01 / 12
H
HAIEC
Enterprise Capability Brief · 2026
High assurance in every consequence

Know what your AI can do.
Control what it should do.
Prove what happened.

HAIEC is an AI security, assurance & governance platform. It connects discovery, deterministic evaluation, human decisions, operational monitoring, and verifiable evidence into one lifecycle — from code to consequence.

Reduce exposure
Find excessive privileges, unsafe AI actions, and control gaps before they cause harm.
Accelerate deployment
Give engineering and security a defensible basis for faster release decisions.
Maintain control
Establish approved boundaries, detect drift where telemetry exists, coordinate responses.
Strengthen audit
Turn scattered technical findings into structured, reusable evidence for reviewers.
Protect operations
Reduce likelihood and impact of unauthorized AI actions touching money, data, or critical processes.
Technical capability & control annex ↗ Reference tables A–F ↗ Scope an enterprise POC ↗ 12-slide brief Companion: Technical Capability & Control Annex Manufacturing examples use synthetic evidence; operations are illustrative
HAIEC · Human AI Evidence Company · haiec.com 01 / 12
The problem02 · Fragmented security
The problem

Your security tools each answer critical questions. HAIEC helps reconcile what an AI is authorized to do with what it can and does do.

What your stack answers — separately

IAM & Access
Who can authenticate. Not: is this business action authorized?
AppSec & CI
What code can reach. Not: is the reachable capability approved for this system?
SIEM & Monitoring
What events occurred. Not: was what occurred permitted to occur?
GRC & Framework
What policy exists. Not: did the AI actually operate inside it?
Model Guardrails & Firewalls
What the model says. Not: what tools it invokes or what target gets affected.
The authority gap
An AI agent can be correctly authenticated and still act outside its intended business responsibility.
A refund agent may be instructed not to issue large refunds, while its API credential permits much larger transactions. A quality agent may be authorized to update one work order, while its credential can update any work order in the plant. The controls work as configured. The authority-to-action is not intact.
HAIEC's premise: the difference between access permission, technical capability, delegated authority, and actual behavior is where consequential AI risk lives.
You already have IAM, AppSec, SIEM, GRC. HAIEC doesn't replace them. It reconciles their evidence around the AI system and its authorized actions — the question none of them was designed to answer alone.
HAIEC · Enterprise Capability Brief 02 / 12
The platform03 · Operating model
The platform

Three pillars. Six independent jobs. One evidence spine.

01 · UNDERSTAND

Discover the estate

AI systems, agents, tools, MCP servers, APIs, cloud resources. Ownership, environment, source modes, supply-chain provenance, provider usage where attributable.

02 · ASSURE

Evaluate evidence

Five independent evidence planes. DAI orthogonal authority comparison. Deterministic dispositions. AI AppSec, MCP isolation, runtime probes, control tests.

03 · GOVERN & OPERATE

Decide and prove

Human approval, receipts, runtime monitoring, drift signals, response coordination, incident investigation, verification.

Six independent customer jobs — each answerable on its own

🔍
Discover
Agents, tools, targets
🛡️
Evaluate
Security & authority
✅
Authorize
Human decisions
👁️
Monitor
Drift & telemetry
🛑
Protect
Guard & respond
📋
Verify
Receipts & audit
What HAIEC is not: not a model firewall · not a prompt filter · not a compliance checkbox · not a replacement for IAM, SIEM, AppSec, or GRC. It is the assurance layer that reconciles what those tools were not designed to compare.
HAIEC · Enterprise Capability Brief 03 / 12
Security & detection04 · Security packages
Security, detection & adversarial testing

Four AI security capability areas, each with distinct evidence requirements and delivery boundaries.

