TeNova

Pilot Onboarding Checklist

From Agreement to First Anchor in 48 Hours

Home / Guides / Pilot Onboarding

CRITICAL ASSESSOR NOTICE: This guide is published by the platform vendor (Tenable Nova LLC). Assessors must independently verify all claims against primary regulatory texts and their own professional judgment. SWT3 creates evidence records; it does not make compliance determinations.

Audience: Technical leads, compliance stakeholders, and executive sponsors participating in an SWT3 pilot evaluation. Print this page, check the boxes, and hand it to your implementation team.

1. Purpose

This checklist covers every step from signed pilot agreement to your first verified SWT3 Witness Anchor. Print it, check the boxes, hand it to your technical lead. Total time: under 48 hours. For the full narrative explanation of the pilot program, evaluation criteria, and expected outcomes, see the Pilot Program Guide.

2. Phase 1: Legal and Administrative (Before Day 1)

Complete these items before any technical work begins. Contact engineering@tenovaai.com with any questions.

Tip: We recommend identifying a single AI system with a known inference endpoint (OpenAI, Anthropic, Bedrock, vLLM, Ollama, or any OpenAI-compatible API). Expanding to additional systems is straightforward after the first anchor is verified.

3. Phase 2: Technical Prerequisites (Day 1)

Confirm these items with your technical lead before installing the SDK.

Clearing Level Reference

Level Name What is recorded Recommendation
0 Analytics Hashes, factors, model name, provider Internal analytics, no regulatory constraint
1 Standard Hashes, factors, model name RECOMMENDED for most pilots
2 Sensitive Hashes and factors only Healthcare, legal, PII-adjacent workloads
3 Classified Numeric factors only, model name hashed Defense, classified environments

Network Verification

Run this command to confirm connectivity:

curl -s https://sovereign.tenova.io/api/v1/health | python3 -m json.tool

Expected output includes "status": "healthy" and a recent lastScan timestamp. If this command fails, check firewall rules for outbound HTTPS (port 443) to sovereign.tenova.io.

4. Phase 3: Account and SDK Setup (Day 1)

Python

pip install swt3-ai

Verify installation:

python -c "import swt3_ai; print(swt3_ai.__version__)"

TypeScript / Node.js

npm install @tenova/swt3-ai

Verify installation:

node -e "const s = require('@tenova/swt3-ai'); console.log('swt3-ai installed')"
API key security: The API key is displayed exactly once during signup. We recommend storing it in your secrets manager or environment variables immediately. If lost, generate a new key from the Settings page (the old key cannot be recovered).

5. Phase 4: First Witness (Day 1-2)

Python Example (OpenAI)

from openai import OpenAI
from swt3_ai import Witness

witness = Witness(
    endpoint="https://sovereign.tenova.io",
    api_key="YOUR_KEY",
    tenant_id="YOUR_TENANT",
    clearing_level=1
)
client = witness.wrap(OpenAI())

# Every inference through this client now produces a witness anchor
response = client.chat.completions.create(
    model="gpt-4o",
    messages=[{"role": "user", "content": "Summarize our Q3 risk report."}]
)

TypeScript Example (OpenAI)

import OpenAI from "openai";
import { Witness } from "@tenova/swt3-ai";

const witness = new Witness({
  endpoint: "https://sovereign.tenova.io",
  apiKey: "YOUR_KEY",
  tenantId: "YOUR_TENANT",
  clearingLevel: 1,
});
const client = witness.wrap(new OpenAI());

const response = await client.chat.completions.create({
  model: "gpt-4o",
  messages: [{ role: "user", content: "Summarize our Q3 risk report." }],
});
What just happened? The wrap() call returns a proxy that intercepts every inference. It computes a SHA-256 fingerprint, assigns the appropriate UCT procedure (AI-INF.1), records the clearing-level-appropriate evidence factors, and transmits the SWT3 Witness Anchor to the ledger. Your AI provider call is unmodified -- same latency, same response, same error handling.

6. Phase 5: Verification (Day 2)

The verification page runs entirely in your browser using client-side SHA-256 computation. No inference content is transmitted during verification. Your compliance stakeholder can verify any anchor independently without a login.

7. You Are Ready When

Success criteria -- all four items must be true before your kickoff session:

Once these four criteria are met, you are ready for the pilot evaluation sessions. The kickoff covers dashboard orientation, clearing level confirmation, and evidence mapping to your target framework. See the Pilot Program Guide for the full session schedule.

8. Stakeholder Handoff Matrix

Use this table to assign responsibilities across your team. Each role has distinct tasks -- overlap is intentional for the compliance stakeholder.

Role Responsibilities When
Legal Signs Pilot Agreement, reviews DPA and clearing addendum Before Day 1
Technical Lead Installs SDK, wraps client, verifies first anchor Day 1-2
Compliance / Assessment Reviews dashboard, selects clearing level, attends all 3 sessions Day 1 through Day 10
Executive Sponsor Approves budget, attends findings session Day 8-10

9. Related Documents