Know what your AI can do. See what the evidence supports.
HAIEC maps the path from requested action to real-world consequence across authority, code capability, runtime evidence, and observed effects — without turning unknown evidence into a guess.
AI guides the workflow. HAIEC determines the evidence state.
MunichTech EXPO Grand Challenge Winner — AI Action Path Assurance, Devpost Autumn 2026 · verified at munichtechexpo.com
❯ assure the claims-agent in this repo ▸ haiec_preflight → ready▸ haiec_bind_github_source → org/claims-agent @ a3f9c1e▸ haiec_run_assurance → run r_84f2 · 5 authority planes▸ haiec_get_agent_trace → 8 lanes · 2 evidence gaps open DISPOSITION REVIEW 2 consequential paths lack runtime evidence UNKNOWN ≠ PASS — gaps stay visible, not hidden same evidence → same verdict. every run.Run HAIEC where your work already happens.
Use HAIEC from an AI coding agent, a connected GitHub repository, the Assurance API, or the HAIEC workspace. Supported paths converge into the canonical Assurance pipeline. Evidence coverage may differ by source mode, and unavailable evidence remains visible.
IDE / MCP
Let Cursor, Claude Code, Devin, Codex, or another MCP-capable agent run and explain HAIEC while the deterministic HAIEC pipeline remains the source of Assurance truth.
Use HAIEC from an AI agentGitHub App
Authorize selected repositories without giving HAIEC a personal access token. Verified Source Assets can feed remote source analysis.
Connect GitHubAssurance API
Start Evaluations, poll exact run state, retrieve deterministic summaries, Agent Audit, reports, Passports, and supported evidence outputs programmatically.
Explore the APIRuntime & Evidence
Add logs, telemetry, structured evidence, and authorized runtime tests when the Assurance question requires evidence beyond source code.
Connect evidenceTelemetry and runtime testing are optional. A static Assurance Evaluation does not require them.
Ask in your IDE. HAIEC decides on evidence.
- ▸Deterministic, not AI-grading-AI. The same evidence produces the same Evaluation — the agent asks, HAIEC decides.
- ▸UNKNOWN stays visible. Missing evidence is reported as missing — never smoothed into a pass.
- ▸Declared ≠ observed. What your agent says it can do and what it actually does are preserved as separate facts.
- ▸One Evaluation, one truth. The same result renders in your IDE, the API, the dashboard, and the PDF.
❯ assure the claims-agent in this repo
▸ haiec_preflight → ready
▸ haiec_bind_github_source → org/claims-agent @ a3f9c1e
▸ haiec_run_assurance → run r_84f2 · 5 authority planes
▸ haiec_get_agent_trace → 8 lanes · 2 evidence gaps open
DISPOSITION REVIEW
UNKNOWN ≠ PASS — gaps stay visible, not hidden
same evidence → same verdict. every run.This is not hypothetical.
Publicly disclosed incidents keep repeating the same shape: individually legitimate capabilities connecting into an unintended consequential path.
Public input → private data → public output
A malicious public issue influenced an AI agent that could read private repositories and create public pull requests. Individually valid capabilities formed a data-leak path.
Trusted tools can create an untrusted sequence.
Illustrative pattern. HAIEC evaluates whether a comparable path exists in your system.
Publicly disclosed pattern · Invariant Labs, May 2025Email → internal context → external leak
A crafted email could influence an enterprise AI assistant and cause internal data to leave through an external channel, without the user intentionally sharing it.
The input itself can become an instruction source.
Illustrative pattern. HAIEC evaluates whether a comparable path exists in your system.
Publicly disclosed pattern · Microsoft Security Insider, 2025Agent → production data → destructive action
An AI coding agent deleted app database data during development; the platform later strengthened development/production isolation.
Natural-language intent is not the same as enforced authority.
Illustrative pattern. HAIEC evaluates whether a comparable path exists in your system.
Publicly disclosed pattern · Replit, July 2025These are publicly disclosed patterns, not HAIEC findings. HAIEC does not claim to have detected or prevented any named incident. The assurance question is whether a comparable influence, reach, authority, and consequence path exists in your system, and what the evidence establishes about it.
See the paths a checklist cannot show.
HAIEC expands the agent into the system around it: what can influence it, what it can reach, what controls the path, whether another route leads to the same effect, and what the evidence actually proves.
Influence
User input, knowledge, memory, tool output, peer agents, runtime configuration
Reach
Tools, APIs, data, identities, cloud, workers, external services
Control
Authentication, authorization, tenant scope, approval, validation
Paths
Canonical path, async workers, direct tool calls, webhooks, retries, legacy fallbacks
Consequence
Data change, money movement, access change, production change, external communication
Evidence
Established, partial, unknown, or not assessed — with inspectable proof and an explicit frontier
What does the evidence actually prove?
No vulnerability does not mean no consequential capability. A perfectly valid tool, called through a valid API, using a valid service identity, can still produce an action the organization never intended the AI to choose.
Permission is not delegation. Security controls answer whether an identity is permitted to do something. They do not necessarily establish whether the AI was delegated the consequential choice it made.
Permission
An identity policy that allows an action. Establishes what is permitted, not what was authorized by a human decision.
Delegation
Whether a human or process with authority actually delegated the consequential choice to the AI. Distinct from permission. Not always established by available evidence.
