VP
VERIPASSDOCS
v1.0 Dashboard → Take the Tour →
LIVE — v1.0

The Certification Authority
for Enterprise AI

Six-dimension behavioral certification with cryptographic proof, continuous compliance monitoring, and court-ready evidence — in 14ms.

14ms certification Ed25519 signed 19 frameworks 6 dimensions 5-tier RRC engine

01Product Overview

VeriPass is the certification authority for enterprise AI. Every AI response passes through a six-dimension behavioral envelope, a multi-tier coherence engine, and a cryptographic proof layer — producing a signed, immutable certification record in under 14 milliseconds.

CERTIFY
Six behavioral dimensions scored against configurable thresholds with per-deployment policy overrides
SCORE
Weighted composite BCS with floor enforcement, multi-tier coherence analysis, and multi-tier content classification
PROVE
Ed25519 signature, SHA-256 content hash, Merkle tree block sealing, and custody chain for court-ready evidence

Verdict Outcomes

Every certification produces one of three verdicts based on the composite Behavioral Compliance Score (BCS) and dimension floor enforcement:

CERTIFIED FLAGGED FAILED
VerdictConditionAction
CERTIFIEDBCS ≥ threshold AND all dimension floors passResponse allowed, record sealed
FLAGGEDBCS near threshold OR one floor marginally breachedResponse allowed with monitoring flag
FAILEDBCS below threshold OR critical floor violationResponse quarantined, incident generated
INFO

Each certification record is cryptographically signed with Ed25519 and sealed into Merkle tree blocks of 100 certificates. The complete chain is independently verifiable without VeriPass infrastructure.

Platform Capabilities

Beyond the core certification pipeline, VeriPass Enterprise provides a comprehensive suite of AI governance tools — 33+ route files, 1,056+ tests (151 unit + 789 integration + 116 chain certification), and a completed 10-phase security audit.

GOVERNANCE
AI Governance Score
Board-ready composite organizational score (0–1000) aggregating behavioral compliance, certification velocity, deployment health, and framework coverage into a single executive metric.
FORECASTING
Predictive Drift Detection
Linear regression behavioral forecasting that identifies certification score trajectories before they breach thresholds — catching drift days before it becomes a compliance gap.
IDENTITY
Behavioral Fingerprinting
Model DNA signatures that detect silent changes in AI behavior. Fingerprints capture dimensional response patterns to identify when a model has been updated, swapped, or fine-tuned.
COMPLIANCE
Regulatory Auto-Remediation
One-click compliance gap fixes. When a framework requirement is unmet, VeriPass generates the exact configuration change needed and applies it with a single action.
INTELLIGENCE
Ask VeriPass
Natural language governance intelligence queries. Ask questions like "Which deployments failed boundary compliance this week?" and get instant, data-backed answers.
CERTIFICATION
Live Certification (Prove It)
Send real prompts and get real certifications in real time. The public trust endpoint at verify.veripass.ai lets anyone verify AI behavioral compliance independently.
DIAGNOSTICS
AI Root Cause Analysis
Automatic plain-English failure explanations. When a certification fails, VeriPass identifies the root cause, classifies the deviation pattern, and recommends specific remediation steps.
POLICY
AI Policy Wizard
AI-generates behavioral contracts from policy documents. Upload your governance policies and VeriPass extracts dimension floors, framework requirements, and alerting thresholds automatically.
TESTING
Adversarial Probe Generator
Automated behavioral boundary testing. Generates certification stress probes designed to find the edges of your AI's behavioral envelope before production exposure.
REPORTING
Behavioral Trend Narration
AI-generated weekly intelligence briefings. Transforms raw certification data into executive-ready narrative summaries with trend analysis, anomaly callouts, and recommended actions.
OPTIMIZATION
Calibration Advisor
Optimal threshold recommendations derived from shadow mode data. Analyzes your certification history to suggest dimension floors and BCS thresholds that balance compliance rigor with operational throughput.

02Architecture

VeriPass Enterprise uses a layered pipeline architecture. Every API call flows through authentication, rate limiting, behavioral certification, compliance evaluation, cryptographic signing, and evidence sealing — all within a single request/response cycle.

INGESTION LAYER
API Gateway
Express 4 with JWT + API key authentication, per-key rate limiting (100 req/min), request validation via JSON Schema, and org-scoped multitenancy.
CERTIFICATION ENGINE
Behavioral Envelope
Six dimensions scored in parallel: factual grounding, boundary compliance, semantic fidelity, response stability, topical adherence, and information safety.
COHERENCE ENGINE
RRC 2.0 Coherence Engine
Multiple independent evaluation tiers measuring semantic alignment, structural coherence, entity fidelity, bag-of-words analysis, and temporal drift detection — with heuristic penalties applied on top.
CONTENT ANALYSIS
Five-Tier Classification
Tier 1: Enhanced Pattern Heuristics (30+ PII patterns, 50+ manipulation patterns, SCADA/ICS). Tier 2: NLP via compromise.js. Tier 3: LLM-as-Judge via Claude.
CRYPTO LAYER
Immutable Proof
Ed25519 signatures via tweetnacl, SHA-256 content hashing, Merkle tree block sealing, timestamp proofs, and chain-linked blocks with genesis anchoring.
COMPLIANCE LAYER
19 Frameworks
Automatic evaluation against EU AI Act, NIST AI RMF, ISO 42001, SOC 2, HIPAA/HITECH, PCI DSS v4.0, SOX, NERC CIP, GDPR, CCPA/CPRA, FINRA/SEC, FTC Act, NYDFS Part 500, DORA, Quebec Law 25, US State Privacy Bundle, Colorado SB 205, Texas HB 1709, and Illinois AI Employment Act (AIEA).
TIP

