Controls

A control is a built-in, scope-agnostic standing rule. Agents are auto-subjected by scope rather than wired in one at a time — every agent that falls within a control's scope is held to it, and each finding is that control's per-agent evidence.

Control	Name	Category	Enforcing defense	Source
ACC-001	MFA required for all human users accessing AI platforms MFA required for all human users accessing AI platforms	ACC	None	Built-in
ACC-002	MFA enforced on service accounts where technically supported MFA enforced on service accounts where technically supported	ACC	None	Built-in
ACC-003	Privileged access granted only via PIM / just-in-time activation Privileged access granted only via PIM / just-in-time activation	ACC	None	Built-in
ACC-004	Conditional Access enforces device compliance for sensitive scopes Conditional Access enforces device compliance for sensitive scopes	ACC	None	Built-in
ACC-005	Quarterly access reviews completed for all privileged roles Quarterly access reviews completed for all privileged roles	ACC	None	Built-in
ACC-006	Role-based access control applied to all AI platform resources Role-based access control applied to all AI platform resources	ACC	None	Built-in
ACC-007	Separation of duties between model development and production deployment Separation of duties between model development and production deployment	ACC	None	Built-in
ACC-008	Service principals scoped to least-privilege resource groups Service principals scoped to least-privilege resource groups	ACC	None	Built-in
ACC-009	Workload identities used in place of long-lived secrets Workload identities used in place of long-lived secrets	ACC	None	Built-in
ACC-010	All secrets stored exclusively in Key Vault or HSM All secrets stored exclusively in Key Vault or HSM	ACC	None	Built-in
ACC-011	Secrets rotated at minimum every 90 days Secrets rotated at minimum every 90 days	ACC	None	Built-in
ACC-012	Break-glass accounts protected by two-person approval and monitored Break-glass accounts protected by two-person approval and monitored	ACC	None	Built-in
ACC-013	External collaborators onboarded via B2B federation only External collaborators onboarded via B2B federation only	ACC	None	Built-in
ACC-014	Joiner-mover-leaver process executes within one business day Joiner-mover-leaver process executes within one business day	ACC	None	Built-in
ACC-015	Authentication logs forwarded to SIEM with 12-month retention Authentication logs forwarded to SIEM with 12-month retention	ACC	None	Built-in
ACC-016	No standing access to production AI inference endpoints No standing access to production AI inference endpoints	ACC	None	Built-in
ACC-017	Authentication risk scoring informs adaptive Conditional Access Authentication risk scoring informs adaptive Conditional Access	ACC	None	Built-in
ACC-018	Sign-in risk policies block high-risk authentication events Sign-in risk policies block high-risk authentication events	ACC	None	Built-in
ACC-019	User risk policies require credential reset on compromise indicator User risk policies require credential reset on compromise indicator	ACC	None	Built-in
ACC-020	Token lifetime policies enforced per workload sensitivity tier Token lifetime policies enforced per workload sensitivity tier	ACC	None	Built-in
ACC-021	Refresh tokens revoked automatically on JML termination Refresh tokens revoked automatically on JML termination	ACC	None	Built-in
ACC-022	SSH key inventory current and keys rotated annually SSH key inventory current and keys rotated annually	ACC	None	Built-in
ACC-023	SSH keys for tier-1 access stored on hardware tokens SSH keys for tier-1 access stored on hardware tokens	ACC	None	Built-in
ACC-024	Just-Enough-Access principle applied at resource group scope Just-Enough-Access principle applied at resource group scope	ACC	None	Built-in
ACC-025	Group lifecycle managed via Entra access packages Group lifecycle managed via Entra access packages	ACC	None	Built-in
ACC-026	Attribute-based access control used where RBAC is insufficient Attribute-based access control used where RBAC is insufficient	ACC	None	Built-in
ACC-027	Network access to AI control plane restricted to allowlist Network access to AI control plane restricted to allowlist	ACC	None	Built-in
ACC-028	Private endpoints used for all data-plane access to AI services Private endpoints used for all data-plane access to AI services	ACC	None	Built-in
ACC-029	Public IP usage on AI workloads requires approved exception Public IP usage on AI workloads requires approved exception	ACC	None	Built-in
ACC-030	Privileged Access Workstation required for tier-0 administration Privileged Access Workstation required for tier-0 administration	ACC	None	Built-in
adversarial_red_team	Adversarial / Red-Team Testing Adversarial robustness, prompt-injection resistance, and red-team exercises. GPAI evaluation under EU AI Act Article 15.	security	None	Built-in
adverse_action_reason_codes	Adverse-Action / Reason Codes Specific principal-reason codes for adverse decisions (ECOA Reg B, FCRA). SHAP / counterfactual reason codes mapped to actual feature contributions.	fairness	None	Built-in
agent_permission_scope	Agent Permission Scope Requires that every agent action stay inside its granted permission scope, so an autonomous agent cannot invoke capabilities, identities, or data beyond what it was provisioned for. This directly addresses OWASP LLM08 Excessive Agency and MITRE ATLAS AML.T0048, and supports NIST AI RMF MANAGE 4.2, ISO 42001 A.6.2.5, and SOC 2 CC6.1 least-privilege expectations. EvidentAI evidences it by tagging spans carrying agent.scope_violation, which mark calls that exceeded the agent's authorized scope, and maps those tagged spans to the listed frameworks as exception evidence for the access-control narrative.	—	Agent Scope Enforcementmonitor	Built-in
ai_model_inventory	AI / Model Inventory Comprehensive registry of every AI/ML system in production including third-party models. Risk-tiered by materiality, complexity, and criticality.	governance	None	Built-in
ai_spend_token_budget	AI Spend — Per-Trace Token Budget A cost-governance control requiring that no trace exceed its configured token ceiling: what good looks like is every trace completing within budget while runaway or looping agents are stopped before they burn unbounded spend. This matters for AI financial governance and runaway-loop containment, where an unconstrained agent recursion or tool-calling loop can multiply gen_ai token usage and cost without producing value, a denial-of-wallet and reliability risk. EvidentAI measures it by having the cost-router sum gen_ai token usage across the trace and set `evidentai.token_budget.breached == true` when the ceiling is crossed; the selector match raises a budget_breach finding and, when the defense is set to enforce_interrupt mode rather than monitor, can interrupt the run, giving operators an auditable per-trace spend record and an automatic stop on runaway behavior.	—	AI Spend / Token-Budgetmonitor	Built-in
aml_transaction_monitoring_alerts	AML Transaction-Monitoring Alerts Requires that AI agents performing transaction monitoring under the Bank Secrecy Act (31 CFR 1020.320) generate, escalate, and disposition alerts on potentially suspicious activity so that reportable conduct is surfaced for SAR evaluation rather than missed. This matters because gaps in alert coverage or unexplained alert suppression expose the institution to FinCEN enforcement and civil money penalties, and AI-driven scoring must remain explainable and auditable. EvidentAI tags every span where aml.alert == true, capturing the alert payload, model rationale, and disposition, and maps the evidence to BSA/AML program-effectiveness controls and NIST AI RMF MEASURE for ongoing monitoring of decision quality.	—	None	Built-in
automated_decision_disclosure	Automated-Decision Disclosure Requires that any solely-automated decision producing a legal or similarly significant effect on a person carries an explicit disclosure to the affected individual, satisfying GDPR Art. 22 / Art. 13(2)(f) transparency duties and emerging US state ADMT rules (e.g., CCPA/CPRA automated decision-making regulations). The disclosure obligation matters because undisclosed automated decisioning exposes the operator to enforcement and invalidates downstream consent. EvidentAI evaluates the selector evidentai.admt.disclosed == true against each ingested span and, on a match, tags the span onto the evidence row's framework_mappings, producing regulator-readable proof that the disclosure event fired on the decisioning trace.	—	None	Built-in
BCM-001	AI workload Business Impact Analysis completed AI workload Business Impact Analysis completed	BCM	None	Built-in
BCM-002	Recovery Time Objective (RTO) defined per use case Recovery Time Objective (RTO) defined per use case	BCM	None	Built-in
BCM-003	Recovery Point Objective (RPO) defined per use case Recovery Point Objective (RPO) defined per use case	BCM	None	Built-in
BCM-004	Disaster recovery plan tested annually for AI workloads Disaster recovery plan tested annually for AI workloads	BCM	None	Built-in
BCM-005	Multi-region deployment for tier-1 inference endpoints Multi-region deployment for tier-1 inference endpoints	BCM	None	Built-in
BCM-006	Failover automation tested quarterly Failover automation tested quarterly	BCM	None	Built-in
BCM-007	Graceful degradation mode defined per use case (deterministic fallback) Graceful degradation mode defined per use case (deterministic fallback)	BCM	None	Built-in
BCM-008	Foundation model multi-vendor fallback configured Foundation model multi-vendor fallback configured	BCM	None	Built-in
BCM-009	Capacity planning model updated quarterly Capacity planning model updated quarterly	BCM	None	Built-in
BCM-010	Inference scaling tested under load Inference scaling tested under load	BCM	None	Built-in
BCM-011	Dependency map maintained for AI workloads Dependency map maintained for AI workloads	BCM	None	Built-in
BCM-012	Single points of failure identified and remediated Single points of failure identified and remediated	BCM	None	Built-in
BCM-013	Crisis communication plan includes AI-specific scenarios Crisis communication plan includes AI-specific scenarios	BCM	None	Built-in
BCM-014	Reputational risk scenarios included in tabletop exercises Reputational risk scenarios included in tabletop exercises	BCM	None	Built-in
