Evidence
The fourth link in the chain. A control is a claim until something proves it operates; each record here names the evidence that does that and the control it belongs to.
EV-AI-TOOL-INVENTORY
verifiedA maintained register listing approved AI tools, allowed use cases, accountable owners, data limits and the next review date.
Controls
Last reviewed: 2026-09-20
EV-DATA-CLASSIFICATION
verifiedThe data classification policy plus an inventory mapping data classes to what may be shared, transformed, summarized, retained or logged in AI workflows.
Controls
Last reviewed: 2026-09-20
EV-HUMAN-APPROVAL
verifiedApproval records that bind the displayed action to the operation actually executed, with reviewer identity, timestamp and outcome.
Controls
Last reviewed: 2026-09-20
EV-IDP-CONFIG
verifiedExported IdP configuration proving SSO and MFA are enforced for approved AI platforms, together with authentication events showing the control operates.
Controls
Last reviewed: 2026-09-20
EV-INPUT-OUTPUT-VALIDATION
verifiedThe validation and sanitization rules applied to agent inputs and outputs, plus logs of blocked or sanitized requests that demonstrate the control fires.
Controls
Last reviewed: 2026-09-20
EV-MCP-CHANNEL-PROVENANCE
under reviewRecords proving the provenance and integrity of MCP channel input, the separation of telemetry and operational channels, and channel provenance alongside tool calls.
Last reviewed: 2026-09-20
EV-OFF-AGENT-AUTHZ
verifiedPolicy decision logs from the authorization gateway, including denied requests, plus hash-chain verification proving the audit log is tamper-evident.
Last reviewed: 2026-09-20
EV-PROMPT-OUTPUT-LOGS
verifiedRetention and access configuration for prompt and output logging, with sampled records that show review, monitoring and incident response are supported.
Controls
Last reviewed: 2026-09-20
Follow the chain from a risk to the control that reduces it, then to the framework that demands it, and finally to the evidence that shows the control exists. Records marked verified have been reviewed; under review records are still being validated.