AI AppSec
Separate package
Static analysis of AI application code: unsafe AI-output execution, prompt/RAG trust boundaries, exposed secrets, insecure API usage, AI-specific vulnerabilities.
122 detectors · 79 security checks · runs independently; feeds SaaS assurance only when integrated
MCP & tenant isolation
Separate package
Static analysis for multi-tenant data boundaries, query isolation, session/cache scope, and MCP server exposure — the AI-specific boundary risks IAM alone does not test.
57 deterministic rules (42 tenant · 15 MCP) · static detection ≠ proven exploit
Runtime adversarial testing
Opt-in · authorized endpoint
Empirical probing against an authorized AI endpoint for prompt injection, jailbreak, info leakage, role confusion, and attempted tool forcing. Bounded findings, not passive monitoring.
Requires operator consent · model claim ≠ tool execution ≠ external effect
LLMVerify · 38-rule CSM6 control set
Specialized package
Structured evaluation of AI output quality and safety — hallucination risk, grounding, sensitive output, structured consistency, and unsafe content signals.
Package boundary preserved · not merged into the core detection registry
Threat-taxonomy references — mapped, not certified
OWASP LLM Top 10 (2026 · Aug 4 release) OWASP Agentic Top 10 (2026) MITRE ATLAS NIST AI RMF
Taxonomy references are used to organize checks — not to imply full coverage or validated mitigation. Full OWASP Agentic, LLM 2026, and ATLAS rule-level crosswalk, with per-threat executable / partial / held status, is in the Technical Annex. Note: the OWASP LLM Top 10 2026 update renumbered categories — for example, Excessive Agency now maps to LLM03.
Static detection is a claim about a file, not an exploit. A source-code finding becomes an assurance finding only when it is part of a qualified evaluation scope. Empirical runtime testing is opt-in and produces bounded findings — not continuous passive detection.
HAIEC · Enterprise Capability Brief 04 / 12
Assurance & authority05 · Deterministic evaluation
Assurance & authority

Five independent evidence planes. DAI as a separate authority comparison. Deterministic result at every step.

01
Requested
What the AI system asks to do.
02
Policy-authorized
What the business permits.
03
Effectively granted
What credentials allow.
04
Code-capable
What code can reach.
05
Observed
What runtime evidence shows.

Comparison, not sequence

The five planes are independent assertions. HAIEC does not require them to be supplied in order, and does not require all five to reach a finding. A single-plane evaluation is valid — it names fewer established facts.

The mismatch is the finding. Requested but not policy-authorized → policy gap. Policy-authorized but not effectively granted → provisioning gap. Effectively granted but not code-reachable → dead privilege. Code-reachable but not observed → latent exposure.

DAI — nine orthogonal dimensions

OPERATION
action semantics
TARGET
resource or entity
SCOPE
tenant / boundary
MAGNITUDE
amount / volume
DURATION
time window
APPROVAL
human authority
DATA_CLASS
sensitivity tier
ENVIRONMENT
prod / staging
GEOGRAPHY
jurisdiction
Deterministic engine — nothing bypasses a step
Claim
What the profile asks
Scope
Sources, analyzers, window
Qualify
Binder, digest, identity
Finding
Rule evaluated
Disposition
Scoped ALLOW/REVIEW/BLOCK
Receipt
Frozen, replayable
Disposition is not authorization. ALLOW / REVIEW / BLOCK is scoped to what was evaluated. It is not permission to deploy. It is not a certification. It is not a runtime enforcement action.
The proof frontier is always visible. Every evaluation ships with an explicit NOT_ASSESSED list. Missing evidence is never scored as zero risk. Frontier items name what would close them.
HAIEC · Enterprise Capability Brief 05 / 12
Verified case06 · Manufacturing Station 217
Verified evaluated case · SYS-217

Wrong-target divergence on a synthetic manufacturing estate. The assessment is real. The operating response is simulated — and labeled so.

