Compliance map
CHAIN INTACT
Evidence, not compliance
Each row states what a control asks for and what this profile actually produces. Nothing here certifies anything — whether the evidence satisfies the obligation is an auditor's judgement, and a tool that answered it for them would be selling the one thing it cannot supply.
CONTROL
ASKS FOR · WHAT THIS PROFILE PRODUCES
STATE
EU AI Act art. 12
Automatic recording of events over the lifetime of the system, to a degree that enables tracing.
11 decisions recorded, each with the clause that produced it and a hash linking it to the one before.
11 decisions recorded, each with the clause that produced it and a hash linking it to the one before.
EVIDENCE
NIST AI 600-1 · GV-1.2
Characteristics of trustworthy AI are integrated into organisational policies.
6 rules are declared as data and applied to every tool call, rather than living in a runbook.
6 rules are declared as data and applied to every tool call, rather than living in a runbook.
EVIDENCE
NIST AI 600-1 · MS-2.6
AI system is evaluated regularly for safety risks, with results documented.
Decisions are documented per call. Periodic evaluation of the policy itself is an operator process this tool does not perform.
Decisions are documented per call. Periodic evaluation of the policy itself is an operator process this tool does not perform.
PARTIAL
SOC 2 · CC7.2
The entity monitors system components for anomalies indicative of malicious acts.
Refusals and held calls are recorded with their clause. This record contains refusals.
Refusals and held calls are recorded with their clause. This record contains refusals.
EVIDENCE
SOC 2 · CC6.1
Logical access to protected information assets is restricted to authorised users.
Capabilities are restricted per agent. Authorisation of the human is not: approvals record what was decided, never who decided it.
Capabilities are restricted per agent. Authorisation of the human is not: approvals record what was decided, never who decided it.
PARTIAL
The gap that recurs
Three of these rows stop at partial for the same reason: the harness records what was decided and never who decided it. Attributable approval needs an identity anchor outside this machine, which is a control-plane concern this build does not claim.