Evidence that says what it establishes
— and what it does not.
HAIEC preserves source, provenance, scope, coverage, and limitations so assurance can distinguish established facts from partial or missing evidence.
Explanatory structure — not a claim that every evidence type is always present.
What Evidence Is
Evidence is information connected to an AI system or assurance evaluation. Depending on what is connected and available, evidence may come from:
- Source analysis of the application code
- Identity and access evidence
- Policy evidence
- Provider IAM evidence where supported
- Runtime evidence where connected
- Uploaded or declared evidence where supported
Not every source is always available. What matters is that what is available is clearly distinguished from what is not.
Provenance
Evidence should retain enough information to identify where it came from and what produced it. HAIEC preserves provenance so reviewers can trace evidence back to its source — whether that is a source code scan, an identity record, a policy document, or a runtime observation. Provenance is what makes evidence auditable rather than merely asserted.
Coverage
HAIEC distinguishes between what the evidence establishes, what it partially establishes, and what remains unknown or not evaluated:
Missing evidence remains missing evidence. HAIEC does not silently convert absence into assurance.
Limitations
Evidence must make gaps visible. A system can have valid source analysis, correct identity configuration, and a clean policy envelope — and still have an unanswered question about what it can actually do at runtime.
Missing evidence remains missing evidence.
HAIEC does not silently convert absence into assurance. Unknown stays unknown. Partial stays partial. Not evaluated stays not evaluated.
Connection to Assurance
Evidence feeds assurance evaluation. Assurance evaluates what the evidence establishes within a defined scope and produces a bounded disposition. Where supported, assurance packages and decision receipts preserve the evaluation output for review.
Evidence does not itself equal Assurance.
Evidence is what you have. Assurance is what the evaluation establishes about it. Evidence ingested is not evidence evaluated — an accepted submission changes the Evaluation only when a new Evaluation runs. Framework mapping is not assurance. An observation that is absent is not the same as a fact that something did not happen.
Integrity
Where supported by the current implementation, HAIEC uses tamper-evident, hash-bound integrity for evidence packages and decision receipts. This means reviewers can verify that artifacts have not been modified after generation. HAIEC does not universally claim that every artifact is permanently immutable or externally notarized unless that is actually established.
What Evidence Is Not
See evidence in context
Explore how evidence connects to AI actions, access, and consequences in the sample AI Action & Access Map.