BCM-015	Insurance coverage reviewed for AI-specific risks Insurance coverage reviewed for AI-specific risks	BCM	None	Built-in
BCM-016	Critical vendor concentration risk monitored Critical vendor concentration risk monitored	BCM	None	Built-in
BCM-017	Resilience SLA reported quarterly to leadership Resilience SLA reported quarterly to leadership	BCM	None	Built-in
BCM-018	Cloud region outage runbook current and rehearsed Cloud region outage runbook current and rehearsed	BCM	None	Built-in
BCM-019	Provider quota / rate-limit headroom tracked Provider quota / rate-limit headroom tracked	BCM	None	Built-in
BCM-020	Inference quota burst protection via queue and degrade modes Inference quota burst protection via queue and degrade modes	BCM	None	Built-in
BCM-021	Region-aware data flow for tenant data residency Region-aware data flow for tenant data residency	BCM	None	Built-in
BCM-022	Annual resilience report produced for board / regulator Annual resilience report produced for board / regulator	BCM	None	Built-in
best_execution_decision_capture	Best-Execution Decision Capture This control requires that every order-routing or trade-execution decision made by an AI agent record the selected execution venue and the rationale tying that choice to the firm's duty to seek the most favorable terms reasonably available under the circumstances. It addresses FINRA Rule 5310 (Best Execution) and SEC Reg NMS expectations, where unexplained or undocumented venue selection exposes the firm to regulatory and customer-harm risk. EvidentAI tags spans where the best_ex.venue field is present, capturing the venue identifier alongside the decision context, and maps the evidence to capital-markets best-execution and supervisory-control frameworks for audit reconstruction.	—	None	Built-in
bias_fairness_testing	Bias / Fairness Testing Pre-deployment and ongoing disparate-treatment and disparate-impact testing across protected classes. Search for less-discriminatory alternatives.	fairness	None	Built-in
claims_handling_decision_capture	Claims-Handling Decision Capture Requires that each AI-assisted insurance claims decision (approve, deny, partial, or referral) be captured with its basis so the insurer can demonstrate fair, timely, and non-discriminatory adjudication under state unfair-claims-settlement-practices acts and NAIC model standards. Undocumented or inconsistent claim outcomes drive bad-faith litigation, market-conduct exam findings, and unfair-discrimination risk in automated adjudication. EvidentAI tags spans where claims.decision is present, recording the outcome, supporting rationale, and reviewer context, and maps them to NIST AI RMF MAP/MEASURE controls for traceable, contestable automated decisions.	—	None	Built-in
conflict_of_interest_disclosure	Conflict-of-Interest Disclosure This control verifies that when an AI agent acts in a context carrying a material conflict of interest, the conflict is affirmatively disclosed to the customer rather than suppressed. It supports SEC Reg BI's Conflict of Interest Obligation and the Investment Advisers Act fiduciary duty to eliminate or fully disclose conflicts, since undisclosed conflicts are a recurring driver of enforcement actions. EvidentAI tags spans where coi.disclosed evaluates to true, evidencing that the disclosure occurred and was recorded at the point of recommendation, and maps these to conduct and fiduciary-duty control families.	—	None	Built-in
consent_check_before_processing	Consent Check Before Processing Requires that a valid, recorded consent be verified before personal data is processed by an agent or model, enforcing the GDPR Art. 6(1)(a)/Art. 7 lawful-processing precondition and equivalent CCPA opt-in regimes for sensitive data. It matters because processing without a verified consent state is a per-record violation that taints every downstream inference and the evidence derived from it. EvidentAI runs this control through the pii-redactor evaluator, matching spans where evidentai.consent.verified == true and tagging them into the evidence framework_mappings so each processing event is provably gated on a checked consent flag rather than assumed.	—	PII Redactionmonitor	Built-in
cross_border_transfer_tag	Cross-Border Transfer Tag Requires that every span touching personal data carry a region attribute so cross-border data flows can be identified and assessed against transfer-restriction regimes (GDPR Chapter V / SCCs, data-residency commitments, and sector rules like GLBA). Untagged region provenance is the root cause of unlawful third-country transfers and breaks data-residency attestations. EvidentAI applies the selector evidentai.region is present (non-null) to each span and tags matched spans into the evidence row's framework_mappings, giving auditors a continuous record of where each processing event occurred for residency and transfer analysis.	—	PII Redactionmonitor	Built-in
cross_boundary_chain_integrity	Cross-Boundary Chain Integrity Requires that a child run's genesis record anchor to the SHA-256 hash of the initiating span in the parent run, extending the tamper-evident chain across the run boundary into a hash-linked Merkle DAG over the causal graph (req-20 R-7). Tampering with any ancestor invalidates the anchors of every descendant, and forging a child's origin or detaching it from its parent breaks verification end to end. EvidentAI evidences it by persisting the parent initiating-span hash on each child's genesis and verifying the anchor chain from a downstream regulated action back to the root originator.	—	None	Built-in
DAT-001	Training data classified per enterprise data sensitivity policy Training data classified per enterprise data sensitivity policy	DAT	None	Built-in
DAT-002	PII tokenized or removed before model training PII tokenized or removed before model training	DAT	None	Built-in
DAT-003	Data lineage tracked from source to model output Data lineage tracked from source to model output	DAT	None	Built-in
DAT-004	Synthetic data flagged in metadata to distinguish from real-world data Synthetic data flagged in metadata to distinguish from real-world data	DAT	None	Built-in
DAT-005	Retention policy enforced per jurisdiction and data type Retention policy enforced per jurisdiction and data type	DAT	None	Built-in
DAT-006	Cross-border data transfer reviewed against adequacy decisions and SCCs Cross-border data transfer reviewed against adequacy decisions and SCCs	DAT	None	Built-in
DAT-007	RAG indexes scanned for sensitive content before publish RAG indexes scanned for sensitive content before publish	DAT	None	Built-in
DAT-008	Right-to-deletion requests processed within statutory window Right-to-deletion requests processed within statutory window	DAT	None	Built-in
DAT-009	Customer data isolated by tenant at the storage layer Customer data isolated by tenant at the storage layer	DAT	None	Built-in
DAT-010	Customer-managed keys (CMK) used for Tier-1 data at rest Customer-managed keys (CMK) used for Tier-1 data at rest	DAT	None	Built-in
DAT-011	TLS 1.2+ enforced for all in-transit data; 1.3 preferred TLS 1.2+ enforced for all in-transit data; 1.3 preferred	DAT	None	Built-in
DAT-012	Backup integrity verified monthly with restore test Backup integrity verified monthly with restore test	DAT	None	Built-in
DAT-013	Purpose limitation documented in DPIA for each use case Purpose limitation documented in DPIA for each use case	DAT	None	Built-in
DAT-014	Vector database access scoped by tenant identity at retrieval Vector database access scoped by tenant identity at retrieval	DAT	None	Built-in
DAT-015	Data sovereignty enforced via region pinning per jurisdiction Data sovereignty enforced via region pinning per jurisdiction	DAT	None	Built-in
DAT-016	Data residency exceptions logged, approved, and time-bound Data residency exceptions logged, approved, and time-bound	DAT	None	Built-in
DAT-017	Sensitive data exfiltration detection (DLP) on storage egress Sensitive data exfiltration detection (DLP) on storage egress	DAT	None	Built-in
DAT-018	Sensitive-data scanner runs continuously on data lake Sensitive-data scanner runs continuously on data lake	DAT	None	Built-in
DAT-019	Training data poisoning detection scans for backdoor triggers Training data poisoning detection scans for backdoor triggers	DAT	None	Built-in
DAT-020	Training data deduplicated to limit memorization and leakage risk Training data deduplicated to limit memorization and leakage risk	DAT	None	Built-in
DAT-021	Training data canary records inserted for leakage detection Training data canary records inserted for leakage detection	DAT	None	Built-in
DAT-022	Data quality metrics (completeness, accuracy, freshness) tracked per dataset Data quality metrics (completeness, accuracy, freshness) tracked per dataset	DAT	None	Built-in
DAT-023	Schema evolution tracked and tested with breaking-change controls Schema evolution tracked and tested with breaking-change controls	DAT	None	Built-in
DAT-024	Data contracts enforced at ingestion boundaries Data contracts enforced at ingestion boundaries	DAT	None	Built-in
DAT-025	Data minimization documented per use case and reviewed annually Data minimization documented per use case and reviewed annually	DAT	None	Built-in
DAT-026	Pseudonymization keys rotated per documented policy Pseudonymization keys rotated per documented policy	DAT	None	Built-in
DAT-027	Cross-tenant data leakage tested in non-prod prior to release Cross-tenant data leakage tested in non-prod prior to release	DAT	None	Built-in
DAT-028	Embedding versions tracked and pinned for RAG indexes Embedding versions tracked and pinned for RAG indexes	DAT	None	Built-in
DAT-029	Index re-vectorization triggered on embedding model change Index re-vectorization triggered on embedding model change	DAT	None	Built-in
DAT-030	Vector similarity threshold tuned and reviewed per use case Vector similarity threshold tuned and reviewed per use case	DAT	None	Built-in
DAT-031	Customer data export available within statutory window (portability) Customer data export available within statutory window (portability)	DAT	None	Built-in
DAT-032	Data Subject Access Request workflow audited quarterly Data Subject Access Request workflow audited quarterly	DAT	None	Built-in
DAT-033	Children's data special handling for COPPA / age-restricted compliance Children's data special handling for COPPA / age-restricted compliance	DAT	None	Built-in
DAT-034	Biometric data processed under special-category controls Biometric data processed under special-category controls	DAT	None	Built-in