The entire certification pipeline executes synchronously within ~14ms. Select coherence tiers run asynchronously after the response is returned for enhanced accuracy on subsequent certifications.


03Behavioral Dimensions

Every AI response is evaluated across six independent behavioral dimensions. Each dimension produces a 0.0–1.0 score, has a configurable weight, and enforces a minimum floor. If any floor is breached, the certification fails regardless of the composite score.

FG Factual Grounding BC Boundary Compl. SF Semantic Fidelity RS Response Stability TA Topical Adherence IS Information Safety Healthy Deployment (0.85–0.95) Degrading (IS/BC at 0.4–0.5)

Dimension Reference

DimensionCodeWeightFloorWhat It Measures
Factual GroundingFG0.200.60Claims anchored to verifiable source material
Boundary ComplianceBC0.200.70Adherence to system prompt constraints and deployment policy
Semantic FidelitySF0.150.60Meaning preservation between prompt intent and response content
Response StabilityRS0.100.50Consistency across repeated similar queries (requires history)
Topical AdherenceTA0.150.60Staying within the deployment's configured domain scope
Information SafetyIS0.200.75PII detection (30+ patterns), credential leakage, PHI, SCADA/ICS data

Score Interpretation

RangeInterpretationTypical Action
0.90–1.00Excellent — dimension fully compliantNo action required
0.75–0.89Good — within normal operating rangeStandard monitoring
0.60–0.74Marginal — approaching floor thresholdEnhanced monitoring, review deployment policy
Below 0.60Failing — floor breached in most configurationsCertification failure, incident auto-generated
WARNING

Information Safety (IS) has the highest default floor at 0.75. Any PII detection — SSN, credit card, medical record number — immediately drops IS below floor, triggering certification failure regardless of composite BCS.


04RRC Coherence Engine

The Request-Response Coherence (RRC) engine evaluates whether an AI response actually addresses the prompt it was given. Multiple independent evaluation tiers produce a weighted composite score, with heuristic penalties applied on top. The composite feeds into the Semantic Fidelity dimension.

PRIMARY
Semantic Alignment

Verifies the response meaningfully addresses the intent and meaning of the request.

CORE
Structural Coherence

Confirms response format and logical flow match what was asked. A list question must produce a list.

CORE
Entity Fidelity

Detects entity conflicts and ensures referenced entities are accurate and consistent with the prompt.

SIGNAL
Bag-of-Words Analysis

Cross-validates response relevance through independent lexical analysis.

SIGNAL
Temporal Drift Detection

Monitors for behavioral deviation across deployment history using SPC baselines.

Heuristic Penalty Layer

After the weighted composite is computed, heuristic penalties are applied for behavioral deviations including:

CheckFlag Raised
Question not directly answeredquestion_not_directly_answered
Format mismatch (asked for list, got prose)format_mismatch
Language mismatch (prompt/response differ)language_mismatch
Response too brief for detailed promptresponse_too_brief

Adaptive Evaluation

When a tier is unavailable, its weight is proportionally redistributed to available tiers. The engine always produces a valid composite score regardless of tier availability.

INFO

Select evaluation tiers run asynchronously after the sync response is returned. Subsequent certifications for the same deployment benefit from enriched evaluation data.


05Five-Tier RRC 2.0 Content Analysis

Content classification runs in parallel with behavioral scoring. Each tier adds progressively deeper analysis, with earlier tiers providing instant results and later tiers providing nuanced evaluation.

TIER 1 — PATTERN HEURISTICS
Enhanced Regex Engine
30+ PII patterns: SSN (with SSA validation), credit card (Luhn check), passport, driver's license, email, phone, IBAN, AWS keys, bearer tokens, private key blocks, connection strings.

50+ manipulation patterns: Instruction override, identity manipulation, jailbreak detection, system prompt extraction, delimiter attacks, encoded attacks, emotional manipulation.

SCADA/ICS patterns: Modbus, DNP3, OPC-UA, BACnet, PLC commands, HMI access, setpoint overrides, safety system disabling.

PHI patterns: Patient identifiers, ICD-10 codes, NDC drug codes, lab results, medical record numbers, DEA numbers.

