AI may reason probabilistically.
Consequential actions require assurance.
HAIEC research investigates how AI systems move from generating answers to taking consequential actions — and how to determine whether the discretion behind those actions was actually delegated, whether their possible effects remain inside authorized boundaries, and whether critical system constraints can be preserved before commitment.
Permission is not delegation.
A system can technically possess permission to perform an action without having been delegated every consequential choice inside that action. As AI systems move from generating answers to taking consequential actions, HAIEC is researching how to distinguish authorized capability from delegated discretion.
Permission is not delegation.
IAM permission, API access, and tool availability do not by themselves prove that discretion was delegated.
Delegation does not by itself prove a safe consequence.
An authorized action can still produce effects outside intended boundaries.
Individually acceptable actions do not necessarily create a safe trajectory.
A sequence of permitted actions can compound into unsafe system-level outcomes.
This is HAIEC's active research direction. These problems have not all been solved. The current platform provides deterministic assurance from bounded technical and governance evidence.
Current Foundations & Active Research
What HAIEC has built today, and what HAIEC is researching next
Source-Proven Foundations
These primitives exist in the current HAIEC platform and are source-proven:
- ✓Evidence Core — deterministic evidence envelopes with canonical serialization
- ✓Operating Envelope — bounded scope for evaluation
- ✓Interface Profile Compiler — deterministic interface specification
- ✓Action Witness — active internal primitive; production integration limited
- ✓Capability Comparison — claimed vs observed capability evaluation
- ✓Impact Vector — structured potential-impact analysis
- ✓Decision Receipt — verifiable integrity of evaluation output
- ✓Deterministic Serialization & Provenance — SHA-256 hashed, tamper-evident artifacts
CONNECTED != EVALUATED. These foundations report what was evaluated, what the evidence supports, and what remains unknown.
What We Are Working Toward
HAIEC is researching the next frontier of AI assurance:
- →Authority, Delegation & Discretion - distinguishing authorized capability from delegated discretion
- →Effect & Capability Recovery - recovering possible effects before commitment
- →Critical-Action Invariants - preserving critical system constraints
- →Runtime Mediation / Confinement - pre-commitment action boundaries
- →Tenant & Scope Isolation — bounded evaluation scope integrity
- →Trajectory / Shared-System Safety — sequences of autonomous actions and systemic risk
- →Evidence & Assurance — extending evidence to cover consequential action boundaries
This is research and future direction, not currently deployed production functionality. The research territory is AI Action Assurance.
Research Method
Published Research
Technical reports and working papers published for citation, public scrutiny and external review
The Instruction Stack Audit Framework (ISAF)
KC, S. (2025). A Technical Methodology for Tracing AI Accountability Across Nine Abstraction Layers. Version 1.0.
AI accountability failures occur when regulatory audits examine outputs while root causes exist in instruction layers that remain undocumented. ISAF provides a nine-layer technical specification with a 127-checkpoint audit protocol.
DOI: 10.5281/zenodo.18080355 | CC BY 4.0 | Preprint — publicly archived, not journal peer-reviewed
Deterministic Bias Detection for NYC LL144
HAIEC Lab & KC, S. (2025). Why Reproducibility Matters More Than Accuracy.
NYC Local Law 144 is an early U.S. law requiring bias audits for automated employment decision tools. This paper presents a deterministic architecture using rule-based pattern matching and cryptographic evidence generation.
DOI: 10.5281/zenodo.18056133 | CC BY 4.0 | Technical report — publicly archived, not journal peer-reviewed
Academic Citation
These frameworks are released for citation, public scrutiny, and regulatory consideration. If you use these methodologies in your research or implementation, please cite the original papers.
How to Use This Research in Your Organization
For Compliance Teams
ISAF Framework: Use the 9-layer audit protocol as your compliance evidence structure. Map each layer to your regulatory requirements (EU AI Act Articles 10 & 11, NIST AI RMF GOVERN-1.3, ISO 42001 Section 8.2). The 127-checkpoint audit provides structured evidence that can support regulatory or audit review.
