What is HAIEC?
Know what your AI can cause. Decide with evidence.
HAIEC helps organizations understand the consequential actions AI systems and agents can take. It traces supported paths from an agent through tools and application code to sensitive systems, compares available evidence of policy, technical access and delegated authority, and produces deterministic, scoped findings and evaluations that decision-makers can inspect.
Run with an AI agentWhy it matters
For example, a support agent may be able to issue a refund. Source analysis can find the path: the agent, the MCP refund tool it can call, the handler, and the payment resource behind it. Finding that path is meaningful on its own, but it does not prove a refund was sent, and it does not prove the refund choice was actually delegated to the agent.
One open authority question
The code can reach the payment API. Was that consequential business choice ever approved for this agent, under which policy, and within what limits? Technical permission and delegated authority are different questions.
HAIEC exists to make that difference visible: to find the meaningful source-visible path early, then ask which authority governs it and which scoped evidence supports the conclusion.
A consequence path is not a completed action
HAIEC separates what source analysis finds from what permission, delegation and runtime evidence establish.
Dashed path (⇢): established from authorized source analysis. It shows what the code is capable of, not that any transaction executed.
What is established
- The path exists in supported source (Code Capable)
- Files, handlers and resources are identified
- Where permission evidence exists, what it grants
What remains open
- Whether any refund was actually issued (Observed)
- Whether the choice was delegated (Delegated Action Integrity)
- Whether policy authorized this consequence at all
Static analysis does not observe runtime behavior. Permission does not equal delegation. A meaningful source finding is a starting point, not a verdict.
What HAIEC actually does
HAIEC connects supported evidence sources, maps consequential routes, evaluates bounded claims against that evidence using deterministic services, and generates reviewable records where supported. Not every source is required before a first useful source finding exists.
Available evidence is organized into five independent planes, so a reviewer can see which questions the evidence answers and which it does not:
Deterministic results matter. AI can guide HAIEC. It does not decide whether its own output is secure. HAIEC's canonical deterministic services evaluate supported evidence under an explicit scope, and the same scope plus the same evidence produces the same answer.
Three pillars, six independent capabilities
Each capability answers a different customer question. None is a required stage before another can be useful.
Understand
Assure
Govern & Operate
Monitor and Protect only report what connected operating sources and customer controls actually establish. See the platform for the detailed capability owner.
Can an AI agent run HAIEC?
Yes. HAIEC exposes an Assurance MCP and REST API so supported AI agents and developer tools can operate the workflow. The AI can ask for user approval, call bounded HAIEC tools, retrieve deterministic results, and explain what remains open.
The agent does not become the Assurance engine. HAIEC remains responsible for the persisted evidence state, bounded Evaluation, and resulting Assurance disposition.
To start, an MCP-capable assistant needs a valid HAIEC connection and scoped key, an eligible source, and the required user authorization. See the agent integration guide for the actual setup steps.
What the results mean
A bounded source finding answers one question about the code. A canonical evaluation produces an ALLOW, REVIEW, or BLOCK disposition within the evaluated scope. Deployment remains a human decision.
ALLOW means ALLOW within the evaluated scope and available evidence. It is not a universal safety determination, certification, or deployment approval.
Where supported, assurance packages and decision receipts preserve the evaluation output for independent review.
Who uses HAIEC?
Teams start with one AI system and one real question, not a company-wide telemetry promise.
Executives and risk owners
See the consequential paths your AI can take and which decisions still need a human answer.
Compliance and legal teams
Get defensible evidence with provenance, scope and stated limitations for auditors and regulators.
Security and governance managers
Align stakeholders around what is established, what is partial and what remains unknown.
Developers and engineers
Trace agent, tool and code paths before the system acts, and rescan after a fix.
What makes HAIEC different?
Evidence-bound, not score-based
Reports what the evidence establishes and what remains unknown
Consequence paths plus authority context
Shows what AI can reach, change, and trigger, and asks which policy, permission, and delegated authority applies
Deterministic evaluation
Canonical services produce scoped, reproducible findings, not probabilistic verdicts
Gaps stay visible
Unknown stays unknown. Partial stays partial. Not evaluated stays not evaluated.
What does HAIEC mean?
HAIEC is the Human AI Evidence Company. Our tagline: High assurance in every consequence.
AI may reason probabilistically. Consequential actions require assurance. HAIEC reports what was evaluated, what the evidence supports, and what remains unknown. The brand meaning reflects where AI systems are going and the assurance problem HAIEC is built to address.
The brand meaning is a direction, not a claim that every possible consequence of every AI system has already been observed or verified.
Frequently asked questions
What is AI assurance?▾
AI assurance is the bounded evaluation of evidence about an AI system within a defined scope. HAIEC practices evidence-bound assurance: it establishes what an AI system or agent can do, what authority applies, and what has been observed, and it reports the limits of that evidence rather than converting absence into approval.
What does HAIEC do?▾
HAIEC provides evidence-bound assurance for consequential AI systems. It connects source, identity, access, policy, permissions, capability evidence, and observed behavior to show what AI systems and agents can reach, change, and trigger, and what the evidence actually establishes.
Is HAIEC a certification body?▾
No. HAIEC is not a certification body. Framework mapping supports assurance work but does not itself constitute certification or a compliance guarantee. Evidence is not certification, and a receipt digest is not independent third-party certification.
What is the System Constellation?▾
The System Constellation is HAIEC's evidence-bound AI Action & Access Map. Where supported by connected evidence, it shows what an AI system can reach, change, and trigger, based on connected evidence about identities, permissions, AI actions, APIs, data, and consequences.
Does ALLOW mean the system is safe to deploy?▾
No. ALLOW means allow within the evaluated scope and available evidence. It is not a universal safety determination, certification, or deployment approval. Deployment remains a human decision.
What does HAIEC not claim?▾
- Evidence is not Assurance: evidence supports an evaluation, it is not the disposition.
- Evidence is not Certification: a report or receipt is not certification.
- Source-established is not safe: code capability is not deployability.
- Missing evidence is not a Pass: UNKNOWN and NOT_EVALUATED stay visible.
- An absent observation is not proof that something did not happen.
- Permission != delegation: technical access and delegated business authority are different questions.
Explore HAIEC
Start with one AI system and one real question.