EVE for Compliance Teams

For compliance functions that need durable, independently checkable records of how AI agents were governed — and want to reduce reliance on the model's own account of what it did.

The problem

When an AI agent can call tools, move data, or trigger actions, compliance needs to answer: which actions were permitted, which were blocked, under what policy, and where is the proof? Screenshots and model transcripts are not tamper-evident records.

How EVE helps

  • Policy enforcement before execution. EVE CoreGuard returns a deterministic ALLOW / BLOCK / MODIFY decision before a governed action runs, so a prohibited action is stopped rather than logged after the fact. This helps enforce policy at the decision boundary.
  • Records useful for review. Each governed decision can produce a signed evidence record bound to the decision (Ed25519 in the production configuration, HMAC-SHA256 fallback), supporting evidence collection for a control file.
  • Verify without trusting the vendor. Signed evidence verifies independently and offline in Python, Node, or the browser — a reviewer confirms integrity, signature, and schema without contacting the EVE server.
  • Sequence and budget controls. EVE can block individually-permitted actions that combine into a prohibited sequence, and enforce deterministic budget/resource limits.
  • Control mapping. EVE can map controls to frameworks descriptively and produce records useful for review. Standards mappings are descriptive, not certification.

Framing that stays accurate

EVE supports evidence collection, helps enforce policy, and produces records useful for review. It does not certify a system or determine a compliance outcome; those judgments remain with your compliance function and its assessors.

Readiness

  • EVE SDK core is a RELEASE CANDIDATE WITH EXCLUSIONS.
  • The core governance architecture is pilot-validated; signed evidence and offline verification are SUPPORTED.
  • Sequence and budget controls, and the red-team harness, are customer-pilot ready at supported boundaries.
  • Framework adapters other than the generic adapter are experimental.

Limitations

  • EVE supports evidence collection and helps enforce policy; it does not guarantee a compliance outcome and does not issue certification.
  • The pip client governs via hosted mode (requires a reachable endpoint); embedded in-process evaluation is the EVE service.
  • Independent verification requires the Ed25519 public key; the HMAC fallback is symmetric and not independently verifiable.
  • Sequence state is per-session and in-process in the pilot; durable multi-instance state is a deployment concern.
  • Verification attests that evidence is authentic and unaltered — not that the underlying decision was correct.
  • Standards mappings are descriptive and are not a certification.
Part of the EVE AI Core control plane Deterministic AI Governance Control Plane → Policy decisions that return the same result for the same input every time, before execution.