FactSheets document what IBM's platform knows. SWT3 witnesses what your agents actually did, across every provider, every tool call, every delegation chain.
Who this is for: Enterprise teams building multi-agent systems on IBM watsonx Orchestrate. Compliance leads in financial services (SR 11-7), healthcare, and regulated industries. Model risk managers evaluating independent validation tools for agent orchestration.
watsonx Orchestrate coordinates agents that call tools, delegate to sub-agents, and make decisions with real-world consequences. IBM provides governance through watsonx.governance, AI FactSheets, and OpenPages integration. These tools record IBM's platform-level view.
But agents cross boundaries. A watsonx Orchestrate agent may call a non-IBM tool, delegate to a model hosted on a different cloud, or access a third-party API. At every boundary crossing, IBM's governance goes silent. The FactSheet records the agent's existence. It does not record what the agent did when it left IBM's platform.
SWT3 is the cross-platform witness layer that travels with your evidence regardless of vendor. It records every inference, tool call, delegation, and access decision as a tamper-evident anchor that belongs to you, not to IBM. FactSheets document. SWT3 witnesses. Together they create the complete evidentiary chain. Apart, each has a blind spot.
| Capability | Description | Governance Relevance |
|---|---|---|
| Agent Orchestration | Multi-agent coordination with workspace context sharing | Who decided what, when, in what order |
| SKILL.md Skills | File-based skill definitions with executable scripts | Declared capabilities vs actual behavior |
| Nested Agent Calls | Agent-to-agent delegation for hierarchical tasks | Delegation chain accountability |
| Workspace Context | Shared state across all agents in an orchestration | Memory management and context provenance |
| watsonx.governance | Platform-level AI governance with risk monitoring | IBM's internal governance record |
| AI FactSheets | Automated model/agent metadata capture | Ownership, lineage, and deployment status |
| OpenPages Integration | Enterprise GRC platform bridge | SR 11-7 model risk management alignment |
| Granite Guardian | Safety classifier for agent output | Guardrail enforcement evidence |
IBM FactSheets capture metadata about models and agents on IBM's platform. SWT3 captures evidence about what those agents did in production. This table shows where each adds value.
| IBM FactSheet Field | SWT3 Procedure | What SWT3 Adds |
|---|---|---|
| Model ownership | AI-ID.1 | Per-inference identity binding, not just registration |
| Intended use | AI-SKILL.1 | Runtime skill manifest hash, not declared intent |
| Deployment status | AI-INF.1 | Actual inference evidence, not deployment timestamp |
| Performance metrics | AI-DRIFT.1 | Continuous drift measurement, not periodic snapshots |
| Fairness evaluation | AI-FAIR.1 | Per-inference bias check evidence, not batch reports |
| Lineage trail | AI-CHAIN.1 | Full delegation chain across vendors, not IBM-only |
| Risk classification | AI-VIO.1 | Real-time violation recording, not post-hoc classification |
| Approval workflow | AI-HITL.1 | Cryptographic proof of human override, not workflow status |
Each time a watsonx Orchestrate agent calls a model, the inference is witnessed. The FactSheet records that the agent exists. SWT3 witnesses every single inference the agent made, with prompt and response hashes, latency, and token counts.
Query AI-INF.1 anchors filtered by agent_id. Verify inference volume aligns with expected agent activity. Cross-reference model_id against the declared model roster.
watsonx Orchestrate registers agents at orchestration time. SWT3 binds a persistent agent_id to every anchor minted by that agent. The FactSheet records agent registration. SWT3 witnesses that a specific agent produced specific outputs, creating an unbroken identity chain across all its actions.
Verify each agent has a unique agent_id in the witness ledger. Confirm that agent_id values are consistent across the deployment lifecycle.
watsonx Orchestrate defines agent capabilities through SKILL.md files. SWT3's witness_skill_manifest() hashes the skill definition at invocation time, creating evidence that the skill an agent claimed to execute is the skill that was actually loaded. The platform registers skills. SWT3 witnesses that the skill definition did not change between registration and execution.
Query AI-SKILL.1 anchors. Compare skill manifest hashes across time windows to detect unauthorized skill modifications.
watsonx Orchestrate shares workspace context across agents. SWT3's witness_memory_context() records the context hash at each agent handoff, proving what information was available to each agent when it made its decision. The platform manages context. SWT3 witnesses the exact context each agent received.