Negation context: "Do not share your SSN" correctly identified as protective guidance, not PII leakage.
TIER 2 — NLP ANALYSIS
compromise.js Integration
Named entity recognition, sentiment analysis, and semantic role labeling. Catches PII and manipulation patterns that evade regex through paraphrasing, obfuscation, or creative reformulation. Runs inline (~2ms).
TIER 3 — LLM-AS-JUDGE
Claude-Powered Evaluation
Activated by enable_judge: true or configurable auto-trigger policies. The LLM evaluates nuanced cases where pattern matching is insufficient — subtle boundary violations, contextual appropriateness, and domain-specific compliance requirements. Results merged into dimension scores with configurable weight.

06Cryptographic Proof

Every certification record is cryptographically signed and sealed into an immutable audit chain. The system produces court-ready evidence that can be independently verified without VeriPass infrastructure. The public trust endpoint at verify.veripass.ai provides instant, independent certification verification for any stakeholder.

Signing Pipeline

STEP 1
Content Hash
SHA-256 of id|deployment_id|bcs|decision|timestamp produces a unique content fingerprint.
STEP 2
Ed25519 Signature
Sign payload id|bcs|decision|content_hash with server's Ed25519 private key via tweetnacl. 64-byte compact signature.
STEP 3
Chain Linking
Each cert's prev_hash points to the prior certification's content hash, forming a linked chain back to genesis.

Merkle Tree Block Sealing

Certifications are batched into blocks and sealed with a Merkle tree. Each block contains up to 200 certifications. The Merkle root is signed and chain-linked to the previous block.

MERKLE ROOT a7f3...9e2b BRANCH SHA-256(L+R) BRANCH SHA-256(L+R) LEAF cert_hash_1 LEAF cert_hash_2 LEAF cert_hash_3 LEAF cert_hash_4 BLOCK #N — prev_hash → Block #N-1 Ed25519 signed • timestamp proof • chain-linked

Certification Record Schema

JSON — Certification Record
{
  "id": "VP-2026-0305-A7K2",
  "deployment_id": "deploy_customer_support_v3",
  "timestamp": "2026-03-05T12:00:00.000Z",
  "bcs": 0.891,
  "decision": "certified",
  "dimensions": {
    "factual_grounding":   { "score": 0.92, "weight": 0.20 },
    "boundary_compliance": { "score": 0.95, "weight": 0.20 },
    "semantic_fidelity":   { "score": 0.88, "weight": 0.15 },
    "response_stability":  { "score": 0.84, "weight": 0.10 },
    "topical_adherence":   { "score": 0.87, "weight": 0.15 },
    "information_safety":  { "score": 0.97, "weight": 0.20 }
  },
  "coherence": 0.894,
  "content_hash": "a7f3c...SHA256",
  "prev_hash": "b8e2d...SHA256",
  "signature": "3fa9e...Ed25519",
  "block_id": "block_042"
}

Tamper Detection

Any modification to a certification record — changing the BCS, altering the decision, or modifying prompt/response content — invalidates the content hash. The invalid hash breaks the Ed25519 signature, the Merkle proof, and the chain link to subsequent blocks. All four verification layers must pass independently.

INFO

Why Ed25519? Fast, compact signatures (64 bytes) with strong security guarantees. Keys are small (32 bytes public, 64 bytes secret), and signing/verification is orders of magnitude faster than RSA. VeriPass supports key rotation and pluggable key providers (file, env, AWS KMS).


06bQuantum-Safe Cryptography

VeriPass is the first AI governance platform with quantum-safe cryptographic certification. Every certification record is dual-signed with both classical and post-quantum algorithms.

Architecture

VeriPass uses a hybrid signing architecture that provides both immediate security and future-proof quantum resistance:

INLINE (0ms overhead)
Ed25519 — Every certification is signed inline at creation time. Ed25519 provides ~0.01ms signing latency, ensuring zero impact on certification throughput.
BACKGROUND (async batch)
ML-DSA-65 — A background worker batch-signs certifications with the NIST post-quantum standard every 5 minutes. All records are quantum-safe within minutes of creation.

Algorithms

AlgorithmTypeStandardPurpose
Ed25519ClassicalRFC 8032Inline signing — fast, proven, widely supported
ML-DSA-65Post-QuantumNIST FIPS 204Quantum resistance — lattice-based, NIST standardized
SHA-256HashNIST FIPS 180-4Content hashing and Merkle tree construction

How It Works

  1. Certification created — Ed25519 signature applied inline. Record stored with quantum_safe = false.
  2. Background worker runs — Every 5 minutes, up to 500 unsigned records are batch-signed with ML-DSA-65.
  3. Record upgradedsignature_pqc, signing_algorithm, and quantum_safe fields updated.
  4. Verification — Both signatures independently verified. The double-shield badge () indicates quantum-safe status.

Why Quantum-Safe Matters

Certification records may need to remain verifiable for years or decades. A "harvest now, decrypt later" attack could compromise classical signatures once quantum computers become available. By dual-signing with ML-DSA-65 today, VeriPass ensures audit trail integrity against future quantum threats.

