No account. No software. Just SHA-256.
Your client's anchors will use their own tenant ID and procedure IDs. The verification process is identical -- only the input values change.
SWT3 witness anchors prove that specific operational controls were active at a specific point in time. They do not replace the assessor's independent judgment, professional expertise, or regulatory authority. Assessors must verify that anchored evidence is sufficient, appropriate, and relevant to the specific assessment context. Each regulatory framework retains its own assessment authority, methodology, and determination standards.
Every SWT3 Witness Anchor encodes its compliance context directly in the string. Each segment is color-coded below:
Both PASS and FAIL anchors are independently verifiable. Failures in the ledger demonstrate the system is honest, not optimistic. A deployment with zero FAILs should prompt additional scrutiny, not confidence.
When you paste an anchor into the public verifier, this is what you will see:
If the anchor has been tampered with, the verifier shows a clear failure:
Changing any single input produces a completely different fingerprint. Here is a side-by-side comparison:
2e16e2fe92ddcompletely differentChanging factor_a from 1 to 0 (a single character) produces an entirely different SHA-256 digest. There is no way to modify evidence and preserve the original fingerprint.
No tools required. Paste the anchor string and get an instant result. Works on any device with a browser.
Maximum independence. No network request required -- runs entirely on your machine.
For assessors on locked-down Windows laptops. No software installation needed.
For assessors with Python available. Works with Python 3.6+.
SHA-256 is a NIST-standardized algorithm (FIPS 180-4). Every implementation -- browser, terminal, PowerShell, Python, hardware module -- produces identical output for identical input. There is no proprietary component in SWT3 verification.
Verification confirms evidence integrity. Assessment determination -- whether the evidence is sufficient, appropriate, and relevant -- remains the assessor's professional responsibility.
An anchor token contains the fingerprint but not the inputs needed to recompute it. To verify independently, request the witness payload JSON from the client. This is available via:
Each procedure defines what factor_a, factor_b, and factor_c represent. These are not generic -- they carry procedure-specific meaning. The factor conventions below are defined by the SWT3 SDK. Verify with the client that their implementation follows these conventions -- ask for their factor mapping document if it differs from the defaults.
| Procedure | factor_a | factor_b | factor_c |
|---|---|---|---|
AI-INF.1 | Model responded (1=yes) | Guardrails active (1=yes) | Anomaly detected (0=no) |
AI-DRIFT.1 | Metric identifier | Observed drift magnitude | Configured threshold |
AI-FAIR.1 | Protected attribute | Disparity ratio | Acceptable threshold |
AI-GOV.1 | Policy version | Compliance status (1=compliant) | Days since last review |
AI-HITL.1 | Reviewer identity hash | Decision (1=approved) | Review duration (seconds) |
For the full procedure catalog with factor definitions, see the UCT Registry (240 procedures, searchable).
When referencing SWT3 anchor verification in your assessment report, the following template provides a consistent citation format:
"The assessor independently verified SWT3 Witness Anchor [full token] using SHA-256 fingerprint recomputation (FIPS 180-4). The anchor confirms that procedure [procedure ID] was evaluated on [human-readable date] with verdict [PASS/FAIL]. Factor values: [factor_a description] = [value], [factor_b description] = [value], [factor_c description] = [value]. Verification method: [web verifier / terminal / PowerShell]. Result: fingerprint match confirmed -- evidence integrity verified."
Adapt the template to your report format and framework requirements. The key elements are: the full anchor token (for reproducibility), the verification method used, and the confirmation that the fingerprint matched.
This guide documents evidence format and verification procedures. It does not prescribe assessment methodology. Sample sizes, sufficiency determinations, and assessment conclusions remain the assessor's professional responsibility under their applicable accreditation and regulatory requirements.