RASTA IMPERIUM

Public assurance · evidence alignment

Governance Evidence Crosswalk

Which governance concerns can the existing public evidence inform — and which remain unestablished? This is an evidence-alignment register, not a compliance engine.

Evidence alignment ≠ compliance. Production authority remains NOT ESTABLISHED. Compliance assessment remains NOT ASSESSED. The UI is not the authority.

Proof RegistryEvaluator ConsoleLimitations

Framework references (version-aware)

  • NIST AI Risk Management Framework

    1.0 (NIST AI 100-1)

    US voluntary framework for identifying, measuring, and managing AI risks across the AI lifecycle.

    Source →

  • NIST AI Agent Standards Initiative

    Initiative (announced 2026)

    Initiative focused on standards for trusted autonomous agents; not a conformity scheme for any single product.

    Source →

  • ISO/IEC 42001

    2023

    International standard for organizational AI management systems — not satisfied by individual technical artifacts.

    Source →

  • EU AI Act

    Regulation (EU) 2024/1689

    EU regulation for AI systems. Technical logging concepts are distinct from legal conformity assessment.

    Source →

  • OWASP Agentic AI security guidance

    Emerging 2025–2026 guidance

    Community security guidance for agentic systems; not a certification programme.

    Source →

Mappings with public evidence

5 mappings grounded in sealed L7 capsules. Each row includes rationale, scope, and explicit non-claims.

Governance concern

Reproducible decision outcomes under identical inputs

PARTIALLY RELEVANTVERIFIED
Framework context
NIST AI Risk Management Framework1.0 (NIST AI 100-1) · Map / Measure functions (traceability & measurement concepts)Authoritative source →
Evidence
ART-L7-REPLAY-001
Invariant
INV-001
Scope
Capsule-scoped only
Production authority
NOT ESTABLISHED
Compliance assessment
NOT ASSESSED
Mapping rationale
INV-001 sealed replay demonstrates that, for a fixed capsule, identical ordered inputs yield identical terminal hashes — a concrete measurement of determinism relevant to Map/Measure-style risk documentation, not a full RMF programme.
What this informs
Independent parties can reproduce sealed replay hashes offline for this public capsule.
What it does not establish
Production runtime determinism, full-kernel behaviour, organizational risk management, or NIST conformity.
Receipt →Artifact →Verify →Limitations →

Governance concern

Rejection of illegal lifecycle / authority transitions

ALIGNEDVERIFIED
Framework context
NIST AI Risk Management Framework1.0 (NIST AI 100-1) · Map / Measure functions (traceability & measurement concepts)Authoritative source →
Evidence
ART-L7-REJECT-001
Invariant
INV-002
Scope
Capsule-scoped only
Production authority
NOT ESTABLISHED
Compliance assessment
NOT ASSESSED
Mapping rationale
INV-002 via ART-L7-REJECT-001 shows a specific illegal edge is rejected without state mutation and with a sealed receipt — technical evidence of a constrained transition boundary, relevant to accountability documentation, not organizational governance certification.
What this informs
Adversarial rejection of one illegal lifecycle edge is independently reproducible for this capsule.
What it does not establish
All possible illegal edges, production enforcement, or risk-management process maturity.
Receipt →Artifact →Challenge →Verify →Limitations →

Governance concern

Independent multi-implementation verification of sealed evidence

PARTIALLY RELEVANTVERIFIED
Framework context
NIST AI Agent Standards InitiativeInitiative (announced 2026) · Trusted, interoperable, secure autonomous agents (initiative scope)Authoritative source →
Evidence
ART-L7-PARITY-001
Invariant
cross_implementation_parity
Scope
Public pure-verifier parity only
Production authority
NOT ESTABLISHED
Compliance assessment
NOT ASSESSED
Mapping rationale
ART-L7-PARITY-001 records agreement between separate Node and Python pure verifiers on sealed capsules — relevant to inspectability and independent checking of agent-related evidence packages, not an endorsement under any NIST agent standard product.
What this informs
Two independent pure-verifier implementations agree on sealed public capsule hashes.
What it does not establish
Full-kernel parity, production agent interoperability, or NIST agent standard conformity.
Receipt →Artifact →Verify →Limitations →

