The enforcement decision is the evidence.
Connect governed actions to the decision, the human who responded and what the target confirmed — in a record your security, risk and audit reviewers can examine.
Decision records · Controls across eight framework packs · Hash-chained audit log
$12,400. One clear trail.
A permitted tool. A consequential amount. A policy that requires a human.
Explain the decision.
Find the policy that matched and the reason behind a governed action.
Make accountability visible.
The decision, the reviewer's response and the recorded outcome, together.
Bring evidence to the review.
Records mapped to named controls, exported in the format your reviewer asked for.
In the product
See the evidence record in the console.
A recorded walk through the screens behind this page: evidence collected and pending per framework, each item mapped to a framework control, an audit entry that carries its own hash and the previous entry's hash, and the export of the record for any time range.
Evidence, step by step
Real product screens from a demo tenant with seeded activity. Nothing was collected, exported or changed while recording.
One policy. A traceable history.
Follow a policy from assessment to production decisions and the evidence they create. When the rule changes, its versions keep the history.
Assessed before release
Agent snapshot evaluated against the policy.
Approved by an owner
Reviewed rule, recorded authority, signed and versioned.
Applied to an action
The decision at the action boundary, with its reason and context.
Linked to the response
Human review, recorded in order.
Ready for scrutiny
Control references, coverage status and exports an assessor can take away.
The same policy identity through every stage. Decision records name the policy that matched, not yet its revision.
Follow a decision. Not a pile of logs.
Start with one refund. See the policy, the human response and the execution status together. Then edit a record and watch the chain refuse to reconcile.
- 1
Policy revision activated
Refund oversight · v14
- 2
Decision at the action boundary
HOLD · $12,400 · finance review above 10000
- 3
Review requested
Finance approver · pending
Held before dispatch.
The amount exceeds the policy threshold. Finance approval is required, and the refund is not dispatched.
- Amount
- $12,400.00
- Destination
- Original payment method
- Policy
- refund-oversight
- Reviewer
- Finance approver requested
- Target receipt
- No receipt
Inspect ledger entries
{
"sample": true,
"schema": "governorai-marketing-example-v1",
"scenario": "held",
"edited_sample": false,
"hash_method": "SHA-256 over canonical JSON (sorted keys)",
"verification_scope": "displayed_sample_only",
"sample_state": "ready",
"verification": null,
"entries": [
{
"sequence_number": 1,
"timestamp": "2026-03-04T09:00:00Z",
"action": "policy.revision.activated",
"data": {
"policy_id": "refund-oversight",
"revision": 14,
"owner": "finance-controls"
},
"prev_hash": "0000000000000000000000000000000000000000000000000000000000000000",
"entry_hash": "bdacfa7dbec619e65a90c60a16a1bbccb3ab450e1d1d7739c39ba993e1f0b039"
},
{
"sequence_number": 2,
"timestamp": "2026-03-04T09:12:44Z",
"action": "policy.decision",
"data": {
"decision": "HOLD",
"tool": "support.issue_refund",
"amount_usd": 12400,
"destination": "original_payment_method",
"rule": "finance_review_above_10000"
},
"prev_hash": "bdacfa7dbec619e65a90c60a16a1bbccb3ab450e1d1d7739c39ba993e1f0b039",
"entry_hash": "0144576dd44c9ebad086b965559b851b84f6b8b6715ed40651ac03b6ba92a635"
},
{
"sequence_number": 3,
"timestamp": "2026-03-04T09:12:45Z",
"action": "approval.requested",
"data": {
"approver_role": "finance-approver",
"status": "pending"
},
"prev_hash": "0144576dd44c9ebad086b965559b851b84f6b8b6715ed40651ac03b6ba92a635",
"entry_hash": "cbe21aaadf3c39bb2f4004989de7a98b4daf819548d3dda435f1551f6f247030"
}
]
}Name the regulation. Here is what naming it gives you.
Each row is a surface in the product, described by what a GRC team gets from it.
- EU AI Act
- Register an AI system, score a risk tier from unacceptable to minimal, and track obligations against a library that names Articles 6, 9–16, 26, 50 and 52. Human-oversight configuration, transparency records and bias reports attach to the same record.
- Colorado AI governance
- Organise system records, impact documentation, mitigation, human review, consumer notices and supporting evidence in one programme workspace.
- ISO/IEC 42001
- 32 controls of the AI management system, mapped, each with a coverage status and, where the standard asks for organisational evidence, the named fields you attest by hand.
