01 / Defined
Cataloged
What control objective exists? This does not mean the customer’s system implements it.
HAIEC Assurance Controls & Evidence
Don't just list AI controls. Know what they actually establish.
HAIEC connects consequential AI action paths with control questions, source-backed findings, recorded evaluations and operating evidence. Know when a control is merely cataloged, when a risk has been found, what was actually tested and when a safeguard's effect has been verified.
Find the risk early. See the control evidence. Make an accountable decision.
Deterministic AI Action Assurance · Source-specific findings · Exact limits of proof
The control question enterprises actually need answered
Having a control isn't the same as knowing it worked.
Compliance mappings describe expectations. A visibility finding concerns a specific source and control objective. A recorded test describes an actual evaluated scope. A protection claim requires evidence that the control really operated. These are different facts, and HAIEC helps teams keep them straight.
02 / Source
Visible
What does an eligible source or bounded scan actually establish, and for which control?
03 / Test
Evaluated
Was an actual control test performed with applicable scope, approvals and recorded result?
04 / Effect
Operating
Did a connected target-side control trigger or mediate an action, supported by effect evidence?
Cataloged ≠ Implemented ≠ Evaluated ≠ Effective. This isn't a mandatory four-step gate for displaying an earlier meaningful source finding.
Interactive customer story
One AI action. Different levels of control evidence.
A support agent can reach a refund recipient-changing handler. The first technical exposure is already useful. Inspect what different source and test facts could establish about the relevant control question.
Control Assurance InvestigationIllustrative · not a live evaluation
Stable technical context
Possible refund-recipient path
Explore an agent to tool to handler to API path. The technical exposure is not erased when a narrower control-specific comparison has additional evidence needs.
- Code source
- Possible path found
- Business consequence
- Change payment recipient
- Actual payment
- Not represented
FIRST PASS / SOURCE RISK
A consequential code path merits investigation.
The source shows possible reach. Without an exact matched control comparison, call this a candidate exposure, not a confirmed Control Visibility DETECTED_FINDING.
- Control visibility
- Not established for this objective
- Recorded Control Test
- No result shown
- Operating effect
- No effect witness
Practical next action
Investigate recipient selection and compare the exact source path to approved policy.
The canonical HAIEC assurance catalog
Controls organized around what consequential AI systems can cause.
This is HAIEC's separate system-oriented assurance catalog, not a second copy of the regulatory framework mapping registry. Catalog coverage is a product design inventory; it is not a claim that every test or real-world safeguard is active.
45Total catalog entries: 42 profiles plus 3 specialized tests
15Launch-priority entries; planning designation, not activation
11Control visibility projections implemented in the reviewed source, not 11 native tested safeguards
G / GOVERNANCE & LIFECYCLE
What policy and lifecycle controls should exist for this AI system?
Operating boundaries, organization ownership, review processes and change governance can inform a concrete consequence decision.
Representative catalog question
Are high-impact agent actions subject to a defined, accountable operating boundary?
Family examples are editorial representations; actual family IDs and active control IDs come from the HAIEC source manifest. Explore your organization's system-scoped controls in the HAIEC workspace.
Visibility is useful, but it isn't a test verdict
Know what a control finding is actually saying.
HAIEC's Control Visibility read model distinguishes four specific states. It should show useful technical leads and what each assessed control question supports, without inflating a scan into proof of safety or protection.
DETECTED_FINDING
An exact relevant control issue was detected.
A confirmed, fully semantically matched observation supports the selected control objective within its evaluated basis.
Meaningful next action
Investigate the finding source, exact policy, identity, action scope and possible business effect.
Visibility ≠ Control Test verdict ≠ Canonical Assurance evaluation.
Findings-first principle
A source-visible possible action path can remain a useful candidate while control-specific visibility coverage is insufficient. Label it as an investigation lead, never falsely as a confirmed matched Control Visibility finding.
Proof is a journey, not a badge
From a catalog question to the evidence of what operated.
The HAIEC Control Proof read model can connect existing owners for visibility, source evidence, TestSpecs, approvals, recorded results, replay and response workflows. The presence of an entry or a workflow does not invent any missing test, approval, execution or target effect.
Control question
What should this scope establish?
Visibility & evidence
Which source and scan support a finding?
Test & result
Was a real authorized test recorded?
Operation & effect
What actually triggered or changed at the target?
Evidence quality
Versioned facts, not impressions
Source, identity, time, coverage, policy basis and exact test or record version matter. A hash binds an artifact; it cannot prove the business effect.