API: PQC Status

GET /api/v1/admin/pqc-status
{
  "total": 1247,
  "signed": 1223,
  "pending": 24,
  "percent": 98.1,
  "estimated_completion": "~5 minutes",
  "worker_active": true,
  "last_run": "2026-03-12T14:45:00.000Z",
  "last_result": {
    "signed": 24,
    "skipped": 0,
    "errors": 0,
    "elapsed_ms": 312
  }
}

Requires admin or super_admin role.

VCAS (VeriPass Certification Artifact Specification) v2.1 Cryptography Block

Quantum-safe certifications include an extended cryptography block in the VCAS artifact:

VCAS v2.1 — Cryptography
{
  "cryptography": {
    "algorithm": "hybrid-ed25519-mldsa65",
    "signature": "a1b2c3...",
    "signature_pqc": "d4e5f6...",
    "public_key": "07a8b9...",
    "public_key_pqc": "c0d1e2...",
    "content_hash": "sha256:...",
    "quantum_safe": true
  }
}

PLATFORM GUIDE
Dashboard Overview

Your command center at a glance. The top navigation bar provides four operational modes — MONITOR / INVESTIGATE / CONFIGURE / REPORTS — each surfacing the right tools for the task. Five hero metric cards, deployment health, recent certifications, and compliance posture — all in real time.

app.veripass.ai — Overview Dashboard
VERIPASS ENTERPRISE 2.0 ANTHROPIC LIVE SHADOW SUPER ADMIN MONITOR INVESTIGATE CONFIGURE REPORTS Dashboard Live Feed Compliance You have 6 active deployments. 172 certifications in the last 7 days. 41 FAILED verdicts detected. Compliance posture: 47% across 7 frameworks. PORTFOLIO TRUST SCORE 84 improving ACTIVE DEPLOYMENTS 6 2 production · 2 staging · 2 shadow CERTIFICATIONS (7D) 172 FAILURE RATE (7D) 23.8% COMPLIANCE POSTURE 47% WHAT NEEDS ATTENTION 124 interactions failed certification 191 flagged certifications DEPLOYMENT HEALTH Internal Operations AI 316 certs · 41 failed 86 R&D Assistant AI 135 certs · 16 failed 87 RECENT CERTIFICATIONS TIME DEPLOYMENT BCS DECISION 20h 10m ago Energy Operations AI 0.700 FLAGGED 20h 10m ago Healthcare Compliance AI 0.730 FLAGGED

Key Elements

PanelWhat It Shows
Portfolio Trust ScoreAnimated gauge with 7-day sparkline trend — your single executive metric
Active DeploymentsCount with stacked bar showing production/staging/shadow breakdown
Certifications (7D)Total certifications with sparkline and delta vs 7-day average
Failure RatePercentage with delta against rolling average
Compliance PostureMulti-ring gauge showing overall compliance across active frameworks
What Needs AttentionAmber cards surfacing compliance gaps and recent behavioral deviations
Deployment HealthPer-deployment BCS scores, certification counts, and trend indicators

08Certification Detail

Click any certification to open the detail modal — the complete record with grade badge, KPI cards, radar chart, and dimension-by-dimension breakdown with PASS/FAIL status.

Certification Detail — CERT-2026-03-001
F CERT-2026-03-001 FAILED Confidence: 94% 2026-03-03 11:47:23 UTC BCS 0.31 GRADE F RRC 0.88 SIGNED Ed25519 BEHAVIORAL ENVELOPE FG BC SF RS TA IS DIMENSION SCORE FLOOR STATUS Factual Grounding 0.91 PASS Boundary Compliance 0.89 PASS Semantic Fidelity 0.87 PASS Response Stability 0.12 HARD FAIL Topical Adherence 0.90 PASS Information Safety 0.88 PASS VERIFY EVIDENCE FORENSICS

09Forensics & Replay

The forensics view provides color-coded evidence replay, PII annotation highlighting, root cause analysis with pattern classification, and remediation recommendations.

Certification Forensics — REPLAY View
CERTIFICATION FORENSICS REPLAY DIMENSIONS CHAIN CONTEXT SIMILAR ROOT CAUSE PROMPT What is the current voltage at substation 7? RESPONSE — DEVIATION DETECTED The voltage at Substation 7 is 13.8 kV. For reference, the site engineer John Smith (SSN: 482-91-3847)... ROOT CAUSE ANALYSIS Information Disclosure Confidence: 94% PII detected in AI response — Social Security Number exposed without authorization. The AI model disclosed personal information that was present in its training context. Remediation: Enable PII filtering in deployment config. Add response safety guardrails.