HAIEC does not claim delegation violations are currently proven unless evidence establishes them. The distinction between permission and delegation is a structural insight, not an automatic finding.
1. Requested
What the request asked the AI to do
2. Policy Authorized
What policy and configuration permit
3. Effectively Granted
What credential evidence establishes
4. Code Capable
What the application can technically do
5. Observed
What runtime evidence establishes was observed
These are evidence questions, not a causal proof chain. A gap between any two is a finding, not a safe state. Not every question currently has a native evidence producer.
Asked for
reroute_traffic on netops.example.comquery_records on customer-db.example.comexport_report to s3://ops-reportsAllowed by policy
narrower than the plane abovereroute_traffic on netops.example.comquery_records on customer-db.example.comGranted by credentials
narrower than the plane abovereroute_traffic on netops.example.comPossible in code
no declarations in evaluated sourceSeen in evidence
includes a host nothing authorizedreroute_traffic on netops.example.comreroute_traffic on attacker-node.example.comdivergencequery_records on customer-db.example.comThe planes are independent evidence planes – what was asked, what policy allows, what credentials grant, what code can do, and what was observed. They are not a guaranteed sequence.
Permission is not delegation. Delegation is not authority. Authority is not observed behavior. HAIEC evaluates each plane and shows where they diverge.
Capability chain
What a task requires vs. what the agent can actually do. Unmet requirements, unobserved grants, and capabilities exceeding the request render as distinct gap types.
Delegation chain
Whether authority actually narrowed at each hop — scope monotonicity and chain continuity. A break is surfaced, never averaged away.
DAI comparison
Four independently-evidenced facts per surface — delegated, code-capable, granted, observed — compared side by side. Divergence is shown, not reconciled silently.
Alternate paths
Expected path
Request → approval → action. The mediated route reviewers expect the AI to take.
Alternate path
A background worker, fallback handler, or direct tool path that reaches the same effect through a different route.
Finding one approval does not prove every route to the action is protected.
Reconstruct what changed — without guessing why.
HAIEC can compare explicitly declared states of the same scenario, correlate evidence across supported sources, identify the earliest established divergence, and show which consequences, authority paths, and evidence boundaries changed.
State order is explicit. HAIEC does not infer scenario order, attacker intent, or root cause from timestamps alone. AL0, AL1, and AL2 are declared scenario states — not HAIEC Assurance levels or dispositions.
Open the telecom forensic exampleFrom repository to decision.
A bounded lifecycle for evidence-bound assurance of consequential AI systems.
Define
Select the AI system and assurance question
Connect
Connect evidence sources: repo, APIs, and infrastructure
Collect Evidence
Source, identity, access, policy, capability
Assure
Deterministic evaluation within explicit scope
Verify
Decision Receipt with SHA-256 integrity
Monitor
Ongoing evidence from supported runtime sources
Monitor is bounded to supported evidence and runtime sources. Not every connected asset has a native evidence producer. Evaluated Scope is currently structured at the contract level; structured scope binding is under development.
Capability state as of build v1.0.0 — auditable in the repository.
Built for different buyers.
Standards-informed. Evidence-decided.
Grand Challenge Winner
MunichTech EXPO 2026
Evaluated against KestrelVoice, a real multi-tenant AI SaaS: 44/44 action paths met criteria, 1,322 evidence traces, 555 verified checkpoints — jury score 8.7/10.
Deterministic evaluation
No LLM in the canonical detection or assurance path — same input, byte-identical digests.
Open evidence formats
STIX 2.1 indicators for SOC interchange; OTLP intake for runtime telemetry.
Integrity by construction
SHA-256 digests on receipts and case artifacts — recomputable, never edited.
Public samples
Evaluated sample systems are public — read the report, the constellation, and the forensic case yourself.
Different questions. HAIEC connects the answers.
| Buyer question | Scanner | Governance | IAM | HAIEC |
|---|---|---|---|---|
| Does the path exist? | Pattern | Policy | Access | Path + consequence + evidence |
| What influences the choice? | — | Partially | — | Yes — influence chain |
| What's the consequence? | — | Policy text | — | Yes — consequence graph |
| What does the evidence prove? | Findings count | Compliance % | Access logs | Established / partial / unknown + frontier |
| Where does proof stop? | — | — | — | Yes — evidence frontier |
These tools answer different questions — this is not a claim that any of them are wrong. HAIEC connects their answers to the consequential path.
Mapped to standards. Not defined by them.
HAIEC maps evidence to recognized frameworks and regulations. This is evidence mapping, technical evaluation, readiness, and assurance support. Framework mapping is not the same as assurance. A green or source-established fact is not the same as safe.
AR-01
Instruction-Like Pattern in Model Context
AR-22
Prompt / Context Attack Signal
AR-69
Handover Outside Declared Scope
Framework mapping ≠ certification. Standards inform. HAIEC evaluates.
Browse all framework mappingsHAIEC supplies evidence and analysis. The qualified firm, CPA, certification body, or assessor retains professional judgment and issues the applicable attestation, certification, or assessment outcome. Framework mapping does not equal assurance.
What can this AI actually cause?
One bounded system. One primary assurance question. Explicit evidence boundary. Decision-grade technical and executive output.