verified policy available
EFFECTIVE GRANTS where provider connected
DELEGATED CHOICE when material discretion exists
Same frozen evidence + rules → consistent result.✓
Connect → Discover → Assure → Report.
HAIEC evaluates persisted evidence — the IDE agent only asks the question.
Real-World Patterns
This is not hypothetical.
Publicly disclosed incidents keep repeating the same shape: individually legitimate capabilities connecting into an unintended consequential path.
Public input → private data → public output
A malicious public issue influenced an AI agent that could read private repositories and create public pull requests. Individually valid capabilities formed a data-leak path.
Trusted tools can create an untrusted sequence.
Illustrative pattern. HAIEC evaluates whether a comparable path exists in your system.
Publicly disclosed pattern · Invariant Labs, May 2025Email → internal context → external leak
A crafted email could influence an enterprise AI assistant and cause internal data to leave through an external channel, without the user intentionally sharing it.
The input itself can become an instruction source.
Illustrative pattern. HAIEC evaluates whether a comparable path exists in your system.
Publicly disclosed pattern · Microsoft Security Insider, 2025Agent → production data → destructive action
An AI coding agent deleted app database data during development; the platform later strengthened development/production isolation.
Natural-language intent is not the same as enforced authority.
Illustrative pattern. HAIEC evaluates whether a comparable path exists in your system.
Publicly disclosed pattern · Replit, July 2025These are publicly disclosed patterns, not HAIEC findings. HAIEC does not claim to have detected or prevented any named incident. The assurance question is whether a comparable influence, reach, authority, and consequence path exists in your system, and what the evidence establishes about it.
Research brief · Reported incident analysis
The Hugging Face breach reveals an AI assurance gap.
AI agents working inside a security evaluation crossed into real production systems – through shared infrastructure, untrusted dataset inputs and authority broader than the task. The lesson: know what your AI can reach, what it is allowed to do, and whether safeguards work when tested.
Read the incident brief
Six boundary crossings, reconstructed. What it means for your consequential AI actions.
System Constellation
See the paths a checklist cannot show.
HAIEC expands the agent into the system around it: what can influence it, what it can reach, what controls the path, whether another route leads to the same effect, and what the evidence actually proves.
Influence
User input, knowledge, memory, tool output, peer agents, runtime configuration
Reach
Tools, APIs, data, identities, cloud, workers, external services
Control
Authentication, authorization, tenant scope, approval, validation
Paths
Canonical path, async workers, direct tool calls, webhooks, retries, legacy fallbacks
Consequence
Data change, money movement, access change, production change, external communication
Evidence
Established, partial, unknown, or not assessed – with inspectable proof and an explicit frontier
Sample environment · illustrative data
Static SampleNorthstar Commerce Operations Copilot
AI-assisted refund processing
Request
User / application input
Policy
System instruction
AI Agent
Model call
Action
stripe.refunds.create
Policy
Authentication
Action
Canonical path
Consequence
Stripe refund
Potential consequence
Permission ≠ Delegation
Permission can be valid while delegation of the consequential choice remains unproven.
Evidence & Authority
What does the evidence actually prove?
No vulnerability does not mean no consequential capability. A perfectly valid tool, called through a valid API, using a valid service identity, can still produce an action the organization never intended the AI to choose.
Permission is not delegation. Security controls answer whether an identity is permitted to do something. They do not necessarily establish whether the AI was delegated the consequential choice it made.
Permission
An identity policy that allows an action. Establishes what is permitted, not what was authorized by a human decision.
Delegation
Whether a human or process with authority actually delegated the consequential choice to the AI. Distinct from permission. Not always established by available evidence.
HAIEC does not claim delegation violations are currently proven unless evidence establishes them. The distinction between permission and delegation is a structural insight, not an automatic finding.
1. Requested
What the request asked the AI to do
2. Policy Authorized
What policy and configuration permit
3. Effectively Granted
What credential evidence establishes
4. Code Capable
What the application can technically do
5. Observed
What runtime evidence establishes was observed
These are evidence questions, not a causal proof chain. A gap between any two is a finding, not a safe state. Not every question currently has a native evidence producer.
Authority – what this agent can do, by evidence planeIllustrative trace
Asked for
reroute_traffic on netops.example.comquery_records on customer-db.example.comexport_report to s3://ops-reportsAllowed by policy
narrower than the plane abovereroute_traffic on netops.example.comquery_records on customer-db.example.comGranted by credentials
narrower than the plane abovereroute_traffic on netops.example.comPossible in code
no declarations in evaluated sourceSeen in evidence
includes a host nothing authorizedreroute_traffic on netops.example.comreroute_traffic on attacker-node.example.comdivergencequery_records on customer-db.example.comThe planes are independent evidence planes – what was asked, what policy allows, what credentials grant, what code can do, and what was observed. They are not a guaranteed sequence.
Text summary of the DAI diagram
An evidence-bound AI system is analyzed across five independent evidence planes: Requested (what the agent was asked to do), Policy Authorized (the boundaries policy and human approval establish, when established), Effectively Granted (what connected identity and access evidence shows), Code Capable (what the application can technically reach), and Observed (what runtime evidence recorded). Each plane may be unknown; DAI compares the established planes side by side instead of reconciling them silently. Illustrative comparison, not a live customer evaluation.
Permission is not delegation. Delegation is not authority. Authority is not observed behavior. HAIEC evaluates each plane and shows where they diverge.