Approval and replay
A recorded decision isn't enforcement
An approval or replay can establish a bounded governance or consistency fact. It does not automatically establish that a customer-side execution point honored it.
Real operating proof
Don't infer the block
To claim prevention, verify an installed mediation path, trigger, action and relevant target or effect witness. "Control available" isn't "control worked."
Five independent evidence views
Requested
Policy Authorized
Effectively Granted
Code Capable
Observed
Delegated Action Integrity (DAI) compares relevant authority behind consequential choices across available evidence, not as a sixth sequential plane. A qualified fact in one view remains useful even if another view has a specific open question. Explore DAI · Explore methodology
Fits your security and AI engineering workflow
Use the AI agent to operate. Let HAIEC evaluate.
With a compatible MCP-enabled IDE or assistant and an authorized scoped key, your agent can request HAIEC source analysis and eligible assurance workflow steps. HAIEC owns the canonical evaluation. Registered control-focused tools must be checked for tenant availability before claiming an actual executed test.
Connect HAIEC MCPRun HAIEC AI Assurance
Four-word instruction: Run HAIEC AI Assurance. Endpoint: https://www.haiec.com/api/mcp.
HAIEC · MCP clientMCP workflow
You: Run HAIEC AI Assurance → haiec_preflight Check access, source eligibility and scope → Analyze supported source/action capability Potential consequential path → investigation lead → Eligible assurance or control evidence lookup Exact relevant scope and permissions → Inspect findings and available recorded result What is supported? What should happen next? The AI guides the workflow. HAIEC owns the bounded evaluation.
A registered tool name alone does not establish customer entitlement, installed protection, a completed control test or universal IDE compatibility.
Frequently asked questions
Know the difference between a control and its proof.
What are HAIEC Assurance Controls?
A system-oriented catalog of bounded control questions around agent authority, application and tool security, runtime consequences, governance, evidence, LLM reliability and responsible AI. The catalog itself does not mean every control is active, tested or effective.
How is this different from the existing Controls and Framework Registry?
The /controls page browses mapped regulatory and framework requirements. HAIEC’s assurance catalog is a separate system-focused inventory for assessing what supported evidence and tests establish about consequential AI actions.
Does listing a control mean it was deployed or worked?
No. Catalog definition, visibility implementation, recorded test result and proven target-side operating effect each answer different questions.
Can HAIEC find meaningful risks before all evidence sources are connected?
Yes, for eligible source-based technical findings. A reachable consequential handler or candidate exposure can be worth investigation while IAM, telemetry or control test evidence is incomplete. Specific stronger verdicts require their own applicable basis.
What does “no finding observed” prove?
Only that no matching finding was observed within the specific completed and qualified scan scope. It does not prove that no risk exists or that any runtime protection operated.
Is a Control Visibility state the same as a Control Test verdict?
No. Visibility is a bounded read projection. A Control Test needs an actual eligible execution and persisted result. HAIEC’s canonical Assurance evaluation is another distinct claim type.
What does a recorded Control Test prove?
It establishes the recorded test’s bounded conclusion under its frozen policy, test contract, evidence and scope. It does not automatically establish continuous production enforcement.
How do you demonstrate an AI control really operated?
Verify an integrated target-side decision or mediation path and relevant trigger and effect records. A declaration, approval or integrity hash is not proof that an external target was blocked.
How many controls are available?
The reviewed source has 45 total catalog entries: 42 profiles and three specialized tests. Fifteen are tagged launch priority and 11 IDs have Control Visibility projection support. These numbers do not mean 45 runnable production protections.
How does DAI relate to assurance controls?
Delegated Action Integrity addresses whether a consequential choice falls within supported delegated authority. It can inform applicable control questions alongside the independent policy, granted, code-capable and observed evidence views.
Do I have to upload policies or runtime logs before HAIEC can discover an issue?
No blanket upload requirement should suppress supported source-based findings. Evidence is connected as needed for the exact question, test or operational effect being claimed.
Can my AI agent use HAIEC controls through MCP?
A compatible configured MCP client can guide authorized HAIEC workflows. Actual control-specific MCP tool availability, entitlements, system and source eligibility and permissions must be verified; a public demo cannot authorize execution.
High assurance in every consequence
Know which AI controls have evidence, and what to do next.
Start with findings you can investigate. Connect the control questions and evidence needed for consequential decisions. Distinguish the claim that a control exists from proof that it was evaluated and actually operated.
Enterprise control assurance
One consequential system. One important question.
Discover the relevant agent, tool and authority paths, investigate evidence-bearing control questions and produce an accountable scoped decision readout. Expand only when the business question and connected sources call for it.
Learn about HAIEC Assurance