DAT-035	Training data integrity hash verified before training run Training data integrity hash verified before training run	DAT	None	Built-in
DAT-036	RAG document sanitization strips executable content and scripts RAG document sanitization strips executable content and scripts	DAT	None	Built-in
DAT-037	RAG chunking strategy documented and reviewed for content boundaries RAG chunking strategy documented and reviewed for content boundaries	DAT	None	Built-in
DAT-038	Vector embeddings encrypted at rest with tenant-scoped keys Vector embeddings encrypted at rest with tenant-scoped keys	DAT	None	Built-in
DAT-039	Retrieval results filtered through safety classifier before LLM assembly Retrieval results filtered through safety classifier before LLM assembly	DAT	None	Built-in
DAT-040	Retrieval citations validated against source content for accuracy Retrieval citations validated against source content for accuracy	DAT	None	Built-in
data_governance_lineage	Data Governance / Lineage Training-data and inference-input provenance, lineage, and quality controls. Covers data minimization, retention, and cross-border transfer mechanisms.	data	PII Redactionmonitor Policy Evaluationmonitor	Built-in
data_subject_request_handling	Data-Subject Request Handling Requires that data-subject access, erasure, and rectification requests be tracked end-to-end with a request identifier, evidencing the operator's response duties under GDPR Arts. 12-22 and CCPA consumer-rights provisions (and their statutory windows). Without a traceable request id, an organization cannot prove it acted on a DSAR within the mandated deadline, which is a direct enforcement exposure. EvidentAI matches spans where evidentai.dsar.request_id is present and tags them into the evidence framework_mappings, linking the agent activity that fulfilled a request to that request for downstream SLA and completeness verification.	—	None	Built-in
delegation_scope_attenuation	Delegation Scope Attenuation Requires that the scope granted to a child run be a subset of the scope held by the granting run, which in turn must be a subset of the root principal's authority — scope SHOULD narrow at each hop (req-20 R-5/R-13). Any initiation edge whose downstream scope exceeds the granting run or the root principal is flagged as privilege escalation through delegation, the confused-deputy problem at chain scale. EvidentAI evidences it by diffing granted_scope against parent_scope on each persisted initiation edge and reporting non-attenuating edges; the flagship case is the upsell (marketing:offer.present) -> loan_app (lending:originate,credit_bureau:pull) edge.	—	None	Built-in
DEP-001	Production changes only through CI/CD pipeline Production changes only through CI/CD pipeline	DEP	None	Built-in
DEP-002	Infrastructure-as-Code mandatory for all AI workloads Infrastructure-as-Code mandatory for all AI workloads	DEP	None	Built-in
DEP-003	IaC changes require security scan pass (Checkov / tfsec) IaC changes require security scan pass (Checkov / tfsec)	DEP	None	Built-in
DEP-004	No direct portal or CLI changes to production resources No direct portal or CLI changes to production resources	DEP	None	Built-in
DEP-005	Deployments require change advisory board approval Deployments require change advisory board approval	DEP	None	Built-in
DEP-006	Canary deployments for model changes affecting >5% of traffic Canary deployments for model changes affecting >5% of traffic	DEP	None	Built-in
DEP-007	Rollback procedure tested quarterly with documented runbook Rollback procedure tested quarterly with documented runbook	DEP	None	Built-in
DEP-008	Out-of-window deployments require documented emergency approval Out-of-window deployments require documented emergency approval	DEP	None	Built-in
DEP-009	Feature flags used for staged rollout of model and prompt changes Feature flags used for staged rollout of model and prompt changes	DEP	None	Built-in
DEP-010	SBOM generated and stored for every production deployment SBOM generated and stored for every production deployment	DEP	None	Built-in
DEP-011	Container images scanned before push to registry Container images scanned before push to registry	DEP	None	Built-in
DEP-012	Signed container images required in production Signed container images required in production	DEP	None	Built-in
DEP-013	Deployment artifacts retained for 7 years for audit traceability Deployment artifacts retained for 7 years for audit traceability	DEP	None	Built-in
DEP-014	Blue-green deployment used for critical inference endpoints Blue-green deployment used for critical inference endpoints	DEP	None	Built-in
DEP-015	Pipeline credentials use OIDC federation, not stored secrets Pipeline credentials use OIDC federation, not stored secrets	DEP	None	Built-in
DEP-016	CI jobs run on clean, ephemeral, immutable agents CI jobs run on clean, ephemeral, immutable agents	DEP	None	Built-in
DEP-017	Build provenance attestations produced (SLSA Level 3 target) Build provenance attestations produced (SLSA Level 3 target)	DEP	None	Built-in
DEP-018	Artifact integrity verified at deploy time via signature check Artifact integrity verified at deploy time via signature check	DEP	None	Built-in
DEP-019	Configuration drift detected and remediated within 24 hours Configuration drift detected and remediated within 24 hours	DEP	None	Built-in
DEP-020	Production secrets fetched at runtime, never baked into images Production secrets fetched at runtime, never baked into images	DEP	None	Built-in
DEP-021	Environment promotion follows documented progression dev->test->stage->prod Environment promotion follows documented progression dev->test->stage->prod	DEP	None	Built-in
DEP-022	Production direct access reserved for break-glass emergencies only Production direct access reserved for break-glass emergencies only	DEP	None	Built-in
DEP-023	Deployment metadata exported to CMDB for asset traceability Deployment metadata exported to CMDB for asset traceability	DEP	None	Built-in
DEP-024	Pull-request templates require security, risk, and rollback fields Pull-request templates require security, risk, and rollback fields	DEP	None	Built-in
DEP-025	Branch protection mandates two approvers for protected paths Branch protection mandates two approvers for protected paths	DEP	None	Built-in
DEP-026	CODEOWNERS enforced on AI-critical paths (models, prompts, policies) CODEOWNERS enforced on AI-critical paths (models, prompts, policies)	DEP	None	Built-in
DEP-027	Pipeline runs scanned for typosquatting / dependency confusion Pipeline runs scanned for typosquatting / dependency confusion	DEP	None	Built-in
DEP-028	License compliance scan executed pre-deploy (SPDX inventory) License compliance scan executed pre-deploy (SPDX inventory)	DEP	None	Built-in
EVL-001	Evaluation harness reproducible across environments Evaluation harness reproducible across environments	EVL	None	Built-in
EVL-002	Golden eval set protected from training-data contamination Golden eval set protected from training-data contamination	EVL	None	Built-in
EVL-003	Eval coverage tracked across use cases and personas Eval coverage tracked across use cases and personas	EVL	None	Built-in
EVL-004	Baseline metrics anchored at major releases for regression comparison Baseline metrics anchored at major releases for regression comparison	EVL	None	Built-in
EVL-005	Eval-as-code with versioned, signed eval suites Eval-as-code with versioned, signed eval suites	EVL	None	Built-in
EVL-006	Statistical significance required for go / no-go decisions Statistical significance required for go / no-go decisions	EVL	None	Built-in
EVL-007	Data drift monitored per feature (PSI, KL divergence) Data drift monitored per feature (PSI, KL divergence)	EVL	None	Built-in
EVL-008	Concept drift monitored via prediction distribution shift Concept drift monitored via prediction distribution shift	EVL	None	Built-in
EVL-009	Label drift monitored where ground truth becomes available Label drift monitored where ground truth becomes available	EVL	None	Built-in
EVL-010	Embedding drift monitored for retrieval systems Embedding drift monitored for retrieval systems	EVL	None	Built-in
EVL-011	Prompt drift monitored via response distribution shift Prompt drift monitored via response distribution shift	EVL	None	Built-in
EVL-012	Response anomaly scoring per output Response anomaly scoring per output	EVL	None	Built-in
EVL-013	Semantic anomaly detection via embedding distance Semantic anomaly detection via embedding distance	EVL	None	Built-in
EVL-014	Factual consistency checks against retrieved context Factual consistency checks against retrieved context	EVL	None	Built-in
EVL-015	Sycophancy detection in conversational systems Sycophancy detection in conversational systems	EVL	None	Built-in
EVL-016	Response coherence scored per turn Response coherence scored per turn	EVL	None	Built-in
EVL-017	Hallucination rate measured per use case per release Hallucination rate measured per use case per release	EVL	None	Built-in
EVL-018	Grounding score distribution monitored Grounding score distribution monitored	EVL	None	Built-in
EVL-019	Citation accuracy verified via retrieval check Citation accuracy verified via retrieval check	EVL	None	Built-in
EVL-020	Response style consistency monitored Response style consistency monitored	EVL	None	Built-in
EVL-021	Output entropy / diversity tracked to detect mode collapse Output entropy / diversity tracked to detect mode collapse	EVL	None	Built-in
EVL-022	Refusal calibration measured against expected refusal rate Refusal calibration measured against expected refusal rate	EVL	None	Built-in
EVL-023	Toxicity drift monitored quarterly Toxicity drift monitored quarterly	EVL	None	Built-in
EVL-024	Bias drift monitored per protected attribute Bias drift monitored per protected attribute	EVL	None	Built-in
EVL-025	Performance regression detection per release Performance regression detection per release	EVL	None	Built-in
EVL-026	A/B test framework for prompt and model changes A/B test framework for prompt and model changes	EVL	None	Built-in
EVL-027	Shadow eval against production traffic Shadow eval against production traffic	EVL	None	Built-in
EVL-028	Human evaluation panel for high-stakes use cases Human evaluation panel for high-stakes use cases	EVL	None	Built-in
EVL-029	Inter-annotator agreement measured on eval sets Inter-annotator agreement measured on eval sets	EVL	None	Built-in