Governance concern

Automatic event logging / traceability for constrained transitions

PARTIALLY RELEVANTVERIFIED
Framework context
EU AI ActRegulation (EU) 2024/1689 · Art. 12-related concepts (logging / traceability for high-risk systems)Authoritative source →
Evidence
ART-L7-REJECT-001
Invariant
INV-002
Scope
Capsule-scoped sealed receipts only
Production authority
NOT ESTABLISHED
Compliance assessment
NOT ASSESSED
Mapping rationale
Sealed rejection and replay capsules demonstrate that specific transition outcomes can be recorded and re-verified offline. This is a narrow technical analogy to logging/traceability concepts often discussed under Art. 12 themes — not evidence of high-risk system classification or legal logging obligations being met.
What this informs
A constrained transition outcome can be sealed and independently re-checked for this public fixture.
What it does not establish
EU AI Act applicability, high-risk system duties, production logging systems, or legal conformity.
Receipt →Artifact →Challenge →Verify →Limitations →

Governance concern

Enforcement of explicit control boundaries under adversarial input

PARTIALLY RELEVANTVERIFIED
Framework context
OWASP Agentic AI security guidanceEmerging 2025–2026 guidance · Agentic security / control boundaries (conceptual)Authoritative source →
Evidence
ART-L7-REJECT-001
Invariant
INV-002
Scope
Capsule-scoped adversarial fixture
Production authority
NOT ESTABLISHED
Compliance assessment
NOT ASSESSED
Mapping rationale
Illegal-transition rejection (CHAL-ILLEGAL-TRANSITION-001 / ART-L7-REJECT-001) is public evidence that at least one disallowed edge is deterministically refused in the sealed fixture — relevant to control-boundary discussions in agentic security guidance, not an OWASP assessment result.
What this informs
One illegal transition is rejected as designed with reproducible sealed evidence.
What it does not establish
Coverage of OWASP control catalogues, runtime agent hardening, or security certification.
Receipt →Challenge →Verify →Limitations →

Evidence gaps

Governance concerns without supporting public technical evidence. Gaps are intentional outputs of this register.

Governance concern

Organizational AI management system (policies, roles, continual improvement)

NOT ESTABLISHED
Framework context
ISO/IEC 420012023 · AI management system (organizational)Authoritative source →
Scope
No public management-system evidence published
Production authority
NOT ESTABLISHED
Compliance assessment
NOT ASSESSED
Mapping rationale
ISO/IEC 42001 addresses organizational management systems. No public sealed capsule establishes an implemented AIMS for any institution. Technical invariants are not management-system evidence.
What this informs
Nothing on the public surface establishes ISO/IEC 42001 implementation.
What it does not establish
Any claim of ISO certification, conformity, or organizational AIMS maturity.
Limitations →

Governance concern

Production monitoring and LIVE operational telemetry

NOT ESTABLISHED
Framework context
NIST AI Risk Management Framework1.0 (NIST AI 100-1) · Map / Measure functions (traceability & measurement concepts)Authoritative source →
Scope
Public surface only
Production authority
NOT ESTABLISHED
Compliance assessment
NOT ASSESSED
Mapping rationale
Public evidence is limited to frozen historical capsules. LIVE production monitoring, continuous measurement, and operational risk registers are not published.
What this informs
Absence of public LIVE telemetry is explicit.
What it does not establish
Production health, continuous monitoring programmes, or operational risk control effectiveness.
Limitations →

Governance concern

Legal conformity assessment under the EU AI Act

NOT ESTABLISHED
Framework context
EU AI ActRegulation (EU) 2024/1689 · Art. 12-related concepts (logging / traceability for high-risk systems)Authoritative source →
Scope
No legal assessment published
Production authority
NOT ESTABLISHED
Compliance assessment
NOT ASSESSED
Mapping rationale
Conformity assessment is a legal and organizational process. Technical capsule evidence cannot substitute for classification, notified-body processes, or documented legal duties.
What this informs
Public technical evidence is not a legal opinion or conformity dossier.
What it does not establish
EU AI Act compliance, readiness, or regulatory approval of any kind.
Limitations →

Next evaluation steps

Evaluator Console →Challenge Lab →Verify offline →Institutional pilots →Governance model →