Wrong-target divergence SYS-217 SYNTHETIC_LAB MFG-EFF-001
◐ Assessed · persisted evaluated evidence
◇ Simulated · browser-local illustration
1
Declared: target WO-217-4802 in operating envelope
2
Dispatched: mes.work_order.update
3
Observed effect: readback names RESOURCE:WO-217-4803
4
Finding: MFG-EFF-001 wrong-target
5
Result: OBSERVED_OUTSIDE_DELEGATION · REVIEW
Persisted evaluation · digest-verified · 45 current canonical cases
6
Attempt: DEMO-GW-SYS-217-02
7
Hold: synthetic demo gateway pauses the write
8
Review: fictional Quality approver (demo character)
9
Advisory work: permissible paths continue locally
10
Monitor: simulated MES / ERP / equipment state
Illustrative only · no production MES integration claimed

DAI comparison · nine dimensions

1 mismatch · 7 not observed
DimensionDelegatedObservedStatus
OPERATIONwork_order.updatework_order.updateMatch
TARGETWO-217-4802RESOURCE:WO-217-4803Broader
SCOPEPLANT-A/WF-QUALITY—Not observed
MAGNITUDE40—Not observed
APPROVAL(envelope)—Not observed
DATA_CLASSSYNTH_MFG_LAB—Not observed
ENVIRONMENTSYNTHETIC_LAB—Not observed
DURATION and GEOGRAPHY not populated in this evaluation. — means no observed value — not that it matched. Blank cells are labeled explicitly.

Corpus scale (manufacturing demo)

9 synthetic AI systems
45 current evaluations
27 historical evaluations
9 wrong-target findings
18 receipt-bound R01 witnesses
Two lanes, two truth classes. A real evaluated wrong-target finding precedes a subsequent simulated hold. The factory-enforcement behavior is browser-local illustration. R01 witness satisfaction establishes eligible effect evidence — not that the action was authorized.
The API succeeded. The business action was still wrong. Every existing tool in the stack would have seen a legitimate work-order update — only HAIEC compared the declared target to the recorded effect and named the divergence. The finding is real. The operating response is a demonstration of what could be wired next.
Source · HAIEC manufacturing demo (synthetic evidence, real evaluation) 06 / 12
DevSecOps07 · CI/CD & release
DevSecOps & release governance

Four separate facts about a release. Never collapsed into one gate status.

Code diff
PR opened → source analyzed
GitHub App static analysis on changed files. Full-tree coverage requires full scan.
Static evidence
AI AppSec · secrets · dependencies
Findings at scan scope. Package attribution preserved. Not automatically qualified.
Assurance
Deterministic engine · scoped disposition
ALLOW / REVIEW / BLOCK over the qualified evaluation scope. Not a deployment decision.
Human approval
Named reviewer · digest-bound record
Separation of duties. Approval is a decision about the scope. Not execution.
CI gate
Independently configured pass/fail
CI gate is a pipeline policy. Not the engine disposition. Not the human approval.
Ready
GitHub App full executor on linked installations. Full static + PR comments + qualified evidence.
Held
GitHub Action v2 pending reconciliation. v1 PAT flow is deprecated. Do not build new workflows against v1.
Preview
Local/CI bundle path. Bounded coverage by bundle contents. Full static requires complete source tree.
CI_RESULT ≠ ASSURANCE_ENGINE_DISPOSITION ≠ HUMAN_APPROVAL ≠ DEPLOYMENT_BLOCK. A CI gate passing does not mean HAIEC evaluated or approved the broader system. A REVIEW disposition does not automatically block a pipeline. Building a release process on the wrong fact produces the wrong outcome at exactly the wrong time.
HAIEC · Enterprise Capability Brief 07 / 12
Operations08 · Runtime monitoring
Production monitoring & drift

Baseline vs current, with source health visible. An anomaly is not a breach.