EVL-030	Eval result aggregation per use case for governance reporting Eval result aggregation per use case for governance reporting	EVL	None	Built-in
EVL-031	Eval failures trigger CI block automatically Eval failures trigger CI block automatically	EVL	None	Built-in
EVL-032	Multi-turn conversation evaluation framework maintained Multi-turn conversation evaluation framework maintained	EVL	None	Built-in
EVL-033	Long-context evaluation (needle-in-haystack) executed for long-context models Long-context evaluation (needle-in-haystack) executed for long-context models	EVL	None	Built-in
EVL-034	Robustness evaluation against perturbed inputs Robustness evaluation against perturbed inputs	EVL	None	Built-in
EVL-035	Adversarial robustness measured per release Adversarial robustness measured per release	EVL	None	Built-in
EVL-036	Domain-specific evaluation suites maintained for in-scope industries Domain-specific evaluation suites maintained for in-scope industries	EVL	None	Built-in
EVL-037	Regulatory-specific evaluation (fair lending, FCRA, etc.) Regulatory-specific evaluation (fair lending, FCRA, etc.)	EVL	None	Built-in
EVL-038	Eval result lineage tracked from model -> eval -> dashboard Eval result lineage tracked from model -> eval -> dashboard	EVL	None	Built-in
EVL-039	Production sampling for offline eval Production sampling for offline eval	EVL	None	Built-in
EVL-040	Eval data refreshed quarterly to prevent overfitting Eval data refreshed quarterly to prevent overfitting	EVL	None	Built-in
fcra_dispute_resolution	FCRA Dispute Resolution Requires that consumer disputes of credit-report or decision data be logged, investigated, and resolved within the statutory window under FCRA section 611 (15 USC 1681i), including reinvestigation and correction or deletion of inaccurate information. Mishandled disputes are a frequent source of CFPB enforcement and private FCRA litigation, and AI agents touching dispute workflows must leave an auditable trail of the reinvestigation. EvidentAI tags spans carrying an fcra.dispute_id, preserving the dispute intake, investigation steps, and outcome, and maps the evidence to FCRA accuracy/dispute controls and NIST AI RMF GOVERN for accountable handling.	—	None	Built-in
fcra_permissible_purpose_check	FCRA Permissible-Purpose Check Requires that a consumer report be accessed only for a permissible purpose enumerated in FCRA section 604 (15 USC 1681b), such as a credit application, account review, or written consumer authorization, before the pull occurs. Obtaining or furnishing a report without permissible purpose is a per-se FCRA violation carrying statutory damages and regulatory exposure, so the justification must be recorded at the point of access. EvidentAI tags spans where fcra.permissible_purpose is present, evidencing that the agent asserted and logged a valid purpose prior to the inquiry, and maps it to FCRA access-control requirements and NIST AI RMF MAP for documented authorization.	—	None	Built-in
human_oversight	Human Oversight Human-in-the-loop gates for consequential decisions (credit, employment, healthcare). Reviewer authority to override, contest, or escalate AI outputs.	governance	None	Built-in
identity_theft_red_flag_detection	Identity-Theft Red-Flag Detection Requires detection and response to identity-theft warning signs under the FCRA Red Flags Rule (16 CFR 681.1 / Reg V), so that suspicious indicators in account opening or maintenance trigger the institution's Identity Theft Prevention Program. Missing a red flag exposes consumers to fraud and the institution to regulatory findings for an ineffective program, and automated agents must surface and route these signals rather than silently proceed. EvidentAI tags spans where identity_theft.red_flag == true, capturing the triggering indicator and the agent's response path, and maps the evidence to Red Flags Rule program controls and NIST AI RMF MEASURE for monitoring detection efficacy.	—	None	Built-in
impact_assessment	Impact / FRIA / DPIA Combined impact assessment satisfying EU FRIA, GDPR DPIA, Colorado AI Act, and CCPA risk-assessment requirements for high-risk AI systems.	governance	None	Built-in
incident_response	Incident Response AI-specific incident response: prompt injection, training-data poisoning, model theft, hallucinated regulatory advice. Regulator notification timelines.	security	Policy Evaluationmonitor	Built-in
initiation_depth_limit	Initiation Depth Limit Requires a maximum initiation depth across a causal chain of workflow runs, so a fully agentic chain cannot grow without bound when no human is in the loop (req-20 R-9). An initiation attempt past the configured depth is denied and recorded; in enforce mode the deny stops the spawn rather than only logging it. EvidentAI evidences it by carrying the current depth in the in-band signed chain summary and evaluating it at the initiation point, writing evidence when the ceiling is reached.	—	None	Built-in
kyc_verification_check	KYC Verification Check Requires Customer Identification Program verification of identity at onboarding and at risk-based refresh, satisfying the CIP rule (31 CFR 1020.220) and the FinCEN Customer Due Diligence requirements before an account or relationship proceeds. Failure to verify before granting access creates AML and identity-fraud exposure and is a recurring examiner finding. EvidentAI tags spans carrying a kyc.verification_id, evidencing that the agent obtained and recorded a completed verification artifact for the customer, and maps the result to BSA/AML CIP/CDD controls and to NIST AI RMF GOVERN/MAP for documented decision provenance.	—	None	Built-in
lawful_basis_attribute	GDPR Lawful-Basis Attribute Requires that each processing span declare the GDPR Art. 6 lawful basis (consent, contract, legal obligation, vital interests, public task, or legitimate interests) under which the personal data is handled, operationalizing the accountability principle of Art. 5(2). Processing with no asserted lawful basis is unlawful on its face and cannot be remediated retroactively, so the attribute must be captured at the point of processing. EvidentAI evaluates evidentai.gdpr.lawful_basis is present against each span and tags matched spans into the evidence row's framework_mappings, producing a per-event ledger of the asserted lawful basis for regulator review.	—	None	Built-in
logging_recordkeeping	Logging & Recordkeeping Tamper-evident logs of prompts, outputs, inputs, decisions, and model versions. Retention windows aligned to regulatory minimums (Reg B 25 mo, CA FEHA 4 yr).	observability	Policy Evaluationmonitor	Built-in
marketing_rule_substantiation	Marketing Rule 206(4)-1 Substantiation This control requires that any performance claim, testimonial, or statement of material fact produced in advertising or marketing content be substantiated with a reasonable basis before dissemination. It enforces the SEC Marketing Rule (Investment Advisers Act Rule 206(4)-1), which prohibits unsubstantiated or misleading advertisements and requires advisers to have records demonstrating the basis for performance claims. EvidentAI tags spans where marketing.substantiated is true, linking the claim to its supporting evidence and review, and maps these records to advertising-compliance and books-and-records control families to demonstrate the firm met its substantiation burden.	—	None	Built-in
market_surveillance_alert	Market Surveillance Alert This control captures cases where an AI agent's behavioral surveillance logic raises an alert for potentially manipulative or abusive trading patterns such as spoofing, layering, wash trading, or insider activity. It underpins exchange and SRO market-integrity obligations under the Securities Exchange Act and FINRA surveillance rules, and Dodd-Frank/CFTC anti-manipulation provisions, where failure to detect and escalate suspicious activity is itself a supervisory failure. EvidentAI tags spans where surveillance.alert is true, preserving the alert and its triggering signals as time-stamped evidence, and maps them to market-abuse and supervisory-surveillance frameworks for examiner review.	—	None	Built-in
MDL-001	Model card maintained for every production model Model card maintained for every production model	MDL	None	Built-in
MDL-002	Model inventory reviewed quarterly and includes shadow-AI discovery Model inventory reviewed quarterly and includes shadow-AI discovery	MDL	None	Built-in
MDL-003	Model risk tier assigned at onboarding using four-tier scale Model risk tier assigned at onboarding using four-tier scale	MDL	None	Built-in
MDL-004	Independent validation required for Tier-1 models before production Independent validation required for Tier-1 models before production	MDL	None	Built-in
MDL-005	Model performance monitored against baseline with SLI tracking Model performance monitored against baseline with SLI tracking	MDL	None	Built-in
MDL-006	Fairness metrics tracked per protected class for in-scope models Fairness metrics tracked per protected class for in-scope models	MDL	None	Built-in
MDL-007	Data and concept drift detection alerts wired to SIEM Data and concept drift detection alerts wired to SIEM	MDL	None	Built-in
MDL-008	Model decommission process documented and includes data deletion Model decommission process documented and includes data deletion	MDL	None	Built-in
MDL-009	Foundation-model vendors assessed annually for DPA, AUP, and security posture Foundation-model vendors assessed annually for DPA, AUP, and security posture	MDL	None	Built-in
MDL-010	Fine-tuning datasets logged with provenance (hash, source, license) Fine-tuning datasets logged with provenance (hash, source, license)	MDL	None	Built-in
MDL-011	Model version pinned in production manifests; no floating tags Model version pinned in production manifests; no floating tags	MDL	None	Built-in
MDL-012	Shadow deployment required minimum 7 days before traffic cutover Shadow deployment required minimum 7 days before traffic cutover	MDL	None	Built-in
MDL-013	Adverse action notices reviewed for explainability adequacy Adverse action notices reviewed for explainability adequacy	MDL	None	Built-in
MDL-014	Champion-challenger comparisons documented for credit and risk models Champion-challenger comparisons documented for credit and risk models	MDL	None	Built-in
MDL-015	Model lineage tracked from training data through to inference output Model lineage tracked from training data through to inference output	MDL	None	Built-in