10Audit Trail

Filter by verdict, search by deployment, and export certification records as CSV or PDF. The audit trail provides the complete history of every certification decision.

app.veripass.ai — Audit Trail
MONITOR INVESTIGATE Audit Trail All Certified Flagged Failed EXPORT CSV PDF REPORT TIME DEPLOYMENT BCS VERDICT SIGNATURE 2 min ago Energy Grid Operations AI 0.93 CERTIFIED Ed25519 1 min ago Energy Grid Operations AI 0.31 FAILED Ed25519

11Risk Heatmap

A deployment-by-dimension grid showing 7-day average scores. Color-coded cells instantly reveal which deployments have behavioral deviations in specific dimensions.

app.veripass.ai — Insights: Risk Heatmap
MONITOR INVESTIGATE Insights Risk Heatmap FG BC SF RS TA IS Energy Grid Operations AI 0.91 0.89 0.87 0.42 0.90 0.85 Patient Triage AI 0.74 0.82 0.71 0.88 0.68 0.80 Financial Advisor AI 0.58 0.45 0.72 0.76 0.51 0.69 R&D Assistant AI 0.93 0.91 0.89 0.94 0.92 0.90 Healthy (0.80+) At Risk (0.60-0.79) Critical (<0.60)

12Compliance Galaxy

A three-column grid of all 19 active compliance frameworks with a Posture Ring summary. Each framework card shows a network-graph constellation of its requirements, percentage score, requirements met, effective date, enforcement status badge, and quick links to audit evidence and reports. Red borders indicate active enforcement, amber borders indicate approaching enforcement deadlines.

app.veripass.ai — Compliance Galaxy
COMPLIANCE GALAXY 19 frameworks active In enforcement Enforcement approaching Proposed EU AI ACT 149 DAYS Regulation (EU) 2024/1689 72% 13/18 reqs met 2026-08-02 View Audit Evidence Export Report NIST RMF ACTIVE NIST AI 100-1 81% 15/19 reqs met 2023-01-26 View Audit Evidence Export Report ISO 42001 ACTIVE ISO/IEC 42001:2023 78% 14/18 reqs met 2023-12-18 View Audit Evidence Export Report SOC 2 ACTIVE AICPA TSC 2017 + AI 83% 17/20 reqs met 2022-10-15 View Audit Evidence Export Report HIPAA/HITECH ACTIVE 45 CFR Parts 160-164 76% 14/18 reqs met 2003-04-14 View Audit Evidence Export Report PCI DSS ACTIVE PCI DSS v4.0 74% 13/17 reqs met 2025-03-31 View Audit Evidence Export Report NERC CIP ACTIVE NERC CIP v7 69% 11/16 reqs met 2024-07-01 View Audit Evidence Export Report CO SB205 ACTIVE Colorado SB 21-205 80% 13/16 reqs met 2026-06-30 View Audit Evidence Export Report TX HB1709 ACTIVE Texas HB 1709 62% 9/15 reqs met 2026-01-01 View Audit Evidence Export Report IL AIEA ACTIVE Illinois AI Employment Act 58% 8/14 reqs met 2026-01-01 View Audit Evidence Export Report SOX ACTIVE Sarbanes-Oxley Act 2002 88% 15/17 reqs met 2002-07-30 View Audit Evidence Export Report GDPR ACTIVE Regulation (EU) 2016/679 78% 14/18 reqs met 2018-05-25 View Audit Evidence Export Report CCPA ACTIVE Cal. Civ. Code §1798 81% 13/16 reqs met 2020-01-01 View Audit Evidence Export Report STATE PRIVACY EVOLVING Multi-state Privacy Laws 77% 10/13 reqs met Varies by state View Audit Evidence Export Report FINRA ACTIVE FINRA Rules 2210 / 3110 84% 16/19 reqs met 2024-03-18 View Audit Evidence Export Report FTC ACTIVE FTC Act §5 + AI Guidelines 88% 15/17 reqs met 2024-09-01 View Audit Evidence Export Report QUEBEC LAW 25 ACTIVE Quebec Bill 64 / Law 25 73% 11/15 reqs met 2024-09-22 View Audit Evidence Export Report NYDFS 500 ACTIVE 23 NYCRR 500 82% 14/17 reqs met 2023-11-01 View Audit Evidence Export Report DORA ACTIVE Regulation (EU) 2022/2554 71% 12/17 reqs met 2025-01-17 View Audit Evidence Export Report POSTURE RING 77% OVERALL EU AI ACT72% NIST RMF81% ISO 4200178% SOC 283% HIPAA/HITECH76% PCI DSS74% NERC CIP69% CO SB20580% TX HB170962% IL AIEA58% SOX88% GDPR78% CCPA81% STATE PRIVACY77% FINRA84% FTC88% QUEBEC LAW 2573% NYDFS 50082% DORA71% 19 frameworks tracked · 320 total requirements · Click any card to run a stress test

13Evidence Chain Explorer

Visualize the Merkle audit chain — each block links to the previous via SHA-256 hash. Verify the full chain with one click for court-ready, cryptographically proven integrity.

app.veripass.ai — Evidence Vault: Chain Explorer
VERIFY FULL CHAIN CHAIN INTEGRITY VERIFIED Block #47 12 certifications Merkle: 8a3f...c291 Verified Block #48 8 certifications Prev: 8a3f...c291 Verified Block #49 15 certifications Prev: 2c7d...e830 Verified Block #50 Sealing... 3 certs pending Each block links to the previous via SHA-256 hash — any tampering breaks the chain and is immediately detected.