Illustrative monitoring example. All source times, token values, tool counts, alerts and decisions below are fictional, not live HAIEC customer telemetry.
Source health
GitHub App1h
OTLP collector12m
IAM observer6h
SBOM1h
Endpoint probeN/A
A stale source cannot establish current coverage for that source; other connected sources may still alert. That is not "no incidents" — it is "no detection." Never shown as green.
Drift · baseline vs current
DATA_CLASS mix
baseline "standard" → now "includes_pii"
Tokens / request
baseline 1.2K → now 1.8K
Tool inventory
baseline 12 → now 14
Tool calls / turn
baseline 2.1 → now 2.8
Approved scope
baseline "unchanged" → now unchanged
Recent signals
14:22refund.create $247.50Allowed
14:21session.read (standard)Allowed
14:18customer.read (standard)Allowed
14:15refund.create $1,840 (no matching grant)Denied
14:12invoice.reconcileAllowed
14:08tool.lookup (unregistered)Watched
What monitoring establishes: a qualified signal was observed at a specific time, from a specific source, against a specific baseline.
What monitoring does not establish: that a breach occurred. That an alert was acknowledged. That the source was complete or continuous.
HAIEC · Enterprise Capability Brief 08 / 12
Protection09 · Guardrails & response
Protection, guardrails & incident response

Guard code exists. Native adapters are per-target. Dotted arrows are honest.

The six-state intervention lifecycle

🔔
Alert
SHIPPED
👤
Human auth
SHIPPED
📤
Dispatch
PER-TARGET
🛑
Guard ack
PER-TARGET
✓
Effect witness
READBACK
↻
Recovery
OPERATIONAL
What exists in HAIEC source
Execution guard code. Kill-switch foundation. Intended native adapter contract. Human authorization workflow. Alerting framework. The pathway for a response.
What is not universally wired
Production native enforcement adapters per provider. Universal automatic enforcement guarantee. Kill-switch coverage across every AI system.
Assessment BLOCK ≠ physical stop. BLOCK is an evaluation finding. It does not mean the target refused the action. It does not mean the pipeline blocked. It does not mean the API call was denied. Those are separate operational facts that require a native adapter to actually occur.
Incident investigation & replay. Evidence receipts are replayable. Optional LogSense forensic normalization can reconstruct timelines and correlate events where integrated and qualified. Investigation strengthens the record — it does not substitute for target enforcement.
HAIEC · Enterprise Capability Brief 09 / 12
Governance & compliance10 · Controls & human decisions
Enterprise controls, compliance & human governance

Controls configured, monitored, tested, verified. Decisions named, versioned, digest-bound. Frameworks mapped, not certified.

Control life cycle · 10 facets, not one green check

Illustrative control state. Policy version, reviewer, timestamps and source health are fictional, not a production control readback.
R03
Runtime guardrail enforcement
Mixed state
✓
Cataloged
YES
✓
Applicable
YES
✓
Configured
v12
✓
Policy approved
A.CHEN
✓
Deployed
COND.
◐
Target wired
NOT WIRED
◐
Monitored
STALE 6H
◐
Test & replay
PENDING
◐
Enforced
NO DEC.
·
Effect verified
N/A
TestSpec execution and replay status are recorded per run — not every control has a replay-confirmed test. The catalog holds 45 objectives; not 45 completed tests. Specialized C7/C9/C16 profiles hold scoped test evidence where qualified case/run exists.

Human decision

Requestrefund.create ≤ $1,000
Requesterbob.kumar
Reviewer · SoDalice.chen · ✓
Policy digestsha256:8f2a…c4b1
ActionsApprove · condition · reject · revoke

Framework-oriented evidence · mapped, not certified

ISO/IEC 42001AI management system evidence · supporting
ISO/IEC 27001AI-specific control evidence · supporting
NIST AI RMFGovern / Map / Measure / Manage artifacts
NIST CSFIdentify / Protect / Detect evidence
SOC 2CC-series evidence · not an attestation
EU AI ActApplicability context · not legal advice
GDPR · HIPAAPrivacy-control evidence for AI actions
NYC LL 144Hiring workflow evidence where applicable
Never claim certification. Mapping is context. Applicability is separate from implementation. Implementation is separate from evidence. Evidence is separate from a reviewer's attestation. A "Compliance Twin" preview shows versioned state — it is not a certification artifact.
Forensic investigation & incident replay
Optional LogSense forensic normalization reconstructs event timelines and correlates across sources where integrated. Supports incident response and post-event reconstruction. Optional enrichment — not a substitute for the assurance engine or target-side enforcement.
Approval ≠ authorization to deploy. A named human's decision about a requested scope is a decision. Deployment, target enforcement, and effect verification are separate operations with their own evidence requirements.
HAIEC · Enterprise Capability Brief 10 / 12
Differentiation11 · Why HAIEC + technical proof
Differentiation & technical proof

Five differentiators. One real control-evidence archive. Reproducible, honest, and inspectable.