MDL-016	Pre-production hold-out evaluation set protected from training contamination Pre-production hold-out evaluation set protected from training contamination	MDL	None	Built-in
MDL-017	Model evaluation harness reproducible across environments Model evaluation harness reproducible across environments	MDL	None	Built-in
MDL-018	Robustness testing against adversarial perturbations executed per release Robustness testing against adversarial perturbations executed per release	MDL	None	Built-in
MDL-019	Membership-inference attack testing for sensitive models Membership-inference attack testing for sensitive models	MDL	None	Built-in
MDL-020	Out-of-distribution detection wired to circuit breaker on inference path Out-of-distribution detection wired to circuit breaker on inference path	MDL	None	Built-in
MDL-021	Calibration metrics tracked for probabilistic outputs (ECE, Brier) Calibration metrics tracked for probabilistic outputs (ECE, Brier)	MDL	None	Built-in
MDL-022	Model interpretability artifacts produced (SHAP / LIME) for in-scope models Model interpretability artifacts produced (SHAP / LIME) for in-scope models	MDL	None	Built-in
MDL-023	Pre-deployment bias assessment completed with documented thresholds Pre-deployment bias assessment completed with documented thresholds	MDL	None	Built-in
MDL-024	Disparate-impact analysis for credit, employment, housing, insurance use cases Disparate-impact analysis for credit, employment, housing, insurance use cases	MDL	None	Built-in
MDL-025	Champion-challenger transition criteria documented and enforced Champion-challenger transition criteria documented and enforced	MDL	None	Built-in
MDL-026	Model retraining triggered by documented data/performance criteria Model retraining triggered by documented data/performance criteria	MDL	None	Built-in
MDL-027	Foundation model context window limits enforced at gateway Foundation model context window limits enforced at gateway	MDL	None	Built-in
MDL-028	Foundation model token budget enforced per use case and tenant Foundation model token budget enforced per use case and tenant	MDL	None	Built-in
MDL-029	Foundation model upgrade impact assessed pre-rollout Foundation model upgrade impact assessed pre-rollout	MDL	None	Built-in
MDL-030	Model output entropy / confidence threshold enforced per use case Model output entropy / confidence threshold enforced per use case	MDL	None	Built-in
MDL-031	Synthetic monitoring probes run continuously against inference endpoints Synthetic monitoring probes run continuously against inference endpoints	MDL	None	Built-in
MDL-032	Cost-per-inference tracked per use case for budget governance Cost-per-inference tracked per use case for budget governance	MDL	None	Built-in
MDL-033	Model card schema enforced with mandatory fields (use, limits, eval, risks) Model card schema enforced with mandatory fields (use, limits, eval, risks)	MDL	None	Built-in
MDL-034	Model weights integrity verified via cryptographic hash at load time Model weights integrity verified via cryptographic hash at load time	MDL	None	Built-in
MDL-035	Model artifacts signed with organizational code-signing certificate Model artifacts signed with organizational code-signing certificate	MDL	None	Built-in
MDL-036	Model parameter count, architecture, and license documented per release Model parameter count, architecture, and license documented per release	MDL	None	Built-in
MDL-037	Training compute tracked (FLOPs, tokens, wall-clock) per model Training compute tracked (FLOPs, tokens, wall-clock) per model	MDL	None	Built-in
MDL-038	Model lineage traces base model, fine-tune dataset, and hyperparameters Model lineage traces base model, fine-tune dataset, and hyperparameters	MDL	None	Built-in
MDL-039	Model watermarking applied where IP protection required Model watermarking applied where IP protection required	MDL	None	Built-in
MDL-040	Model extraction attack detection wired to monitoring Model extraction attack detection wired to monitoring	MDL	None	Built-in
MDL-041	Distillation defense for proprietary models (query rate, output noise) Distillation defense for proprietary models (query rate, output noise)	MDL	None	Built-in
MDL-042	Embedding model versioned, pinned, and registered in catalog Embedding model versioned, pinned, and registered in catalog	MDL	None	Built-in
MDL-043	Tokenizer version pinned and tested for compatibility on upgrade Tokenizer version pinned and tested for compatibility on upgrade	MDL	None	Built-in
MDL-044	Model rollback artifact retained for at least n-2 production versions Model rollback artifact retained for at least n-2 production versions	MDL	None	Built-in
MDL-045	Model registry access audited and segregated from production deploy Model registry access audited and segregated from production deploy	MDL	None	Built-in
model_identification	Model Identification Requires that each inference record the model name, version, and provider that produced it, establishing a per-call model ledger that underpins the model inventory and technical documentation obligations. This matters for EU AI Act Art. 11 / Annex IV technical documentation, NIST AI RMF MAP 1/MAP 2 context-mapping, SR 11-7 model inventory, ISO 42001 A.6.2.4, and SOC 2 CC2.1. EvidentAI evidences it by tagging spans where gen_ai.request.model is present and mapping that identification coverage to the frameworks, so an auditor can confirm no inference ran on an unregistered or unattributed model.	—	Policy Evaluationmonitor	Built-in
MON-001	All AI workloads send logs to centralized SIEM All AI workloads send logs to centralized SIEM	MON	None	Built-in
MON-002	Cost anomaly alerts configured per AI workload Cost anomaly alerts configured per AI workload	MON	None	Built-in
MON-003	Inference latency SLIs tracked at p50, p95, p99 Inference latency SLIs tracked at p50, p95, p99	MON	None	Built-in
MON-004	Error rate SLI tracked per endpoint (4xx, 5xx, model errors) Error rate SLI tracked per endpoint (4xx, 5xx, model errors)	MON	None	Built-in
MON-005	Security alerts triaged within one hour by on-call rotation Security alerts triaged within one hour by on-call rotation	MON	None	Built-in
MON-006	AI-specific incident response playbook current and reviewed annually AI-specific incident response playbook current and reviewed annually	MON	None	Built-in
MON-007	Tabletop exercises conducted twice yearly including model-failure scenarios Tabletop exercises conducted twice yearly including model-failure scenarios	MON	None	Built-in
MON-008	Vendor incident notifications received and triaged within 24 hours Vendor incident notifications received and triaged within 24 hours	MON	None	Built-in
MON-009	Audit log immutability enforced via WORM or equivalent Audit log immutability enforced via WORM or equivalent	MON	None	Built-in
MON-010	Regulator notification process documented (GDPR 72hr, NYDFS, state breach) Regulator notification process documented (GDPR 72hr, NYDFS, state breach)	MON	None	Built-in
MON-011	Blameless postmortem published within 5 business days of major incident Blameless postmortem published within 5 business days of major incident	MON	None	Built-in
MON-012	Customer notification SLAs defined and met per incident severity Customer notification SLAs defined and met per incident severity	MON	None	Built-in
MON-013	AI-specific KPIs included in service health dashboards AI-specific KPIs included in service health dashboards	MON	None	Built-in
MON-014	Model degradation detected within 15 minutes of threshold breach Model degradation detected within 15 minutes of threshold breach	MON	None	Built-in
MON-015	Inference token consumption tracked per tenant Inference token consumption tracked per tenant	MON	None	Built-in
MON-016	Inference quotas enforced and breach-alerted Inference quotas enforced and breach-alerted	MON	None	Built-in
MON-017	Concept drift alert routing per use case Concept drift alert routing per use case	MON	None	Built-in
MON-018	Data drift alert routing per feature and per use case Data drift alert routing per feature and per use case	MON	None	Built-in
MON-019	Anomalous user behavior detected (UEBA) on AI platform Anomalous user behavior detected (UEBA) on AI platform	MON	None	Built-in
MON-020	Honeytoken / canary content monitoring on RAG indexes Honeytoken / canary content monitoring on RAG indexes	MON	None	Built-in
MON-021	Forensic packet capture available for critical incidents Forensic packet capture available for critical incidents	MON	None	Built-in
MON-022	Incident classification per harm taxonomy (model harm vs security) Incident classification per harm taxonomy (model harm vs security)	MON	None	Built-in
MON-023	Regulator-mandated logging fields captured (EU AI Act Art. 12) Regulator-mandated logging fields captured (EU AI Act Art. 12)	MON	None	Built-in
MON-024	Logs aggregated to enable cross-system correlation Logs aggregated to enable cross-system correlation	MON	None	Built-in
MON-025	Reverse-engineering / model-extraction detection in place Reverse-engineering / model-extraction detection in place	MON	None	Built-in
MON-026	Membership-inference attack monitoring in production Membership-inference attack monitoring in production	MON	None	Built-in
MON-027	Audit log SIEM coverage measured and reported Audit log SIEM coverage measured and reported	MON	None	Built-in
MON-028	Customer-facing status page updated within 15 minutes of declared incident Customer-facing status page updated within 15 minutes of declared incident	MON	None	Built-in
MON-029	Token consumption anomaly alerts per tenant Token consumption anomaly alerts per tenant	MON	None	Built-in
MON-030	Latency p99 anomaly alerts per endpoint Latency p99 anomaly alerts per endpoint	MON	None	Built-in
MON-031	Cost-per-inference anomaly alerts Cost-per-inference anomaly alerts	MON	None	Built-in
MON-032	Refusal-pattern anomalies trigger investigation Refusal-pattern anomalies trigger investigation	MON	None	Built-in
MON-033	Response length anomalies trigger investigation Response length anomalies trigger investigation	MON	None	Built-in
MON-034	Cross-tenant correlation prohibited in observability dashboards Cross-tenant correlation prohibited in observability dashboards	MON	None	Built-in
MON-035	AI-specific KPIs reported to executive dashboard quarterly AI-specific KPIs reported to executive dashboard quarterly	MON	None	Built-in
MON-036	Toxic / unsafe output rate reported per use case Toxic / unsafe output rate reported per use case	MON	None	Built-in
