01 / SECURITY
Protect the AI system.
Source analysis, runtime security testing, agent and tool exposure, data paths and MCP or tenant-boundary risks.
Explore HAIEC AI Security ↗DETERMINISTIC AI ACTION ASSURANCE
Your AI passed security. Who authorized the decision?
AI security protects what agents can reach. Governance defines what they should be allowed to do. HAIEC Assurance connects those findings with qualified evidence to establish what can be defended, what remains uncertain, and what the accountable team should do next.
One consequential action. Independent evidence views. A bounded, inspectable evaluation.
Authority ≠ Access
HAIEC / ASSURANCE DECISION
When individual checks look complete.
01 / SECURITY
Source path found
Refund API is reachable in code
02 / GOVERNANCE
Policy in context
Refunds allowed within defined scope
03 / AUTHORITY
Choice unproven
Recipient selection not established
BOUNDED ASSURANCE OUTCOME
Review the delegated choiceREVIEW
Deterministic rules evaluate qualified evidence.Inspect the supporting facts →
05
Independent evidence viewsRequested, policy, granted, code and observed
DAI
Delegated Action IntegrityThe authority behind consequential choices
01
Defensible decision recordFinding, evidence, gaps and next action
THREE COMPLEMENTARY DISCIPLINES
Security protects. Governance directs. Assurance establishes the decision.
HAIEC has capabilities across all three. Assurance draws on each relevant source without pretending a passed scan or documented policy answers every consequential question.
02 / GOVERNANCE
Define the authority.
Operating boundaries, policy decisions, approvals, delegated discretion and accountable human ownership.
Explore HAIEC Governance ↗03 / ASSURANCE
Defend the decision.
Compare what was requested, authorized, granted, code-capable and observed. Apply deterministic evaluation, reveal proof gaps and record the result.
Explore the assurance decision →Security and governance produce important facts Assurance evaluates the relevant evidence
INTERACTIVE / CONSEQUENCE LAB
One action. Several kinds of proof. One decision to defend.
Choose an AI action, inspect the evidence and see why a valid tool call can still leave a consequential question unresolved.
Interactive example · choose an industry
01 / Trace the consequential actionSource → Tool → Effect
Customer support refund agent
Change the destination of a small refund
Support agentRefund toolPayment API
SOURCE CAPABILITY
The AI can reach a refund operation.
The available source path supports a possible refund API call. That is a finding worth investigating even before other evidence has been connected.
STEP 1 / 4
02 / Inspect the five evidence viewsIndependent, not sequential
Requested action
ESTABLISHEDThe support agent was asked to correct a billing error. A correction request does not inherently authorize the agent to select a new recipient.
Evidence question: What was requested, by whom and for which target?
Delegated Action Integrity: authorization to use an API is separate from authority to choose the business consequence. Explore DAI ↗
THE HAIEC ASSURANCE MODEL
Five independent views. No guessed connections.
A security scan can establish a code-capable route. IAM can establish a qualified grant. Policy can establish a permitted boundary. Runtime evidence can establish an observed action. None silently proves another.
DAI compares the consequential choice.
It tests the relationship between available delegation facts, approved scope and actual capability or activity. It is a comparator, not a sixth evidence plane.
The deterministic evaluator produces a bounded answer.
Explore HAIEC Evidence and Provenance →Qualified evidence, applicable rules and proof limits determine the recorded conclusion. AI can operate the workflow, but it does not author the canonical verdict.
The five views are independent analytical questions, not five mandatory collection steps. This diagram illustrates the evaluation model.
WHAT THE CUSTOMER ACTUALLY RECEIVESNot a mysterious score.
View actual sample reports ↗Not a mysterious score.
A decision with reasons.
Assurance makes the consequence, supporting facts, gaps and accountable next step inspectable in one scoped record.
EXAMPLE / ASSURANCE DOSSIERCan the agent choose a new refund recipient?
01 / ESTABLISHED
What we can support
A code-capable refund path and a limited operating policy are visible in the scenario. Neither alone proves delegated recipient selection.