Query AI-SKILL.2 anchors to verify context hashes are consistent within a single orchestration chain (shared cycle_id).
When an Orchestrate agent calls an external tool (API, database, file system), SWT3's wrap_tool() records the tool name, input hash, and output hash. The platform logs tool availability. SWT3 witnesses every individual invocation and its result.
Query AI-TOOL.1 anchors. Verify that tool calls match the agent's declared skill manifest. Flag any undeclared tool invocations.
Each agent's access to external resources (APIs, databases, services) should be witnessed. SWT3's wrap_access() records the access target, whether access was granted, and the declared authorization scope. IBM controls agent permissions. SWT3 witnesses whether the agent stayed within its declared scope.
Query AI-ACC.1 anchors. Verify that access targets match the agent's declared authorization scope. Flag access attempts to undeclared resources.
When watsonx Orchestrate agents delegate to sub-agents, the full chain must be traceable. SWT3's chain() context manager links all anchors within a delegation sequence using a shared cycle_id. The platform orchestrates the chain. SWT3 witnesses every link in it, including links that cross vendor boundaries.
Query anchors by cycle_id to reconstruct the full delegation chain. Verify that no gaps exist between agent handoffs.
Each delegation event between agents is witnessed as a separate anchor, recording the delegating agent, the receiving agent, and the task description hash. The platform routes delegation. SWT3 witnesses who delegated to whom and when.
Query AI-DEL.1 anchors. Verify delegation patterns match the declared orchestration topology (sequential, hierarchical, or mesh).
For high-risk agent decisions, watsonx Orchestrate supports step-level approval gates. SWT3 witnesses each human override decision as a tamper-evident anchor. The platform records approval status. SWT3 witnesses that a specific human approved a specific action at a specific time, with cryptographic proof.
Query AI-HITL.1 anchors for high-risk decisions. Verify that human override was obtained before the agent proceeded.
When agent behavior triggers an automated escalation (confidence threshold, anomaly detection, policy violation), SWT3 witnesses the trigger event and the subsequent review. The platform triggers escalation. SWT3 witnesses that escalation actually happened.
Query AI-HITL.2 anchors. Verify trigger events were followed by corresponding AI-HITL.1 human review anchors.
When Granite Guardian is deployed as a safety filter for Orchestrate agents, each Guardian verdict is witnessed. The platform runs Guardian. SWT3 witnesses that Guardian was consulted for every agent output.
Query AI-GRD.1 anchors by agent_id. Verify Guardian checks occur at the same frequency as AI-INF.1 inference anchors.
SWT3 witnesses whether each agent operated within its declared behavioral boundaries. When boundaries are configured, every inference is evaluated against the boundary definition. The policy defines boundaries. SWT3 witnesses whether the agent stayed inside them.
Query AI-SAFE.1 anchors. Verify boundary definitions are consistent across the deployment window. Flag any boundary violations.
When an agent is interrupted (manual kill, timeout, safety violation), SWT3 witnesses the interruption event, including the reason and the state at interruption. The platform handles shutdown. SWT3 witnesses that shutdown actually occurred and captures the agent's state at that moment.
Query AI-SAFE.2 anchors. Verify interruption reasons are documented and that no inference anchors appear after the interrupt timestamp.
SWT3's witness_behavioral_baseline() records the establishment and monitoring of each agent's behavioral envelope. Drift from baseline triggers evidence. The platform defines expected behavior. SWT3 witnesses whether actual behavior matched expectations.
Query AI-BASE.1 anchors. Verify baseline establishment occurred before production deployment. Check for drift events.
watsonx.governance monitors drift at the model level. SWT3 monitors drift at the orchestration level, capturing changes in agent behavior patterns, delegation frequencies, and tool usage over time.
Query AI-DRIFT.1 anchors. Verify drift monitoring covers both individual agent models and orchestration-level behavior patterns.
In multi-agent systems, bias can emerge from individual models or from orchestration patterns (e.g., routing certain demographics to different agent chains). SWT3 witnesses bias evaluations at both the individual agent and orchestration levels.
Query AI-FAIR.1 anchors. Verify fairness evaluations were conducted across all agent decision points, not just individual models.
SWT3's witness_audit_integrity() records audit log integrity checks, verifying that agent activity logs are complete and untampered. The platform generates logs. SWT3 witnesses that the logs themselves are intact.