MON-037	Tool-call failure rate monitored and alerted Tool-call failure rate monitored and alerted	MON	None	Built-in
MON-038	Agent loop / recursion anomalies detected Agent loop / recursion anomalies detected	MON	None	Built-in
MON-039	Response sentiment / quality monitored against baseline Response sentiment / quality monitored against baseline	MON	None	Built-in
MON-040	Heartbeat from agents continuously aggregated for liveness Heartbeat from agents continuously aggregated for liveness	MON	None	Built-in
pii_detection_redaction	PII Detection / Redaction Requires that personally identifiable information appearing in agent prompts, outputs, or logs be detected and redacted, supporting GDPR data-minimization (Art. 5(1)(c)), HIPAA §164.514 de-identification, and SOC 2 confidentiality commitments. Unredacted PII in model context or transcripts is a leakage and breach-notification trigger, so detection must be evidenced on every invocation rather than sampled. EvidentAI runs this control through the pii-redactor evaluator, matching spans where evidentai.pii.detected == true and tagging them into the evidence framework_mappings, and pairs the result with the NIST AI RMF MEASURE-3.1 output-PII test so coverage is measured against a threshold.	—	PII Redactionmonitor	Built-in
PRM-001	System prompts stored in version control only; no production-edit paths System prompts stored in version control only; no production-edit paths	PRM	None	Built-in
PRM-002	Prompt changes require peer review and PR approval Prompt changes require peer review and PR approval	PRM	None	Built-in
PRM-003	Prompt injection defense tested against adversarial suite before deploy Prompt injection defense tested against adversarial suite before deploy	PRM	None	Built-in
PRM-004	Agents declare permitted tools in a manifest registered with platform Agents declare permitted tools in a manifest registered with platform	PRM	None	Built-in
PRM-005	Tool-call results logged with normalized I/O to canonical evidence schema Tool-call results logged with normalized I/O to canonical evidence schema	PRM	None	Built-in
PRM-006	Agent identity propagated to downstream tool calls (on-behalf-of) Agent identity propagated to downstream tool calls (on-behalf-of)	PRM	None	Built-in
PRM-007	Tool allowlist enforced at runtime, not solely in prompt instructions Tool allowlist enforced at runtime, not solely in prompt instructions	PRM	None	Built-in
PRM-008	Multi-turn agent loops bounded by max-step and max-cost limits Multi-turn agent loops bounded by max-step and max-cost limits	PRM	None	Built-in
PRM-009	Human-in-the-loop required for high-risk agent actions Human-in-the-loop required for high-risk agent actions	PRM	None	Built-in
PRM-010	Agent memory subject to documented retention and deletion policy Agent memory subject to documented retention and deletion policy	PRM	None	Built-in
PRM-011	Prompt templates reviewed for sensitive data leakage before publish Prompt templates reviewed for sensitive data leakage before publish	PRM	None	Built-in
PRM-012	Function-calling schemas validated against registered tool registry Function-calling schemas validated against registered tool registry	PRM	None	Built-in
PRM-013	Agent traces exported to canonical evidence schema for GRC ingestion Agent traces exported to canonical evidence schema for GRC ingestion	PRM	None	Built-in
PRM-014	Adversarial prompt suite executed per release (min 200 vectors) Adversarial prompt suite executed per release (min 200 vectors)	PRM	None	Built-in
PRM-015	Agent action approval policy mapped to control risk tier Agent action approval policy mapped to control risk tier	PRM	None	Built-in
PRM-016	PII in prompts flagged and redacted before logging PII in prompts flagged and redacted before logging	PRM	None	Built-in
PRM-017	Prompt library inventoried by use case and reviewed quarterly Prompt library inventoried by use case and reviewed quarterly	PRM	None	Built-in
PRM-018	System and user prompts logged in separate, role-tagged channels System and user prompts logged in separate, role-tagged channels	PRM	None	Built-in
PRM-019	Prompt evaluation suite runs nightly on production prompts Prompt evaluation suite runs nightly on production prompts	PRM	None	Built-in
PRM-020	Prompt diffs reviewed for security and policy implications Prompt diffs reviewed for security and policy implications	PRM	None	Built-in
PRM-021	Tool-call cost limits enforced per agent per session Tool-call cost limits enforced per agent per session	PRM	None	Built-in
PRM-022	Agent escalation policy executed when limits exceeded Agent escalation policy executed when limits exceeded	PRM	None	Built-in
PRM-023	Long-running agents emit periodic heartbeats to monitoring Long-running agents emit periodic heartbeats to monitoring	PRM	None	Built-in
PRM-024	Agent task queues persisted to enable replay Agent task queues persisted to enable replay	PRM	None	Built-in
PRM-025	Tool definitions versioned using semantic versioning Tool definitions versioned using semantic versioning	PRM	None	Built-in
PRM-026	Tool deprecation notices issued to consumers with 30-day window Tool deprecation notices issued to consumers with 30-day window	PRM	None	Built-in
PRM-027	Function-call arguments validated at runtime against schema Function-call arguments validated at runtime against schema	PRM	None	Built-in
PRM-028	Agent reasoning traces redacted of secrets before storage Agent reasoning traces redacted of secrets before storage	PRM	None	Built-in
PRM-029	Vector tool memory subject to per-tenant isolation Vector tool memory subject to per-tenant isolation	PRM	None	Built-in
PRM-030	Agent identity attested via signed token at tool boundary Agent identity attested via signed token at tool boundary	PRM	None	Built-in
PRM-031	Agent workflows tested for replay safety and idempotency Agent workflows tested for replay safety and idempotency	PRM	None	Built-in
PRM-032	Cross-agent communication restricted to declared topology Cross-agent communication restricted to declared topology	PRM	None	Built-in
PRM-033	Prompt metadata schema enforced (purpose, owner, risk tier, dependencies) Prompt metadata schema enforced (purpose, owner, risk tier, dependencies)	PRM	None	Built-in
PRM-034	Prompt content hash recorded for integrity verification at runtime Prompt content hash recorded for integrity verification at runtime	PRM	None	Built-in
PRM-035	Prompt taxonomy maintained with categories, tags, and risk classifications Prompt taxonomy maintained with categories, tags, and risk classifications	PRM	None	Built-in
PRM-036	Prompt regression suite executed per release with go/no-go criteria Prompt regression suite executed per release with go/no-go criteria	PRM	None	Built-in
PRM-037	Prompt cost attribution tracked per use case and per tenant Prompt cost attribution tracked per use case and per tenant	PRM	None	Built-in
PRM-038	Indirect prompt injection from retrieved content tested and defended Indirect prompt injection from retrieved content tested and defended	PRM	None	Built-in
PRM-039	Prompt template variables validated against allowlist before assembly Prompt template variables validated against allowlist before assembly	PRM	None	Built-in
PRM-040	Prompt assembly logged with all components (template, vars, retrieved context) Prompt assembly logged with all components (template, vars, retrieved context)	PRM	None	Built-in
PRM-041	Agent metadata schema enforced (capability, risk class, owner, dependencies) Agent metadata schema enforced (capability, risk class, owner, dependencies)	PRM	None	Built-in
PRM-042	Agent capability declarations validated against runtime enforcement Agent capability declarations validated against runtime enforcement	PRM	None	Built-in
PRM-043	Agent goal alignment monitored via output classifier Agent goal alignment monitored via output classifier	PRM	None	Built-in
PRM-044	Sub-agent provenance tracked through multi-agent invocation chains Sub-agent provenance tracked through multi-agent invocation chains	PRM	None	Built-in
PRM-045	Agent runtime sandboxed with resource and network restrictions Agent runtime sandboxed with resource and network restrictions	PRM	None	Built-in
prompt_injection_detection	Prompt-Injection Detection Requires active screening of model inputs for prompt-injection and jailbreak attempts, including indirect injection arriving through tool or retrieval I/O, so adversarial instructions cannot subvert the agent. It maps to OWASP LLM01 Prompt Injection, MITRE ATLAS AML.T0051, NIST AI RMF MEASURE 2.7, and SOC 2 CC6.6 logical-access protection. EvidentAI evidences it by tagging spans where prompt_injection.flagged == true emitted by the detector, and maps those flagged spans to the frameworks as both detection-coverage proof and the incident trail for any attempt caught.	—	Prompt-Injection Defensemonitor	Built-in
prompt_logging_capture	Prompt / Response Logging Requires durable capture of the full prompt and corresponding response for each agent call, providing the books-and-records and replay trail regulators expect for AI-assisted decisions. This satisfies FINRA Rule 4511 and SEC Investment Advisers Act §204-2 recordkeeping, NIST AI RMF MEASURE 3, ISO 42001 A.6.2.8, and SOC 2 CC7.2. EvidentAI evidences it by tagging spans that carry prompt.text (the captured prompt content) and mapping logging completeness to the frameworks, demonstrating that interactions are recorded and retrievable for post-hoc review.	—	None	Built-in
REG-001	EU AI Act classification documented per use case (Annex III mapped) EU AI Act classification documented per use case (Annex III mapped)	REG	None	Built-in
REG-002	NIST AI RMF profile maintained covering Govern, Map, Measure, Manage NIST AI RMF profile maintained covering Govern, Map, Measure, Manage	REG	None	Built-in
REG-003	ISO / IEC 42001 AI management system documented for external certification ISO / IEC 42001 AI management system documented for external certification	REG	None	Built-in
REG-004	Banking model risk management aligned to SR 11-7 where applicable Banking model risk management aligned to SR 11-7 where applicable	REG	None	Built-in
REG-005	Fair-lending review conducted for credit decisioning models Fair-lending review conducted for credit decisioning models	REG	None	Built-in
REG-006	HIPAA Business Associate Agreement in place for healthcare workloads HIPAA Business Associate Agreement in place for healthcare workloads	REG	None	Built-in