- NIST AI RMF 1.0
- All 72 subcategories across GOVERN, MAP, MEASURE and MANAGE, 13 backed by live evidence and the rest structured for attestation, with per-control coverage, contributing system signals and named attestation fields.
- NIST SP 800-53 Rev 5
- The same assessment runs, findings and per-control attestation, for agent programmes that answer to an existing federal catalogue rather than a new AI-specific one.
- SOC 2, HIPAA, PCI DSS
- Controls scored live from system state — audit volume, active policies, alert rules, registered agents — with cross-framework references so evidence gathered once can be pointed at its counterpart.
- GDPR
- Right-of-access exports, erasure with an explicit confirm step and legal-hold gating, consent grant and withdrawal, retention policies and data-residency configuration.
We show you the gap before your auditor does.
For applicable controls, see whether the evidence comes from a system signal, a person or both — so the review starts with a list rather than a surprise.
A control is never marked automatic while any part of it still needs a person to attest. ISO/IEC 42001 is a management-system standard and NIST AI RMF a voluntary risk-management framework; both ask mostly for organisational evidence, so the packs name the clauses and fields that need your attestation, up front.
A live GovernorAI signal evidences the control on its own — the decision record, the approval, the kill switch.
A GovernorAI signal contributes and a person supplies the rest. The control is not claimed as covered.
The control asks for documented procedure or management commitment. The pack names the fields so nothing is discovered in the audit.
Integrity, attestation and reporting — built in, not bolted on.
Take verifiable proof with you
Signed evidence bundles — Ed25519 signatures and Merkle batch manifests sealed in the gateway, where a deployment enables signing — that a reviewer verifies against the deployment's public keyring through GovernorAI's verify endpoint. The offline verifier for decision evidence records is built but not yet released to assessors.
per deployment · dedicated key storeScore controls from what actually ran
SOC 2, GDPR, HIPAA and PCI DSS controls scored from real system state, not a questionnaire. Each resolves to pass, fail, partial or not assessed.
computed from the governed-action recordPut an owner on the next step
Recurring campaigns assign each policy owner a task, a due date and a decision, with escalation, overdue tracking and a per-policy history.
campaigns · tasks · historySend the report reviewers need
Per-framework exports in PDF, JSON, CSV or HTML over any date range, with a preview of every section and its evidence before the job runs.
pdf · json · csv · htmlReuse evidence across reviews
Cross-framework control references point evidence gathered for one control at its counterparts in SOC 2, GDPR, HIPAA and PCI DSS, with the rationale attached.
seeded mappingPreserve records under hold
Place an account-, subject- or resource-scoped legal hold. Erasure is gated by the registry and fails closed: if the gate cannot prove there is no hold, nothing is erased.
api · retention-policy flagKeep your GRC program. Add the evidence behind the agent.
GovernorAI does not replace your policy authority or your review process. It evaluates the same policy at the action boundary and hands back action-level evidence your teams bring into the workflows they already run.
- Keep an existing OPA server and approval flow. Policies run in GovernorAI's native engine or OPA/Rego — side by side, per policy.
- Exports land in your GRC tool of record as per-framework evidence, not as another dashboard to reconcile.
- Owners attest inside the campaign, so the organisational evidence a standard asks for sits next to the technical evidence the record supplies.
Ready for a closer look?
What makes this more than an activity log?
The connection to governance: the specific action, the policy and rule that matched, when one did, the reason, any human response and the execution status at the target. Control references make that history useful to reviewers outside the engineering team.
Can a reviewer verify the evidence without trusting the dashboard?
Yes. Chain verification walks the ledger from genesis and names the first row that does not reconcile. Deployments that enable evidence signing also produce Ed25519-signed bundles with Merkle batch manifests, which a reviewer verifies against the deployment's public keyring through GovernorAI's verify endpoint; the offline verifier for decision evidence records is built but not yet released to assessors.
How does a record become compliance evidence?
Framework packs map records to named controls, each with a coverage status. Owner attestations supply the organisational context the standard asks for. The result supports your assessment; it is not a certification.
What is stored in the ledger?
Governance actions only: the decision, its reason and context, approvals, overrides and execution receipts. Approval requests keep the tool-call arguments a person is asked to approve.
Do we have to replace our existing tools?
No. Keep the policy ownership and review processes you use today. GovernorAI adds policy-linked action evidence and per-framework exports that your security and audit teams bring into their existing workflows.
Start with one consequential action
Your next AI review. Bring the evidence.
Bring one consequential workflow to a briefing. We walk through the decision, the policy that matched, the human response and the evidence your security and risk teams will need. Design partners get a six-week evaluation of that one workflow, with named success criteria.