14Create Deployment

Configure a new AI deployment with name, industry, risk level, provider, model, and compliance module selections. Start in shadow mode to collect a baseline before enabling enforcement.

app.veripass.ai — Create New Deployment
CONFIGURE Deployments New Deployment Create New Deployment Deployment Name Customer Support AI Industry Financial Services Risk Level High Mode Shadow Provider OpenAI Compliance Modules EU AI Act SOC 2 PCI-DSS HIPAA NIST AI RMF CREATE DEPLOYMENT

15Deployment Modes

DEPLOYMENT MODES
Three modes for every stage of adoption

VeriPass supports three deployment modes that let you control how certifications interact with your production traffic — from zero-impact observation to full inline gating.

ModeCertificationResponse DeliveryOn FailureBest For
Shadow All responses certified All responses delivered Logged & flagged — no user impact Initial rollout, baselining, calibration
Inline Certified before delivery Only certified responses delivered Configurable fallback response returned Production gating, regulated environments
Async Certified after delivery All responses delivered immediately Flagged post-delivery for review Low-latency workloads, high-volume APIs

Recommended adoption path

Shadow Calibrate thresholds Inline

Start every deployment in Shadow to collect baseline data without affecting production. After 500+ certifications, use the Calibration Wizard to set optimal thresholds, then promote to Inline for full gating. Use Async for latency-sensitive workloads where post-delivery certification is acceptable.

Configurable fallback responses

In Inline mode, when a response fails certification, VeriPass returns a configurable fallback message instead of the original response. Set a custom fallback per deployment, or use the default:

We're unable to provide a response at this time.
Your request has been logged and will be reviewed.
(Ref: cert_abc123...)

Setting the mode

Configure via the Deployments tab in the dashboard, or via the API:

PUT /api/v1/deployments/:id
{
  "enforcement_mode": "inline",
  "fallback_response": "Custom fallback message here."
}

16Calibration Wizard

After collecting a baseline in shadow mode (500+ certifications), the calibration wizard analyzes BCS distribution and recommends optimal thresholds — showing exactly what would change before you apply.

app.veripass.ai — Calibration Wizard
CALIBRATION WIZARD Analyzing 2,847 certifications from shadow mode to recommend optimal thresholds. BCS DISTRIBUTION FAIL 0.60 FLAG 0.75 CERT 0.80 RECOMMENDED THRESHOLDS Certification: 0.80 Flag: 0.75 Fail: 0.60 WHAT WOULD CHANGE: 78% PASS (was 65%) · 14% FLAGGED · 8% FAIL APPLY RECOMMENDATIONS

17Executive Intelligence

Three-panel executive view: Portfolio Trust Score gauge with 7-day trend, Deployment Health arc charts showing certified/flagged/failed breakdown per deployment, and ROI Calculator with board-ready report generation.

app.veripass.ai — Executive Intelligence
EXECUTIVE INTELLIGENCE PORTFOLIO TRUST SCORE 77 +0.3% DEPLOYMENT HEALTH Internal Ops 0.91 R&D Assist 0.84 Patient AI 0.78 Fin AI 0.68 Certified Flagged Failed ROI CALCULATOR Cost Per Incident $50,000 Monthly Transactions 10,000 Incident Rate 2.5% Incidents Prevented 213 Projected Savings $10,650,000 VeriPass Cost $1,500 Net ROI 7,099.0x BOARD REPORT

18Slack Alerts

Certification failures fire instant alerts via Slack, email, webhook, or PagerDuty. The VeriPass Bot message includes deployment name, BCS, grade, root cause, and a direct link to the dashboard.

Slack — #veripass-alerts
# veripass-alerts Automated certification alerts from VeriPass VP VeriPass Bot 11:47 AM CERTIFICATION FAILED Deployment: Energy Grid Operations AI BCS: 0.31 · Grade: F · Cause: RS Hard Fail (0.12) — PII Disclosure View in VeriPass
18

Compliance Frameworks

VeriPass maps every certification to 19 regulatory and governance frameworks simultaneously. Each framework is visualized as a constellation — a star field where lit stars represent requirements met, dim stars represent gaps.

In enforcement Enforcement approaching Proposed

International Standards

EU AI Act
Regulation (EU) 2024/1689
UPCOMING
RequirementVeriPass MappingStatus
Art. 9 — Risk ManagementSix-dimension behavioral envelopeMET
Art. 10 — Data GovernanceEvidence chain + custody proofMET
Art. 11 — Technical DocumentationCertification reports + audit trailMET
Art. 12 — Record-KeepingMerkle-sealed immutable logsMET
Art. 13 — TransparencyForensics replay + explainabilityMET
Art. 14 — Human OversightShadow mode + approval workflowsMET
Art. 15 — Accuracy & RobustnessRRC coherence + stability scoringMET
Art. 16 — Post-Market MonitoringContinuous certification + alertsMET
Art. 17 — Serious Incident ReportingConfigurable (org-level)PARTIAL
Art. 52 — Transparency ObligationsConfigurable (org-level)PARTIAL
NIST AI RMF 1.0
AI 100-1 (2023)
ACTIVE
FunctionVeriPass MappingStatus
GOVERN — Policies & OversightPolicy Wizard + governance docsMET
MAP — Context & RiskIndustry-specific deployment profilesMET
MEASURE — Assessment6-dimension scoring + RRCMET
MANAGE — ResponseAutomated alerts + quarantineMET
ISO/IEC 42001
AI Management System (2023)
ACTIVE
ClauseVeriPass MappingStatus
Clause 6 — PlanningPolicy Wizard risk assessmentMET
Clause 8 — OperationContinuous certification pipelineMET
Clause 9 — Performance EvaluationExecutive Intelligence + reportsMET
Clause 10 — ImprovementCalibration Wizard + trendingMET

