You build AI systems. Eventually, someone will ask you to prove what your system did, when it did it, and whether it followed the rules. This guide shows what that proof looks like today versus what it looks like with the SWT3 protocol.

Contents

1. The Audit You Already Dread 2. Side-by-Side Comparison 3. What Changes in Your Workflow 4. Where Your Evidence Goes 5. The Protocol, Not the Platform 6. Next Steps

1. The Audit You Already Dread

Your auditor sends an email: "Prove your guardrails were active on March 14."

You dig through application logs. You hope the timestamps are UTC. You correlate entries across three services, matching request IDs that were formatted differently in each one. You find what you think is the right window.

You screenshot a Grafana dashboard and paste it into a Word document. You add a caption: "Figure 3: Guardrail activation rate, March 14." You know this screenshot proves nothing on its own. Anyone could fabricate it. But it is what your auditor expects.

You write an attestation letter. "I, the undersigned, certify that our AI system was operating within policy on the date in question." You sign it. Your manager countersigns it. You both know you are attesting to something you cannot independently verify after the fact.

Your auditor reads the package. They ask a follow-up question: "How do I know the model version running on March 14 was the same one you tested in February?" You open a spreadsheet where someone was supposed to track model versions. The last entry is from January. You start over.

This takes 40 to 80 hours per audit cycle. Every time. The evidence is fragile, the process is manual, and the result depends entirely on whether the auditor trusts you personally.

2. Side-by-Side Comparison

Manual Evidence

Without Cryptographic Evidence

  • Manual log correlation across services
  • Screenshots as "proof" (easily fabricated, no chain of custody)
  • Attestation letters signed by humans ("I promise this is true")
  • Version spreadsheets maintained by hand
  • Evidence prep: 40-80 hours per audit cycle
  • Follow-up questions restart the process
  • Auditor must trust you -- no independent verification possible
Witness Anchors

With SWT3 Witness Anchors

  • Every inference generates a tamper-evident anchor automatically
  • Anchors include a SHA-256 fingerprint derived from the evidence itself
  • Verification is independent -- auditor checks without your involvement
  • Model version, guardrail state, and access decisions recorded as they happen
  • Evidence prep: zero hours (generated when the system ran)
  • Follow-up questions answered by querying the anchor chain
  • Auditor verifies cryptographically -- trust is mathematical, not personal

3. What Changes in Your Workflow

You add a single function call that wraps your existing AI client. Your application's behavior does not change. The response your code receives is identical. No new dependencies to manage, no infrastructure to deploy, no database to maintain.

In the background, the SDK generates a witness anchor for each inference -- a tamper-evident record containing the procedure ID, evidence factors, timestamp, and a SHA-256 fingerprint. The fingerprint is derived from the evidence itself, so any modification to the record after the fact would produce a different hash. The math is self-proving.

These anchors flow to your auditor's assessment checklist automatically. When your auditor opens the checklist, each procedure shows its current status with a verifiable anchor attached. There is no evidence to prepare, no screenshots to capture, no attestation letters to draft.

The next time someone asks "prove your guardrails were active on March 14," the answer is already waiting for them.

See the Quickstart Guide for implementation details. Full API reference at /docs.

4. Where Your Evidence Goes

Step 1

You instrument your AI client
One function call wraps your existing code

Step 2

SDK generates witness anchors
Tamper-evident records, one per inference

Step 3

Anchors stored with fingerprints
SHA-256 hash locks the evidence

Step 4

Auditor opens the checklist
Each procedure mapped to its evidence

Step 5

PASS with a verifiable anchor
Cryptographic proof, not promises

Your auditor can independently verify any anchor at sovereign.tenova.io/verify by entering the fingerprint. No account required. No network dependency. The math either checks out or it doesn't.

5. The Protocol, Not the Platform

SWT3 is an open cryptographic protocol, not a vendor platform. The fingerprint formula is published. The SDK is Apache 2.0. Any party can independently verify an anchor using nothing more than SHA-256 -- the same hash function that secures every Bitcoin transaction and TLS certificate on the internet.

Your auditor does not need an account, a subscription, or any relationship with TeNova to verify your evidence. The protocol is designed so that trust is derived from mathematics, not from any vendor relationship.

The Unified Control Taxonomy maps 80 AI procedures across 16 regulatory frameworks, including EU AI Act, NIST AI RMF, CMMC, and SR 11-7. Each procedure has a published definition, assessment methodology, and framework crosswalk. The registry is open and namespace-aware.

Get Started

Quickstart Guide -- add witness anchors to your AI client SDK Documentation -- full API reference (Python and TypeScript) Assessment Mapping -- procedures mapped to regulatory frameworks Assessment Checklist -- auditor-ready procedure checklist Anchor Verifier -- independently verify any witness anchor

Auditor Walkthrough Guides

Notified Body Auditor Walkthrough C3PAO CMMC Assessment Guide ISSM RMF Continuous Monitoring Guide AO RMF Authorization Guide