01
Deterministic
Defined deterministic rules. Reproducible results for the same qualified inputs, policy and evaluator version.
02
Authority-aware
Compares requested, authorized, granted, code-capable, observed. A qualified comparison can establish a finding; missing source evidence remains unknown.
03
Lifecycle
Pre-deploy, release, runtime, audit share the same evidence spine.
04
Evidence-conscious
Missing coverage named. NOT_ASSESSED never downgraded. Frontier visible.
05
Integration-first
Builds on existing DevSecOps, cloud, IAM, and observability infrastructure.

Supporting technical proof · TM Forum 2026 archive

C16 · SATISFIED
35,559 tokens against 60,000-token cap
Measured control verdict — within frozen cap
C16 · NOT_SATISFIED
106,829 tokens against 60,000-token cap
Measured control verdict — exceeded frozen cap
C9 · SATISFIED
Two assessed runs under frozen v2 thresholds
No sanctioned live breach in archive
C7 · PARTIAL
9 of 10 required coverage · one negotiation event missing
Partial result — NOT_EVALUATED for missing event
Monitoring
OTLP ingestion + detector canary + alert delivery
Clean negative + separately labeled synthetic canary
Kill switch
Organizer environment pause/recovery pathway
External enforcement — HAIEC engine not invoked
Measured verdict ≠ enforcement proof. The C16 run exceeded the cap — the archive does not prove the over-cap call was blocked at target. The archive is participant-published and integrity-verifiable — not an organizer audit, not an independent scientific certification. Partial coverage (C7) is a valid, honest result.
Sources · TM Forum 2026 participant archive · HAIEC capability matrix 11 / 12
The POC12 · Enterprise POC
Scoped enterprise POC

Evaluate one consequential AI system. Prove the value before expanding.

01

What you provide

  • One consequential AI system (non-production preferred where practical) with a named business owner
  • Read access to its source repository, or a source archive
  • Its operating envelope or the intent it should be governed by
  • Its IAM grants — via live observer or signed JSON export
  • Optional: 7–14 days OTLP traces or gateway events
02

What HAIEC does

  • Maps the system's consequential capabilities and authority planes
  • Runs deterministic assurance over supplied evidence
  • Compares authority-to-action across five planes + DAI
  • Produces a scoped disposition and a frozen receipt
  • Surfaces the proof frontier — what remains unknown
03

What you get

  • Executive assurance summary (findings, disposition, scope)
  • Technical evidence appendix with per-analyzer participation
  • Digest-bound receipt for auditor or customer review
  • Prioritized remediation list with named unknowns
  • Architectural recommendation for scaling to the next 3 systems

Success criteria — clean, inconclusive, or finding all valid outcomes

Success 01
Qualified evidence basis
Every source authenticated, source-bound, and schema-qualified against a registered binder.
Success 02
Deterministic rerun stability
Same input produces the same findings and digest. Changes between snapshots are visible.
Success 03
Traceable finding OR clean result
A qualified finding, a clean result, or a declared inconclusive outcome — each defensible. Vulnerability discovery is not a requirement.
Success 04
Defensible decision artifact
An evidence-bound report or receipt that your security, legal or audit team can review within its stated scope.
Scope an Enterprise AI Assurance POC
Typically 4–8 weeks after readiness · One system · One defensible answer to: was this AI authorized to do what it did?
haiec.com · POC scoping
No invented ROI · no incident-reduction rate claims · no "we block all dangerous actions" claims until target-native adapter binding, guard decision, and effect witness are proved per-target.
HAIEC · Human AI Evidence Company · haiec.com 12 / 12