Capability chain
What a task requires vs. what the agent can actually do. Unmet requirements, unobserved grants, and capabilities exceeding the request render as distinct gap types.
Delegation chain
Whether authority actually narrowed at each hop – scope monotonicity and chain continuity. A break is surfaced, never averaged away.
DAI comparison
Four independently-evidenced facts per surface – delegated, code-capable, granted, observed – compared side by side. Divergence is shown, not reconciled silently.
Alternate paths
Expected path
Request → approval → action. The mediated route reviewers expect the AI to take.
Alternate path
A background worker, fallback handler, or direct tool path that reaches the same effect through a different route.
Finding one approval does not prove every route to the action is protected.
When the system changes
Reconstruct what changed – without guessing why.
HAIEC can compare explicitly declared states of the same scenario, correlate evidence across supported sources, identify the earliest established divergence, and show which consequences, authority paths, and evidence boundaries changed.
AL0 Baseline
AL1 Degraded
AL2 Compromised
State order is explicit. HAIEC does not infer scenario order, attacker intent, or root cause from timestamps alone. AL0, AL1, and AL2 are declared scenario states – not HAIEC Assurance levels or dispositions.
Open the telecom forensic exampleFrom findings to accountable action
Find the risk. Decide what needs a human.
This scripted 26-second example shows how a meaningful first finding can lead to contextual policy comparison, an accountable decision and connected follow-through. It is not an actual agent intervention.
- ▸Know what your AI can do. Technical reach established from evidence, not vendor declarations.
- ▸Approve the right operating scope. Consequential changes can be routed to an accountable human reviewer.
- ▸Keep permitted work moving. Advisory and in-scope activity continues while reviews are pending.
- ▸Follow actions with supporting evidence. Every decision stays linked to a verifiable report.
From proposed action to documented decision
Demo playbackA consequential action is proposed
Action & scope
A consequential action is proposed — A fictional operations agent proposes a high-impact change. Routine activity stays within approved scope.
Reviewer
Waiting…
Monitoring & evidence
Waiting…
Scripted example, paused by default – press play to step through it. A recorded decision is not proof that an external gateway blocked anything. See the fictional nine-system enterprise version in the deployment governance demonstration.
How HAIEC Works
From repository to decision.
A bounded lifecycle for evidence-bound assurance of consequential AI systems.
Define
Select the AI system and assurance question
Connect
Connect evidence sources: repo, APIs, and infrastructure
Collect Evidence
Source, identity, access, policy, capability
Assure
Deterministic evaluation within explicit scope
Verify
Decision Receipt with SHA-256 integrity
Monitor
Ongoing evidence from supported runtime sources
Monitor is bounded to supported evidence and runtime sources. Not every connected asset has a native evidence producer. Evaluated Scope is currently structured at the contract level; structured scope binding is under development.
Capability state as of build v1.0.0 – auditable in the repository.
Buyer Paths
Built for different buyers.
Trust Signals
Standards-informed. Evidence-decided.
Grand Challenge Winner
MunichTech EXPO 2026
Evaluated against KestrelVoice, a real multi-tenant AI SaaS: 44/44 action paths met criteria, 1,322 evidence traces, 555 verified checkpoints – jury score 8.7/10.
Deterministic evaluation
No LLM in the canonical detection or assurance path – same input, byte-identical digests.
Open evidence formats
STIX 2.1 indicators for SOC interchange; OTLP intake for runtime telemetry.
Integrity by construction
SHA-256 digests on receipts and case artifacts – recomputable, never edited.
Public samples
Evaluated sample systems are public – read the report, the constellation, and the forensic case yourself.
A Different Question
Different questions. HAIEC connects the answers.
| Buyer question | Scanner | Governance | IAM | HAIEC |
|---|---|---|---|---|
| Does the path exist? | Pattern | Policy | Access | Path + consequence + evidence |
| What influences the choice? | – | Partially | – | Yes – influence chain |
| What's the consequence? | – | Policy text | – | Yes – consequence graph |
| What does the evidence prove? | Findings count | Compliance % | Access logs | Established / partial / unknown + frontier |
| Where does proof stop? | – | – | – | Yes – evidence frontier |
These tools answer different questions – this is not a claim that any of them are wrong. HAIEC connects their answers to the consequential path.
Evidence & Framework Support
Mapped to standards. Not defined by them.
HAIEC maps evidence to recognized frameworks and regulations. This is evidence mapping, technical evaluation, readiness, and assurance support. Framework mapping is not the same as assurance. A green or source-established fact is not the same as safe.
AR-01
Instruction-Like Pattern in Model Context
ATLAS AML.T0051ATLAS AML.T0051.001ASI ASI01NIST MEASURENIST MANAGE
AR-22
Prompt / Context Attack Signal
ATLAS AML.T0051ATLAS AML.T0051.000ATLAS AML.T0054ASI ASI01NIST MEASURENIST MANAGE
AR-69
Handover Outside Declared Scope
NIST MANAGE-2.43GPP TS 38.3003GPP TS 23.502
Framework mapping ≠ certification. Standards inform. HAIEC evaluates.
Browse all framework mappingsHAIEC supplies evidence and analysis. The qualified firm, CPA, certification body, or assessor retains professional judgment and issues the applicable attestation, certification, or assessment outcome. Framework mapping does not equal assurance.
Evidence-Bound Assurance for Consequential AI
What can this AI actually cause?
One bounded system. One primary assurance question. Explicit evidence boundary. Decision-grade technical and executive output.