NYC LL144 Paper: Implement the deterministic bias detection architecture to support audit requirements. The cryptographic evidence generation produces tamper-evident records that support integrity and traceability.
Implementation: Both papers include implementation guidance. Fork our GitHub repos, run tests against your models, adapt to your use case.
For Engineering Teams
DriftTrace Research: Active research investigating whether behavioral fingerprints can expose changes that conventional task-level performance metrics may miss.
Truth-Reward Gap Research: Research examining how optimization for helpfulness, coherence or confidence can interact with factual reliability under ambiguous conditions.
Implementation: Implementation code or reproducibility materials are linked where publicly available. Fork our GitHub repos, run tests against your models, adapt to your use case.
For Risk & Legal Teams
Behavioral Drift Research: Active research on AI system stability risk. Use findings to inform monitoring controls for board reporting.
Multi-Agent Divergence Research: Identify coordination failure risks in autonomous systems. Use findings to establish human oversight requirements and kill switch triggers.
Citation: Published technical reports and working papers can be cited by DOI in regulatory filings and incident reports. A DOI establishes citability — it does not by itself establish peer review or regulatory acceptance.
For Executives & Decision Makers
Key insight: AI assurance is not a one-time evaluation. It benefits from ongoing evidence collection from connected sources where supported. Traditional GRC platforms may require AI-specific evaluation, monitoring and evidence capabilities to address model behavior, prompt/configuration changes and other AI-specific risks.
Research-informed approach: HAIEC research informs product development. ISAF research became the ISAF Logger implementation tool. DriftTrace research is being explored for monitoring features where supported.
Open access: Research remains openly accessible, even where products are commercial.
How HAIEC Research Is Designed
Implementation-Oriented
Research is designed to be implementable, not just theoretical. Papers include implementation guidance and reference code where available.
Explicit Artifact Links
Each paper links to its Zenodo record, DOI, and implementation repository where one exists. Provenance is transparent.
Regulatory Context
Research maps to real regulations — EU AI Act, NIST AI RMF, ISO 42001, NYC LL144 — with explicit clause references where applicable.
Reproducibility Where Available
Implementation code or reproducibility materials are linked where publicly available. We do not claim reproducibility for research lines that lack supporting artifacts.
Open Access
Papers are published openly under Creative Commons licenses. Code is published under separate software licenses where applicable.
Research-to-Product Connection
Research informs product development. ISAF research became the ISAF Logger implementation tool. DriftTrace research is being explored for monitoring features where supported.
Research Artifacts
🔬 Active Research Topics
High-signal research directly extractable from real implementations, not theory.
Core Compliance & Governance
Operationalizing NIST AI RMF in Production Systems
From abstract risk categories to continuous, structured controls.
Implementing ISO/IEC 42001 via Modular Rule Packs
Turning ISO clauses into executable compliance logic.
Pre-Enforcement Readiness for NYC Local Law 144
Bias audits, evidence retention, and artifacts designed to support regulatory review.
EU AI Act Readiness via Connected Evidence
Exploring how high-risk system obligations can be mapped to connected evidence where supported (not only point-in-time audits).
Technical & Systems Research
Compliance Rule Packs as Code
Policy → YAML → Enforcement. HAIEC's rule-pack architecture as a new compliance primitive.
Drift Detection as a Compliance Failure Mode
Model, data, and prompt drift tied to regulatory breach risk.
LLM Oversight Without Model Access
Black-box governance using outputs, prompts, and metadata only.
Autonomous Root Cause Analysis for AI Incidents
Linking failures back to policy, data lineage, and controls.
Market & Strategy
Why Companies Fail When They Wait for Enforcement
Artifact debt, cost curves, and missed budget windows.