REG-007	SOC 2 Type II audit completed annually SOC 2 Type II audit completed annually	REG	None	Built-in
REG-008	Annual third-party penetration test conducted Annual third-party penetration test conducted	REG	None	Built-in
REG-009	Internal audit reviews AI controls annually with findings tracked to closure Internal audit reviews AI controls annually with findings tracked to closure	REG	None	Built-in
REG-010	Board-level reporting on AI risk produced quarterly with key risk indicators Board-level reporting on AI risk produced quarterly with key risk indicators	REG	None	Built-in
REG-011	Customer-facing AI disclosures and transparency notices current Customer-facing AI disclosures and transparency notices current	REG	None	Built-in
REG-012	Model documentation package exportable on demand for regulator inquiry Model documentation package exportable on demand for regulator inquiry	REG	None	Built-in
REG-013	EU AI Act technical documentation maintained per Article 11 EU AI Act technical documentation maintained per Article 11	REG	None	Built-in
REG-014	EU AI Act post-market monitoring system operational EU AI Act post-market monitoring system operational	REG	None	Built-in
REG-015	EU AI Act serious incident reporting process tested annually EU AI Act serious incident reporting process tested annually	REG	None	Built-in
REG-016	EU AI Act conformity assessment completed for high-risk systems EU AI Act conformity assessment completed for high-risk systems	REG	None	Built-in
REG-017	GDPR Records of Processing Activities (ROPA) current GDPR Records of Processing Activities (ROPA) current	REG	None	Built-in
REG-018	Data Protection Officer designated and contactable Data Protection Officer designated and contactable	REG	None	Built-in
REG-019	CPRA-required registrations and disclosures filed (where applicable) CPRA-required registrations and disclosures filed (where applicable)	REG	None	Built-in
REG-020	Colorado AI Act consumer disclosure produced (where applicable) Colorado AI Act consumer disclosure produced (where applicable)	REG	None	Built-in
REG-021	NYC Local Law 144 audit for AEDT completed (where applicable) NYC Local Law 144 audit for AEDT completed (where applicable)	REG	None	Built-in
REG-022	Illinois BIPA compliance for biometric processing Illinois BIPA compliance for biometric processing	REG	None	Built-in
REG-023	FTC Section 5 unfair / deceptive practices review for AI features FTC Section 5 unfair / deceptive practices review for AI features	REG	None	Built-in
REG-024	Insurance regulator AI bulletin compliance (NAIC Model Bulletin) Insurance regulator AI bulletin compliance (NAIC Model Bulletin)	REG	None	Built-in
REG-025	State insurance department filings for ML rating models State insurance department filings for ML rating models	REG	None	Built-in
REG-026	SEC AI disclosures in 10-K / 10-Q (where applicable) SEC AI disclosures in 10-K / 10-Q (where applicable)	REG	None	Built-in
REG-027	CCAR / DFAST stress-test model coverage documented (where applicable) CCAR / DFAST stress-test model coverage documented (where applicable)	REG	None	Built-in
REG-028	CECL allowance model SR 11-7 alignment documented CECL allowance model SR 11-7 alignment documented	REG	None	Built-in
risk_management_policy	Risk Management Policy Written, board-overseen AI risk management policy referencing applicable regulatory frameworks. AI Governance Council with explicit board reporting line.	governance	None	Built-in
SAF-001	Content safety filters enabled on all generative endpoints Content safety filters enabled on all generative endpoints	SAF	None	Built-in
SAF-002	Output classification policy mapped to use-case severity Output classification policy mapped to use-case severity	SAF	None	Built-in
SAF-003	Jailbreak attempts logged and trigger SIEM alert Jailbreak attempts logged and trigger SIEM alert	SAF	None	Built-in
SAF-004	Rate limits enforced per user and per tenant at API gateway Rate limits enforced per user and per tenant at API gateway	SAF	None	Built-in
SAF-005	PII exfiltration detector runs on model outputs PII exfiltration detector runs on model outputs	SAF	None	Built-in
SAF-006	Hallucination rate tracked per use case with eval set per release Hallucination rate tracked per use case with eval set per release	SAF	None	Built-in
SAF-007	Refusal rate tracked per content category for business-impact review Refusal rate tracked per content category for business-impact review	SAF	None	Built-in
SAF-008	Grounding score required above threshold for RAG responses Grounding score required above threshold for RAG responses	SAF	None	Built-in
SAF-009	Source citations enforced for factual claims in regulated workflows Source citations enforced for factual claims in regulated workflows	SAF	None	Built-in
SAF-010	Output language matched to user locale for regulated communications Output language matched to user locale for regulated communications	SAF	None	Built-in
SAF-011	Disallowed-topic list enforced at policy gateway pre-LLM Disallowed-topic list enforced at policy gateway pre-LLM	SAF	None	Built-in
SAF-012	Toxicity classifier reviewed quarterly for drift and calibration Toxicity classifier reviewed quarterly for drift and calibration	SAF	None	Built-in
SAF-013	External red-team exercise conducted twice yearly External red-team exercise conducted twice yearly	SAF	None	Built-in
SAF-014	Customer-configurable safety threshold available per workspace Customer-configurable safety threshold available per workspace	SAF	None	Built-in
SAF-015	Multimodal input safety classifier scans text, image, and audio inputs Multimodal input safety classifier scans text, image, and audio inputs	SAF	None	Built-in
SAF-016	Image steganography detection on uploaded images Image steganography detection on uploaded images	SAF	None	Built-in
SAF-017	Audio deepfake detection for voice-input use cases Audio deepfake detection for voice-input use cases	SAF	None	Built-in
SAF-018	Document parsers sandboxed (no formula or macro execution) Document parsers sandboxed (no formula or macro execution)	SAF	None	Built-in
SAF-019	URL-based content fetched through safe-browsing gateway URL-based content fetched through safe-browsing gateway	SAF	None	Built-in
SAF-020	Indirect prompt injection scanner runs on all retrieved content Indirect prompt injection scanner runs on all retrieved content	SAF	None	Built-in
SAF-021	Synthetic content provenance attached per C2PA / regulatory standard Synthetic content provenance attached per C2PA / regulatory standard	SAF	None	Built-in
SAF-022	Output watermarking applied for AI-generated content where required Output watermarking applied for AI-generated content where required	SAF	None	Built-in
SAF-023	Refusal taxonomy maintained and reviewed quarterly Refusal taxonomy maintained and reviewed quarterly	SAF	None	Built-in
SAF-024	Sensitive-topic policy maintained with regional / jurisdictional variants Sensitive-topic policy maintained with regional / jurisdictional variants	SAF	None	Built-in
SAF-025	Cross-language safety evaluation performed for supported languages Cross-language safety evaluation performed for supported languages	SAF	None	Built-in
SAF-026	Code-injection detection on tool-call arguments Code-injection detection on tool-call arguments	SAF	None	Built-in
SAF-027	Prompt-shield service evaluates each turn for jailbreak indicators Prompt-shield service evaluates each turn for jailbreak indicators	SAF	None	Built-in
SAF-028	Safety regression suite blocks releases below configured threshold Safety regression suite blocks releases below configured threshold	SAF	None	Built-in
SAF-029	Output filtered for self-harm and crisis indicators with escalation path Output filtered for self-harm and crisis indicators with escalation path	SAF	None	Built-in
SAF-030	Hate-speech classifier reviewed and re-trained periodically Hate-speech classifier reviewed and re-trained periodically	SAF	None	Built-in
SAF-031	Sexual-content classifier applied across modalities Sexual-content classifier applied across modalities	SAF	None	Built-in
SAF-032	CBRN content classifier blocks dangerous-uplift outputs CBRN content classifier blocks dangerous-uplift outputs	SAF	None	Built-in
SAF-033	Election-integrity content rules enforced during election windows Election-integrity content rules enforced during election windows	SAF	None	Built-in
SAF-034	Cybersecurity-misuse classifier applied to outputs Cybersecurity-misuse classifier applied to outputs	SAF	None	Built-in
SAF-035	Output style and tone constraints enforced for brand and regulatory contexts Output style and tone constraints enforced for brand and regulatory contexts	SAF	None	Built-in
sampling_parameter_change_tracking	Sampling-Parameter Change Tracking Requires tracking changes to LLM sampling parameters (temperature, top_p, top_k, seed, max_tokens, frequency/presence penalty) that materially shift the output distribution, treating such changes as governed model-change events rather than silent configuration drift. This supports SR 11-7 change management, NIST AI RMF MANAGE 4.3, ISO 42001 A.6.2.7, and EU AI Act Art. 17 quality-management obligations. EvidentAI evidences it by tagging spans where sampling.params is present, recording the active parameters per call so deltas against the approved baseline can be flagged and mapped to the frameworks as change-control evidence.	—	None	Built-in
sanctions_screening_check	OFAC Sanctions Screening Requires screening of customers, counterparties, and transactions against OFAC's Specially Designated Nationals and consolidated sanctions lists before funds move, with a recorded match disposition (clear, potential match, or confirmed hit) to prevent prohibited dealings. OFAC liability is strict, so an unscreened or mis-dispositioned transaction can trigger blocking obligations and penalties regardless of intent. EvidentAI tags spans where ofac.match_status is present, preserving the screened entity, list version, and disposition, and maps the evidence to OFAC sanctions-compliance controls and the NIST AI RMF MEASURE function for false-positive/negative oversight.	—	None	Built-in
