A control is not proof.
A policy may exist. A test may run. A guard may be configured. What does the evidence actually establish?
Choose a consequential AI action, identify the controls that matter, follow the source evidence, and practice decisions you can defend. This lab teaches how to use HAIEC's control model. V2 adds a unique evaluation method and practical exercise for every control. It does not run customer evaluations.
Independent reading · No sign-in required · Exercises and progress are educational
Learn the control decision.
Every lesson helps you answer what was found, what it means, what still needs proof, and who should act.
Start with impact
A control matters only when it addresses a meaningful AI action, source or consequence. Scope first.
Separate proof layers
Catalog metadata, visibility, executed tests, evaluations, human approvals and target effects each say different things.
Operate the finding
Make the next decision useful: select a source, assign an owner, review signals and re-evaluate when facts change.
Which layer supports this claim?
A control review is strongest when it names the question, source, test scope, decision and possible consequence. Click any facet to learn what it establishes and what it does not.
What can start immediately?
A source-backed code-capable tool path can be actionable even before an IAM provider, policy package or runtime source is connected. Missing sources sharpen the follow-up, not erase an established source finding.
What is not one green score?
A control may be applicable but unevaluated, present but ineffective, or tested for one version while production has changed. Record each fact against its own identity, source and time.
Practice this explanation
"A02 is in the catalog. A code-source candidate appeared. No eligible native control test has run for this system. We can investigate the capability, but cannot yet claim a tested pass or an applied runtime block."
Eight groups. One accountable system.
The catalog is organized by the question each control asks. Select a family below to open the corresponding controls in the complete atlas.
An accessible text-based family selector follows this diagram. Connections indicate relevance, not live agent execution.
Recommended learning order
Start with your actual business consequence, then select the applicable family. A security team might open S and A first. A risk owner may need G and E. An operator investigating a runtime event may start with R and E. No family is a universal prerequisite.
Explore all 45 controls.
Select any control to explore its mechanism, evidence requirements, evaluation procedure, finding interpretation, practical exercise, and operating response. All 45 include their own deep-dive lesson.
Complete controls reference for print
All 45 control-by-control practitioner lessons
Five separate evidence questions.
Requested, Policy Authorized, Effectively Granted, Code Capable and Observed are peers, not a five-step clearance pipeline. Click each source to see what it can actually establish.
The missing-source exercise
Suppose the source analysis finds an exported data-write path, but no runtime feed exists. Which fact should remain visible?
Control evidence quality
A visibility state is not an assurance verdict.
The current supported Control Visibility read model uses four bounded states. Review them beside executed control tests, system assurance, human decisions and runtime effects.
Visibility
Current bounded read projection for supported IDs, qualified source and scope.
DETECTED_FINDING / NO_FINDING / INSUFFICIENT / NOT_ASSESSEDNative test & evaluation
An actual authorized test/result and scoped Assurance Evaluation. A separate record with source, version and identity.
Run ID · exact result · scopeDecision & effect
A human reviewer and target-side action require their own source and event chain. They do not follow automatically from the badge.
Approval · mediation · effect witnessIdentity-bound replay, without cross-system attribution
For a permitted MCP investigation, bind aiSystemId and controlId for both control assurance and results, and the exact aiSystemId and resultId for replay. Confirm returned record identities match the selected system before claiming proof. A replay-verifiable artifact does not certify all upstream facts.
Four independent operational truths.
Monitoring, active testing, policy evaluation and target enforcement do not prove each other. Follow the lanes, then change the example source health to see what it actually means.
The colored labels explain distinct statuses, not the results of a connected customer account. All four rows must be inspected separately.
Practice source-freshness interpretation
Incident lifecycle
An alert delivered does not prove a human acknowledged it. A policy-approved intervention does not prove the customer target was blocked. Recovery also needs scoped authorization and proof.
Reassessment triggers
A control result is bounded by its source and evaluated time. Fresh evidence can change the answer, but must not silently rewrite a frozen evaluation.
Twelve cases. Thirty-six decisions.
Choose a case, inspect the fictional fact record and answer the three questions: which controls matter, what does the evidence establish, and what action is justified?
All 12 case summaries
Build an evidence-bound control packet.
Record a real or hypothetical control decision without claiming HAIEC evaluated it. Only put non-sensitive summaries here. Export a Markdown or JSON note that clearly labels your entries as learner-authored.
Your training shortlist
No controls selected yet.
Your practice progress
0 / 36 scenario answers checked
A quiz score is for learning, not a statement of enterprise assurance maturity or control coverage.
Export data is generated in the current browser only. No uploaded files, API requests, HAIEC evaluations or verification receipts are created.
Continue with actual HAIEC evidence.
This workbook is a learning reference. For an authorized system, use the real workspace and source-bound read models. The links below separate general public documentation from authenticated product journeys.