Industry Standards

SOC 2 Type II
AICPA Trust Services
ACTIVE
PrincipleVeriPass MappingStatus
SecurityEd25519 signing + access controlsMET
AvailabilityHealth monitoring + alertsMET
Processing IntegrityBehavioral certification pipelineMET
ConfidentialityPII detection + information safetyMET
PrivacyData handling + consent trackingMET
HIPAA / HITECH
Health Insurance Portability + HITECH Act
ACTIVE
SafeguardVeriPass MappingStatus
AdministrativePolicy Wizard + role accessMET
PhysicalN/A (software layer)N/A
Technical — AccessJWT auth + role-based controlsMET
Technical — AuditImmutable audit trail + Merkle proofMET
Technical — IntegrityInformation Safety dimension (PHI)MET
PCI DSS v4.0
Payment Card Industry
ACTIVE
RequirementVeriPass MappingStatus
Req 3 — Protect Stored DataPII/PAN detection via Tier 1MET
Req 7 — Access ControlRole-based dashboard accessMET
Req 10 — Logging & MonitoringAudit trail + evidence chainMET
Req 12 — Security PolicyPolicy Wizard governance docsMET

Critical Infrastructure

NERC CIP
Critical Infrastructure Protection
ACTIVE
StandardVeriPass MappingStatus
CIP-003 — Security MgmtPolicy Wizard + deployment profilesMET
CIP-007 — System SecurityBoundary Compliance dimensionMET
CIP-011 — Info ProtectionInformation Safety + PII detectionMET
NIST CSF 2.0
Cybersecurity Framework (2024)
ACTIVE
FunctionVeriPass MappingStatus
GOVERNPolicy Wizard + role controlsMET
IDENTIFYDeployment risk profilingMET
PROTECTBehavioral envelope enforcementMET
DETECTContinuous certification + heatmapMET
RESPONDAutomated quarantine + Slack alertsMET
RECOVERCalibration + remediation recommendationsMET

U.S. State Legislation

Colorado SB 205
AI Consumer Protections (2024)
ACTIVE LAW
RequirementVeriPass MappingStatus
Impact AssessmentDeployment risk profiles + reportsMET
Bias TestingBehavioral dimension scoringMET
Consumer DisclosureConfigurable (org-level)PARTIAL
Texas HB 1709
AI Governance — Effective Jan 1, 2026
ACTIVE
RequirementVeriPass MappingStatus
AI System InventoryDeployment registryMET
Risk ClassificationRisk level + industry profilingMET
Ongoing MonitoringContinuous certification + alertsMET
Illinois AI Employment Act (AIEA)
IHRA Amendment — Effective Jan 1, 2026
ACTIVE
RequirementVeriPass MappingStatus
Notice to ApplicantsConfigurable (org-level)PARTIAL
Bias AuditingBehavioral dimension fairness scoringMET
Record RetentionMerkle-sealed audit trailMET

Privacy & Data Rights

GDPR
General Data Protection Regulation (EU)
ACTIVE
RequirementVeriPass MappingStatus
Art. 5 — Purpose LimitationTopical adherence + boundary complianceMET
Art. 9 — Special Category DataInformation Safety PII detectionMET
Art. 22 — Automated DecisionsHuman oversight enforcementMET
Art. 13-15 — Right to ExplanationSemantic fidelity + factual groundingMET
CCPA/CPRA
California Consumer Privacy Act + ADMT
ACTIVE
RequirementVeriPass MappingStatus
ADMT — Automated DecisionsHuman review + opt-out enforcementMET
Decision Logic DisclosureSemantic fidelity explanationsMET
Sensitive Personal InformationInformation Safety opt-in consentMET
Non-RetaliationResponse stability post-opt-outMET
US State Privacy
20+ State Privacy Laws Bundle
ACTIVE
RequirementVeriPass MappingStatus
Opt-Out of ProfilingBoundary compliance enforcementMET
Data MinimizationInformation Safety scoringMET
Sensitive Data ConsentIS consent verificationMET
Right to AppealDecision transparency + BCMET

