CONTROL EVIDENCE

Show the control was operating.

Fidacy is Continuous Control Monitoring for consequential AI agent actions. It gives security, compliance and risk teams evidence of the authority, decision, operating trail and proof around a connected control.

WHAT A REVIEWER CAN INSPECT

Four records, one control story.

SIGNED MANDATE

The authority a human granted: scope, duration, amount, payee or resource, and version. It can be delegated with attenuation and revoked.

SIGNED DECISION

An allow, review or deny bound to a specific action and the policy version in force. A connected payment executor validates the one-time grant before the refund call.

CONTROL COVERAGE

The account-backed Agent Session trail visible to the connected host: action metadata, redacted target and a session digest. A complete session is independently recomputable; a truncated or missing session is a coverage limit, not proof of inactivity.

EXTERNAL PROOF

Append-only hash-chained audit, signed records, Merkle inclusion proof and Bitcoin checkpoint. The anchor proves integrity and existence in time, not that an unconnected system was observed.

FRAMEWORK ALIGNMENT

Evidence for controls, not a compliance badge.

The mapping below states the evidence Fidacy can contribute. A customer still owns its risk assessment, procedures, retention policy and certification outcome.

EU AI Act
Articles 12 and 14

Record keeping and human oversight require traceable operation and a way to constrain the system.

Versioned mandates, revocation, signed decisions and connected session evidence support those records. Fidacy is not a conformity assessment.

SOX, ICFR and ITGC

Authorization, integrity and reconstruction of a consequential transaction.

For the connected and observed workflow, Fidacy supplies the mandate, decision and tamper-evident trail. It does not establish completeness beyond the configured control boundary.

NYDFS Part 500
and ISO 27001

Access boundaries, protected logging, audit trail and evidence preservation.

Agent identity, scoped mandates, signed verdicts and exportable evidence can support those controls. Certification remains the organization’s responsibility.

THE INSURANCE QUESTION

Was the control active when the event happened?

That is the question Continuous Control Monitoring makes answerable. Fidacy should show the agent identity, the mandate in force, decision before execution, whether a connected host produced complete evidence and the external proof after the event. The absence of that evidence must remain visible rather than being mistaken for safety.

Read how Control Coverage works · See the insurer evidence model