Query AI-AUDIT.1 anchors. Verify log integrity checks are conducted at the declared frequency and that no gaps are detected.
When an agent violates a configured policy (access scope, output content, rate limit), SWT3 witnesses the violation with severity, description, and detection method. The platform may catch violations. SWT3 records them as tamper-evident evidence independent of the platform that produced them.
Query AI-VIO.1 anchors. Verify that violations triggered the declared response procedures (escalation, interruption, or remediation).
| Procedure | Orchestration | Skills | Delegation | Safety | Audit |
|---|---|---|---|---|---|
| AI-INF.1 Inference | ✓ | ✓ | ✓ | ||
| AI-ID.1 Agent Identity | ✓ | ✓ | |||
| AI-SKILL.1 Skill Manifest | ✓ | ||||
| AI-SKILL.2 Memory Context | ✓ | ✓ | |||
| AI-TOOL.1 Tool Call | ✓ | ||||
| AI-ACC.1 Resource Access | ✓ | ✓ | |||
| AI-CHAIN.1 Multi-Agent Chain | ✓ | ✓ | |||
| AI-DEL.1 Delegation | ✓ | ✓ | |||
| AI-HITL.1 Human Override | ✓ | ✓ | |||
| AI-HITL.2 Review Trigger | ✓ | ✓ | |||
| AI-GRD.1 Guardrail | ✓ | ||||
| AI-SAFE.1 Safety Boundary | ✓ | ||||
| AI-SAFE.2 Agent Interrupt | ✓ | ||||
| AI-BASE.1 Baseline | ✓ | ✓ | |||
| AI-DRIFT.1 Drift | ✓ | ✓ | |||
| AI-FAIR.1 Bias Detection | ✓ | ✓ | |||
| AI-AUDIT.1 Audit Log | ✓ | ||||
| AI-VIO.1 Violations | ✓ | ✓ |
IBM positions watsonx heavily in financial services, where SR 11-7 (Guidance on Model Risk Management) sets the regulatory bar. watsonx.governance integrates with OpenPages to deliver the model inventory and risk classification that bank examiners expect.
SWT3 adds the independent validation layer that SR 11-7 requires. Examiners ask three questions about model risk:
agent_id binding (AI-ID.1) provides the independent verification.For detailed SR 11-7 procedure mappings, see the SR 11-7 Overlay Guide.
Python
from swt3_ai import Witness
witness = Witness(
endpoint="https://sovereign.tenova.io/api/v1/witness",
api_key="axm_live_...",
agent_id="loan-orchestrator",
)
# Chain links all anchors with a shared cycle_id
with witness.chain("loan-approval-2847") as ctx:
# Step 1: Credit check agent runs
witness.witness_skill_manifest(
skill_count=3, skills_declared=3, manifest_hash="a1b2c3...",
)
# Step 2: Delegate to fraud detection
witness.witness_delegation(
delegating_agent="loan-orchestrator",
receiving_agent="fraud-detector",
task_hash="d4e5f6...",
)
# Step 3: Human review for high-value loans
witness.witness_human_override(
decision="approved", reviewer_hash="g7h8i9...",
override_type="pre_decision",
)
# All anchors share ctx.cycle_id -- one query reconstructs the full chain
witness.flush()
TypeScript
import { Witness } from "@tenova/swt3-ai";
const witness = new Witness({
endpoint: "https://sovereign.tenova.io/api/v1/witness",
apiKey: "axm_live_...",
agentId: "loan-orchestrator",
});
const ctx = witness.chain("loan-approval-2847");
// Step 1: Credit check agent runs
witness.witnessSkillManifest({
skillCount: 3, skillsDeclared: 3, manifestHash: "a1b2c3...",
});
// Step 2: Delegate to fraud detection
witness.witnessDelegation({
delegatingAgent: "loan-orchestrator",
receivingAgent: "fraud-detector",
taskHash: "d4e5f6...",
});
// Step 3: Human review for high-value loans
witness.witnessHumanOverride({
decision: "approved", reviewerHash: "g7h8i9...",
overrideType: "pre_decision",
});
ctx.end();
await witness.flush();
The loan approval chain is now a tamper-evident sequence. An auditor queries by cycle_id and sees: credit check, fraud delegation, human approval. Every step anchored. Every handoff witnessed. Every decision provable.