Where Traditional GRC Tools Need AI-Specific Extensions
Static controls vs adaptive models — what GRC platforms may need to address AI-specific risks.
Developer-First Compliance vs Consultant-Led Audits
Speed, cost, and defensibility tradeoffs.
Research Categories
Behavioral Drift
How and why AI systems change their behavior over time, even without retraining or updates.
Instruction Sensitivity
When small changes in phrasing or prompt structure produce disproportionately large output differences.
Alignment Deviation
Small shifts in how models apply organizational rules, safety boundaries, or intended outcomes.
Multi-Agent Divergence
How small inconsistencies between autonomous agents compound into contradictory or unsafe actions.
Cognitive Load Testing
How AI behavior degrades under memory constraints, context depth, or multi-step reasoning demands.
Behavioral Reconstruction
Methods for tracing how a system arrived at a decision across time, context, and internal states.
Featured Research Lines
DriftTrace: Behavioral Fingerprinting for Production AI
Active ResearchStandard monitoring tracks outputs. DriftTrace tracks behavior. We establish a baseline behavioral profile for an AI system, then continuously compare new behavior against that baseline to detect drift, inconsistency, or emergent patterns.
Research Question
Can behavioral fingerprints expose changes that conventional task-level performance metrics may miss? We are evaluating what behavioral signals are most diagnostic, how baselines should be established, and how early drift can be detected relative to output-level degradation.
The Truth-Reward Gap in Language Models
Active ResearchModels are trained to be helpful, harmless, and honest. But these goals sometimes conflict. When a model is rewarded for confidence or coherence, it may produce wrong answers that sound correct. This research maps when and why the truth-reward gap emerges.
Research Question
How does optimization for helpfulness, coherence or confidence interact with factual reliability under ambiguous conditions? We are studying the conditions under which reward signals conflict with factual accuracy and whether detection methods can identify this gap.
Context Steering in Multi-Turn Interactions
OngoingA model's behavior changes based on conversation history, system prompts, and hidden context. Small changes in context can steer outputs in unintended directions. We study how context shapes behavior and develop methods to detect unwanted steering.
Research Question
How can semantically similar context and conversation history change model behavior despite an unchanged underlying task? We are evaluating detection methods for context-induced behavioral shifts and their implications for evaluation reproducibility.
Methodology
HAIEC research combines experimental methods from cognitive science, stress testing from reliability engineering, and causal analysis from machine learning. Implementation code or reproducibility materials are linked where publicly available.
Controlled Experiments
We systematically vary inputs, contexts, and conditions to isolate specific behavioral mechanisms and understand causality.
Longitudinal Studies
Tracking the same systems over weeks or months to observe how behavior evolves and detect drift patterns.
Failure Analysis
When AI systems fail in the real world, we reconstruct what happened using logs, prompts, and counterfactual testing.
Stress Testing
Pushing models to their limits with edge cases, cognitive load, and adversarial inputs to reveal failure modes.
Published Research & Whitepapers
The Instruction Stack Audit Framework (ISAF)
KC, S. (2025). A Technical Methodology for Tracing AI Accountability Across Nine Abstraction Layers. Version 1.0. Preprint.
AI accountability failures occur when regulatory audits examine outputs while root causes exist in instruction layers that remain undocumented. ISAF provides a nine-layer technical specification defining instruction propagation from hardware substrate to emergent behavior, with a 127-checkpoint audit protocol for systematic verification.
DOI: 10.5281/zenodo.18080355 | License: CC BY 4.0 | Preprint — publicly archived, not journal peer-reviewed
Deterministic Bias Detection for NYC Local Law 144
HAIEC Lab & KC, S. (2025). Why Reproducibility Matters More Than Accuracy. A Technical Framework for Compliance-Grade AI Auditing. Technical report.
NYC Local Law 144 is an early U.S. law requiring bias audits for automated employment decision tools. This paper argues that reproducibility is more fundamental than algorithmic sophistication. We present a deterministic architecture using rule-based pattern matching, version-controlled lexicons, and cryptographic evidence generation to create tamper-evident audit trails that support reconstruction and assurance activities.
