Evidence starts with live configuration
A posture report is meaningful only when it reads the rules, settings, identity coverage, and telemetry that are actually active. A rule that exists but is disabled is a gap, not a pass.
Compliance
What AI runtime evidence can actually prove
Compliance software is useful when it states its boundary clearly. AI-FW assesses the technical controls on the AI path, but it does not replace classification, contracts, training, or legal judgment.
By Sarah Reid · ·
The module separates enforcement from assessment
The rules engine decides what traffic is allowed, blocked, or masked. The Compliance module reads that state and reports whether selected framework controls can be supported. A compliance gap is not itself a traffic decision.
What belongs in an evidence pack
AI-FW can report control status, rule state, relevant settings, retention information, inventory evidence, and named attestations. Evidence packs are designed to avoid prompt and response content unless your separate logging policy allows content capture.
Plan the work outside the gateway
System classification, risk assessments, contracts, training, quality management, and conformity work remain organizational responsibilities. Use the framework pages to separate the runtime work from the work your legal, security, and compliance teams must own.