Enterprise Evaluation Guide -- Validate AI Compliance Posture with SWT3 Witness Anchors

This guide is for providers and deployers evaluating SWT3 integration. Assessment bodies (Notified Bodies, C3PAOs, auditors): see the Assessor Onboarding Kit instead.

Executive Summary

SWT3 generates cryptographic witness anchors for every AI inference, governance decision, tool access, and agent handoff in your systems. These anchors are independently verifiable by any assessor using standard SHA-256 -- no proprietary tooling required. Evidence maps to 36 regulatory frameworks including the EU AI Act (Art. 9-15 and GPAI Art. 51-56), NIST AI RMF, CMMC, and ISO/IEC 42001.

An evaluation takes 14 days, scoped to a single AI system. Total time investment: approximately 10 hours (4 engineering, 6 compliance). Start on the OPEN tier (free, limited to 3 procedures and 100 anchors/month) or go directly to PRO for full procedure coverage.

3 lines of code. 10 hours total. Zero lock-in.
Integrate the SDK, review the evidence, export everything.

Data Handling

Hashes only. No PII. No model weights. No prompts. No responses.

Raw data never leaves your infrastructure. Only cryptographic hashes and numeric factors cross the wire.

What Crosses the Wire	What Stays in Your Infrastructure
SHA-256 fingerprint (12 hex characters)	Raw prompts and user inputs
Three numeric factors (integers)	Raw model responses
Clearing level (0-3)	Model weights and parameters
Timestamp (millisecond epoch)	Training data
Procedure ID (e.g., AI-INF.1)	PII and sensitive content
Prompt/response SHA-256 hashes (16 hex chars, Level 0-2 only)	System prompts
Model ID string (Level 0-2 only)	Embedding vectors

You control what metadata accompanies each anchor by setting the clearing level. At Level 1 (default), raw evidence is purged at the source before anything is transmitted. At Level 3, even the model identity is hashed.

Time Commitment

Week 1: Integration

Engineering: ~4 hours

Install SDK (pip or npm, 1 minute)
Add 3 lines of code to wrap your AI client
Run first inference and verify anchor receipt
Configure clearing level and procedure coverage

Week 2: Review

Compliance: ~6 hours

Review anchor chain and procedure coverage
Generate Compliance Passport
Run gap analysis against target framework
Export evidence package (JSON, OSCAL, HTML)

Deliverables

Deliverable	Format	Description
Compliance Passport	HTML, signed JSON, or W3C VC	Signed summary of compliance posture with evidence digest
Anchor Chain	JSON export	Complete history of witness anchors with factors and verdicts
Gap Report	HTML	Procedure coverage analysis against your target framework
Framework Checklist	HTML	EU AI Act, NIST AI RMF, CMMC, or other framework-specific checklist
OSCAL Artifacts	XML (validated)	NIST oscal-cli validated assessment results package

For Model Providers: Downstream Deployer Evidence

If your organization distributes AI models to third parties -- whether through open-weight distribution, API access, cloud platform hosting, or embedded integration -- you face a common challenge:

How do you prove downstream deployers are using proper guardrails, without accessing their infrastructure?

The SWT3 solution:

Downstream deployers integrate the SWT3 SDK (3 lines of code).
Anchors flow to the deployer's own tenant, maintaining data isolation.
You query aggregated coverage metrics across deployer tenants via API.
You see: procedure coverage percentage, verdict distribution, clearing levels. You never see raw deployer data, prompts, responses, or model configurations.

This pattern works identically across all distribution models:

Distribution Model	Your Role	How Deployers Use SWT3
Open-weight	You distribute model weights for local deployment	Deployers witness their local inference with their own tenant
API access	You serve model inference via API	Deployers witness their API calls with their own tenant
Cloud platform	You host models on your cloud infrastructure	Deployers witness through your platform's SDK integration
Embedded	Your model is integrated into your application	Deployers witness their use of your application's AI features

Cross-provider interoperability. A deployer building on models from multiple providers uses one SWT3 integration for all of them. The same anchors, minted under the deployer's tenant, can serve all provider relationships. No per-provider compliance systems needed.

Exit Path

All data exportable -- JSON, OSCAL, HTML. No proprietary formats.
No lock-in -- Anchors use standard SHA-256. Fingerprints are recomputable by any party without our platform.
Delete on request -- Tenant and all associated anchors deleted permanently.
No contractual minimum for OPEN tier -- use it indefinitely at no cost.
Portable evidence -- Anchors minted during an evaluation remain valid and verifiable even after leaving the platform.

Support Model

Track	What You Get	Contact
Self-Serve (OPEN tier)	SDK documentation, 177+ guides, public verifier, community support	sovereign.tenova.io/docs
Guided Evaluation	Single point of contact, weekly check-in, 3 structured review sessions	pilot@tenovaai.com

Pricing Transparency

OPEN

Free

7-day anchor retention
3 AI procedures
100 anchors/month
Public verifier access

PRO

$499/mo

90-day retention
All 114 procedures
Unlimited anchors
Compliance Passport
Annual: $4,990/yr

ENCLAVE

$9,500/mo

365-day retention
W3C Verifiable Credentials
OSCAL validated exports
Deployer evidence aggregation
Annual: $102,000/yr

Security and Privacy

Measure	Detail
Transport security	TLS 1.3 with HSTS. HTTP/2.
Data at rest	No raw data stored. Only hashes, factors, and anchor metadata.
Authentication	API key (axm_*) per tenant. Supabase Auth for dashboard.
Data residency	US (default). EU options available for Enclave+ tier.
Clearing guarantee	At Level 1+, raw prompts/responses are purged at the SDK before transmission. Irreversible.

Integration Effort

from swt3_ai import Witness
from openai import OpenAI

witness = Witness(
    endpoint="https://sovereign.tenova.io",
    api_key="axm_live_...",
    tenant_id="YOUR_TENANT",
)

client = witness.wrap(OpenAI())

# Use client exactly as before -- witnessing happens automatically
response = client.chat.completions.create(
    model="gpt-4o",
    messages=[{"role": "user", "content": "Hello"}],
)
print(response.choices[0].message.content)

import { Witness } from "@tenova/swt3-ai";
import OpenAI from "openai";

const witness = new Witness({
  endpoint: "https://sovereign.tenova.io",
  apiKey: "axm_live_...",
  tenantId: "YOUR_TENANT",
});

const client = witness.wrap(new OpenAI());

// Use client exactly as before -- witnessing happens automatically
const response = await client.chat.completions.create({
  model: "gpt-4o",
  messages: [{ role: "user", content: "Hello" }],
});
console.log(response.choices[0].message.content);

For the complete setup guide including dashboard walkthrough, framework selection, and troubleshooting FAQ, see the Technical Setup Guide.

Full SDK documentation with 21 adapter examples (OpenAI, Anthropic, Bedrock, LiteLLM, Vercel AI SDK, and more): sovereign.tenova.io/docs

Audit Portal Demo

During the evaluation, your compliance team can access a demo audit portal showing what assessors and Notified Bodies see when reviewing SWT3 evidence. The portal includes:

Interactive control matrix with per-control evidence, factors, and inheritance details
EU AI Act conformity section with per-article compliance status and enforcement countdown
Forensic timeline with lifecycle chain reconstruction, agent legend, and drift markers
Finding register, evidence requests, and assessment interview tracking
Export options: Assessment Report (Annex V format), Audit Package, Work Papers PDF
Guided walkthrough for first-time users

The demo portal uses the same anchors and evidence your SDK integration produces. This gives your compliance team visibility into the assessor experience before committing to a production deployment. See the Assessor Onboarding Kit for the full portal walkthrough.