02 / PROOF FRONTIER
What remains to establish
Which approved person or policy authorized the agent to choose a different recipient, and what did the target system actually execute?
03 / NEXT ACTION
Who should resolve it
The accountable business owner provides the delegation decision; the team then evaluates qualified evidence within fresh scope.
Evaluation dispositions express bounded conclusions. A BLOCK disposition does not, by itself, mean the transaction was stopped at the target.
EVIDENCE STATES ARE PART OF THE RESULT
Established
The evaluated evidence supports the statement within the stated scope.
Partial
Only part of the relevant relationship, path, or evidence surface is established.
Unknown
Available evidence cannot support a stronger conclusion.
Not Assessed
That evidence family was not evaluated in this scope.
BOUNDARIES THAT STAY HONEST
A control being listed is not a control being proven. HAIEC separates cataloged expectations, relevant controls, evidence actually evaluated, contradictions and missing proof. A control count is not a coverage score. Explore Controls and Evidence →
Source Reachability is adjacent context. It helps explain supported relationships among agents, tools, handlers, resources and evaluation surfaces. A source-capable path is not an observed action; a credential reference is not an effective grant; missing runtime evidence is not proof that an action did not happen.
Agent-driven does not mean agent-decided. Interface automation changes how the workflow is operated. It does not change the evidence semantics or assign the Assurance disposition.
FROM A QUESTION TO AN ACCOUNTABLE DECISION
Assurance fits the way enterprises actually work.
Choose the evidence and assessment appropriate to the system and the decision. These are common activities, not a mandatory sequence for every evaluation.
Identify the consequential action
Start with a source-visible path, connected system or specific authority question that matters to the business.
Bring qualified evidence
Use eligible code, policy, access, identity, control and runtime evidence. Preserve missing and partial coverage.
Evaluate the exact claim
HAIEC applies selected deterministic rules to the evidence and reports an explicitly scoped conclusion.
Review, verify and revisit
Give the owner a report and next action. Verify supported artifacts and reassess as relevant evidence changes.
AI-ASSISTED WORKFLOW, DETERMINISTIC VERDICT
Run HAIEC AI Assurance
Connect a compatible AI coding assistant through authenticated MCP. The agent can preflight and operate approved evaluations. HAIEC determines the evaluation.
Run HAIEC AI AssuranceEndpoint https://www.haiec.com/api/mcp. Connection and authorized scope are required. A read-only preflight checks organization, system, source, role and consent eligibility; writes and active testing require explicit approval.
QUESTIONS BUYERS ASKClear answers.
Clear answers.
Defined limits.
Assurance is strongest when every conclusion says exactly which evidence supports it.
Is assurance just security plus governance?
Security and governance contribute important questions and evidence. Assurance evaluates relevant facts, authority, actual capability and observation to reach a scoped conclusion. It is not a simple sum or an additional scanner.
Can a security scan establish delegation?
Not by itself. A scan can establish code-capable behavior within its scope. Delegated discretion requires appropriate policy or human authority evidence.
Does unknown evidence mean the system failed?
No. Unknown means the available evidence cannot establish the claim. It is different from a verified violation and different from a passed check.
Is a HAIEC ALLOW disposition a guarantee of safety?
No. ALLOW is a conclusion within the evaluated scope and qualified input only, not universal safety or target-side enforcement.
Does a HAIEC BLOCK outcome automatically stop the action?
No. The outcome records an evaluator disposition. Target-side enforcement requires a separately connected and supported control with evidence of its actual operation.
Can I start without connecting every data source?
Yes. Supported early findings, such as a source-visible consequential path, can be valuable. The depth of the subsequent assurance conclusion depends on the evidence needed for the chosen claim.
HIGH ASSURANCE IN EVERY CONSEQUENCE
Scope an Enterprise Assurance POC ↗Make your next AI decision defensible.
Start with one AI system, one consequential action and the evidence needed to decide responsibly.