DOI: 10.5281/zenodo.18056133 | License: CC BY 4.0 | Technical report — publicly archived, not journal peer-reviewed
Academic Citation
These frameworks are released for citation, public scrutiny, and regulatory consideration. If you use these methodologies in your research or implementation, please cite the original papers.
Both papers are published under Creative Commons licenses. Associated code, where available, may carry a separate software license.
Research FAQ
How is HAIEC research different from academic AI research?
Academic research often prioritizes novelty and theoretical contributions. HAIEC research prioritizes implementation and regulatory alignment. We publish implementation guidance, explicit compliance mappings, and reference code where available. Our papers are technical reports and preprints published for citation and public scrutiny, not journal publications that have undergone traditional peer review.
Can I use HAIEC research for commercial purposes?
License terms vary by publication. Papers carrying CC BY 4.0 may be shared and adapted with attribution for any purpose, including commercial use, provided the license terms are followed. Associated code may carry a separate software license (e.g., MIT or Apache 2.0). Check the license attached to each artifact or contact HAIEC for additional permissions. This summary is not legal advice.
How do I cite HAIEC research in my work?
Use the DOI for formal citations. Example for ISAF: KC, S. (2025). The Instruction Stack Audit Framework (ISAF): A Technical Methodology for Tracing AI Accountability Across Nine Abstraction Layers. Zenodo. https://doi.org/10.5281/zenodo.18080355
For code implementations, cite the GitHub repository with commit hash or release version.
What review process does HAIEC research use?
HAIEC publications undergo internal technical and implementation review before release. Papers are published openly on Zenodo with DOIs for permanent archival and citability, and are intended for citation, external scrutiny and practitioner feedback. Unless a publication explicitly states otherwise, it should not be interpreted as having completed traditional journal peer review.
How often is research updated?
Major papers: annually or when regulations change significantly. Code implementations: quarterly updates for bug fixes and feature additions. Active research topics: continuous updates as findings emerge. Subscribe to GitHub repositories for notifications.
Can I contribute to HAIEC research?
Yes. Code contributions: submit pull requests to GitHub repositories. Research contributions: share findings, test cases, or real-world incident data (anonymized). Regulatory insights: if you have inside knowledge of enforcement actions or regulatory interpretations, we want to hear from you. Contact research@haiec.com.
What is the relationship between HAIEC research and HAIEC products?
Research informs product development. ISAF research became the ISAF Logger implementation tool. DriftTrace research is being explored for monitoring features where supported. Products validate research in production environments. Research remains open source and free, even if products are commercial.
How do I know if HAIEC research applies to my use case?
ISAF: applies to any AI system requiring audit trails (EU AI Act high-risk systems, regulated industries, government contracts). NYC LL144: applies to automated employment decision tools used in NYC. DriftTrace: applies to any production AI system where behavior stability matters. Truth-reward gap: applies to fine-tuned language models. If unsure, review the open papers and evaluate whether the methodology fits your use case.
What is the typical ROI of implementing HAIEC research?
ROI depends on your organization's regulatory exposure, existing compliance maturity, and the scope of AI systems in scope. HAIEC research is designed to reduce implementation effort by providing explicit artifact links, regulatory mappings, and reference code where available. We do not publish generic ROI figures because meaningful estimates require organization-specific context.
Where can I get help implementing HAIEC research?
Documentation: each paper includes implementation guide. Code: GitHub repositories have examples and tests. Community: join discussions on GitHub Issues. Commercial support: HAIEC offers implementation consulting, training, and custom development. Contact support@haiec.com for enterprise support options.
Participate in Research
We partner with organizations deploying AI systems to conduct real-world behavioral studies. Participants receive detailed reports on their systems' behavioral patterns and early access to HAIEC research findings.