soc2_c1_1_confidentiality_filter	SOC 2 C1.1 — Confidentiality Filter Requires that information designated confidential is filtered or stripped before it leaves the system boundary, satisfying the SOC 2 Confidentiality category criterion C1.1 (identify and maintain confidential information) so that protected data is not disclosed through model outputs, tool calls, or logs. This matters because LLM agents routinely echo or relay sensitive inputs, and an unfiltered output is a direct confidentiality breach and a reportable exception in a SOC 2 Type II audit. EvidentAI evidences it via the pii-redactor evaluator: spans where the selector matches `evidentai.confidentiality.filtered == true` are tagged and mapped to the SOC 2 C1.1 reference, producing a continuous record that the confidentiality filter ran on each governed turn rather than a point-in-time attestation.	—	PII Redactionmonitor	Built-in
soc2_cc6_8_inference_rate_limit	SOC 2 CC6.8 — Inference Rate Limiting Requires that inference access is attributed to an authenticated principal and rate-limited per principal, mapping to SOC 2 Common Criterion CC6.8 (prevent or detect unauthorized or malicious use of the system). Per-principal limiting is the control that contains credential abuse, runaway clients, and denial-of-wallet against a metered model endpoint, and unattributed inference defeats both authorization and abuse detection. EvidentAI evidences it by matching the selector `evidentai.principal` present on each inference span, confirming every call carries the caller identity needed to enforce and audit the rate limit, and tagging the span to the CC6.8 reference so the control is demonstrably exercised on live traffic.	—	None	Built-in
soc2_cc7_3_incident_capture	SOC 2 CC7.3 — Incident Capture Requires that operational anomalies and errors are detected and captured as security/incident events, satisfying SOC 2 Common Criterion CC7.3 (evaluate events to determine whether they represent a security incident). Reliable incident capture is the foundation of incident response and breach-notification timelines, and a silently dropped agent error is both an availability gap and an undetected-incident finding. EvidentAI evidences it by matching the OTel selector `span_status.code == 2` (ERROR), which both tags the span to the CC7.3 reference and triggers the finding-generator to raise an agent_error finding, giving the auditor a traceable chain from the failed span to the captured incident record.	—	None	Built-in
soc2_pi1_2_output_verification	SOC 2 PI1.2 — Output Verification Requires that processing output is validated against defined specifications before it is relied upon, mapping to SOC 2 Processing Integrity criterion PI1.2 (system processing is complete, accurate, timely, and authorized). For agentic systems this is the guardrail that a model response was schema-checked, grounded, or otherwise verified before it drove a downstream action, without which incorrect or fabricated output flows through unchecked. EvidentAI evidences it by matching the selector on the presence of `evidentai.output.validated` on each output span and tagging it to the PI1.2 reference, yielding continuous proof that output verification was invoked on governed turns rather than asserted in policy alone.	—	None	Built-in
subtree_aggregate_budget	Subtree Aggregate Budget Requires that token, cost, action-count, and wall-clock budgets be attributed to the root run and decremented across every descendant in the causal subtree — a child draws from the root's budget and never gets a fresh one, and no descendant may reset a limit set above it (req-20 R-9). This ties the cross-workflow runaway control to the AI-spend per-trace token_budget, extended from one trace to the whole initiation subtree. EvidentAI evidences it by summing usage across the descendant set keyed to the root run and raising a breach (and, in enforce mode, halting the subtree) when the aggregate ceiling is crossed.	—	None	Built-in
suitability_best_interest_check	Suitability / Best-Interest Check This control confirms that before an AI agent recommends a security or strategy, a suitability and best-interest evaluation against the customer's investment profile (risk tolerance, objectives, financial situation, and time horizon) was performed. It implements SEC Reg BI's Care Obligation and FINRA Rule 2111 (Suitability), where recommendations made without a documented best-interest basis are a core source of customer-harm and enforcement exposure. EvidentAI tags spans where suitability.checked is true, evidencing that the check ran and recording its inputs and outcome, and maps the result to retail-conduct and Care-Obligation control frameworks.	—	None	Built-in
tool_use_governance	Tool-Use Governance Requires that agent tool and plugin invocations be restricted to an approved allowlist, preventing over-privileged or insecurely designed tool access from extending the agent's reach. It maps to OWASP LLM07 Insecure Plugin Design, MITRE ATLAS AML.T0053, NIST AI RMF MEASURE 2.6, ISO 42001 A.6.2.6, and SOC 2 CC6.1. EvidentAI evidences it by tagging spans carrying tool_call.allowlisted, which record whether each invoked tool was on the sanctioned list, and maps that coverage to the frameworks so auditors can confirm tool use was gated rather than open-ended.	—	Tool-Use Governancemonitor	Built-in
TPR-001	AI vendor inventory current with subprocessors mapped AI vendor inventory current with subprocessors mapped	TPR	None	Built-in
TPR-002	Vendor security questionnaire completed per onboarding Vendor security questionnaire completed per onboarding	TPR	None	Built-in
TPR-003	DPA signed with all AI vendors processing personal data DPA signed with all AI vendors processing personal data	TPR	None	Built-in
TPR-004	AUP reviewed for AI vendor terms (training restrictions, retention) AUP reviewed for AI vendor terms (training restrictions, retention)	TPR	None	Built-in
TPR-005	Vendor SOC 2 reports reviewed annually with finding analysis Vendor SOC 2 reports reviewed annually with finding analysis	TPR	None	Built-in
TPR-006	Vendor incident notification SLA contractual (24 hours target) Vendor incident notification SLA contractual (24 hours target)	TPR	None	Built-in
TPR-007	Vendor breach exit plan documented per critical vendor Vendor breach exit plan documented per critical vendor	TPR	None	Built-in
TPR-008	Vendor financial viability assessed annually Vendor financial viability assessed annually	TPR	None	Built-in
TPR-009	Vendor concentration risk monitored at portfolio level Vendor concentration risk monitored at portfolio level	TPR	None	Built-in
TPR-010	Open-source model license compliance reviewed (Llama, etc.) Open-source model license compliance reviewed (Llama, etc.)	TPR	None	Built-in
TPR-011	Foundation model API terms reviewed for training opt-out Foundation model API terms reviewed for training opt-out	TPR	None	Built-in
TPR-012	Vendor pricing change notifications tracked Vendor pricing change notifications tracked	TPR	None	Built-in
TPR-013	Vendor model card / system card reviewed at onboarding Vendor model card / system card reviewed at onboarding	TPR	None	Built-in
TPR-014	Vendor model lineage (base + fine-tune chain) documented Vendor model lineage (base + fine-tune chain) documented	TPR	None	Built-in
TPR-015	Vendor evaluation against alternative providers (annual) Vendor evaluation against alternative providers (annual)	TPR	None	Built-in
TPR-016	Vendor lock-in risk mitigated by abstraction layer Vendor lock-in risk mitigated by abstraction layer	TPR	None	Built-in
TPR-017	Cross-border vendor transfer mechanisms in place Cross-border vendor transfer mechanisms in place	TPR	None	Built-in
TPR-018	Subcontractor approval required for critical vendors Subcontractor approval required for critical vendors	TPR	None	Built-in
TPR-019	Vendor right-to-audit clause exercised on critical vendors Vendor right-to-audit clause exercised on critical vendors	TPR	None	Built-in
TPR-020	Vendor termination data return process tested Vendor termination data return process tested	TPR	None	Built-in
TPR-021	Open-source model fine-tune output license respected Open-source model fine-tune output license respected	TPR	None	Built-in
TPR-022	Marketplace model (HuggingFace, etc.) provenance verified Marketplace model (HuggingFace, etc.) provenance verified	TPR	None	Built-in
TPR-023	Foundation model API rate-limit headroom monitored per vendor Foundation model API rate-limit headroom monitored per vendor	TPR	None	Built-in
TPR-024	Vendor model deprecation tracked and migration planned Vendor model deprecation tracked and migration planned	TPR	None	Built-in
TPR-025	Vendor outage / degradation routed via fallback model Vendor outage / degradation routed via fallback model	TPR	None	Built-in
trace_correlation_integrity	Trace Correlation Integrity Requires that trace_id and parent_span_id propagate correctly across multi-agent and multi-tool calls so a complete, unbroken execution graph can be reconstructed, with orphan spans surfaced as integrity gaps. Coherent correlation is the foundation for auditable AI behavior under NIST AI RMF MEASURE 3, ISO 42001 A.6.2.8, and SOC 2 CC7.2 continuous-monitoring criteria. EvidentAI evidences it by tagging spans that carry a present, correlatable trace_id and mapping correlation completeness to the frameworks, proving the telemetry on which all other evidence depends is itself trustworthy and traceable end to end.	—	Policy Evaluationmonitor	Built-in
transparency_disclosure	Transparency / Disclosure Customer-facing transparency: AI-use disclosure, model facts label, instructions for use, contact-a-human pathways. Pre-decision notice where required.	governance	Policy Evaluationmonitor	Built-in
vendor_supply_chain	Vendor / Supply Chain Third-party AI due diligence, contractual rights (audit, exit, IP, security), ongoing monitoring, and termination procedures for vendor models.	governance	None	Built-in
workflow_initiation_provenance	Workflow Initiation Provenance Requires that every workflow run record its initiator (the run and span that caused it, or the external trigger), its root originator (the human or trigger at the top of the chain, propagated unchanged down every hop), and its depth — so that for any action the full path from root originator through each initiation edge is reconstructable (req-20 R-1/R-2/R-3). A non-root run that cannot name its initiator is marked incomplete provenance rather than dropped. EvidentAI evidences it from the first-class workflow_run_edge initiation records and the per-run initiator/root/depth fields, distinguishing initiation (caused-by, separate run, a span link) from parent-child containment within a single run.	—	None	Built-in