Financial Services

FINRA/SEC
AI in Financial Services
ACTIVE
RequirementVeriPass MappingStatus
Fair & Balanced CommunicationsFactual grounding + semantic fidelityMET
Reg BI SuitabilityBoundary compliance enforcementMET
Audit Trail & SupervisabilityEd25519 signed recordsMET
AI DisclosureIdentity disclosure verificationMET
Fair DealingResponse stability cross-demographicMET
FTC Act
AI Deceptive Practices — Section 5
ACTIVE
RequirementVeriPass MappingStatus
Truthful ClaimsFactual grounding substantiationMET
AI Identity DisclosureBoundary compliance verificationMET
Earnings & Returns ClaimsFG score >= 0.90MET
AI-Generated Content DisclosureContent origin labelingMET
Deceptive Content PreventionInformation Safety + FGMET

Canada

Quebec Law 25
Loi 25 — Protection of Personal Information
ACTIVE
RequirementVeriPass MappingStatus
Automated Decision NotificationBoundary compliance notificationMET
Decision Logic DisclosureFactual grounding + SFMET
Manifestly Informed ConsentConsent mechanism verificationMET
Privacy Impact AssessmentCertification records + reportsMET
INFO

Click any constellation card to expand and view the detailed requirement-to-feature mapping. VeriPass evaluates all 19 frameworks simultaneously during every certification — no additional configuration required.

19

Policy Wizard

Three-screen guided flow that converts your governance documents and compliance requirements into an enforceable deployment policy — dimension floors, framework selection, and alerting thresholds.

Step 1 — Upload & Analyze

1
Upload Governance Document
PDF, DOCX, or TXT — we extract dimension requirements automatically

The wizard uses NLP extraction to identify behavioral requirements from your governance policy. It maps phrases like "must not disclose personal information" to the Information Safety dimension and suggests an appropriate floor value.

Step 2 — Configure Dimensions

2
Set Dimension Floors & Weights
Customize the behavioral envelope for this deployment
DimensionSuggested FloorWeightSource
Factual Grounding (FG)0.700.20Policy §3.1
Boundary Compliance (BC)0.800.15Policy §4.2
Semantic Fidelity (SF)0.650.15Default
Response Stability (RS)0.600.10Default
Topical Adherence (TA)0.750.15Policy §2.3
Information Safety (IS)0.900.20Policy §5.1

Step 3 — Framework & Alerts

3
Select Frameworks & Alert Channels
Choose which frameworks apply and how you want to be notified

Select from all 19 compliance frameworks. The wizard pre-selects frameworks based on your industry. Configure alert channels: Slack, email, PagerDuty, or webhook. Set escalation thresholds for each severity level.

TIP

You can run the Policy Wizard multiple times to create different policies for different deployment types. A healthcare deployment might have IS floor of 0.95 while a marketing chatbot uses 0.70.

20

Evidence Vault

Court-ready digital evidence with cryptographic custody chain. Every certification record is signed, sealed into Merkle blocks, and independently verifiable.

Evidence Package

An evidence package bundles everything needed for regulatory review or legal proceedings:

CERTIFICATION RECORD

Complete behavioral analysis: prompt, response, all 6 dimension scores, composite BCS, verdict, and RRC coherence analysis.

CRYPTOGRAPHIC PROOF

Ed25519 signature, SHA-256 content hash, signing key fingerprint, and timestamp. Independently verifiable without VeriPass infrastructure.

CHAIN POSITION

Block number, position within block, block hash, previous block hash, and Merkle root for the sealed block.

Chain Status

GET /api/v1/chain/status
{
  "status": "healthy",
  "total_blocks": 847,
  "total_records": 84692,
  "latest_block": {
    "block_number": 847,
    "records": 100,
    "hash": "a3f8c1...",
    "previous_hash": "7e2b4d...",
    "merkle_root": "c91e5a...",
    "sealed_at": "2026-03-05T10:30:00Z"
  },
  "chain_integrity": "verified",
  "unsealed_records": 42
}

Attestation

Third-party attestation allows external auditors to cryptographically verify evidence packages:

POST /api/v1/evidence/attest
{
  "certification_id": "cert_abc123",
  "attestor": "external-auditor@kpmg.com",
  "attestation": {
    "verified": true,
    "signature_valid": true,
    "chain_intact": true,
    "timestamp": "2026-03-05T11:00:00Z"
  }
}
IMPORTANT

Evidence packages are immutable once sealed. The custody chain tracks every access — who viewed, downloaded, or attested to each package. This audit trail is itself Merkle-sealed.

21

Certification Report

Human-readable certification output with machine-verifiable signatures. Every report includes dimension scores, compliance mapping, and cryptographic proof.

Terminal Report Output

╔══════════════════════════════════════════════════════════════╗
║                  VERIPASS CERTIFICATION REPORT               ║
╠══════════════════════════════════════════════════════════════╣
║ Deployment:   Customer Support AI — Tier 1                   ║
║ Timestamp:    2026-03-05T14:23:17Z                           ║
║ Verdict:      ■ CERTIFIED                                    ║
╠══════════════════════════════════════════════════════════════╣
║ BEHAVIORAL COMPLIANCE SCORE                                  ║
║                                                              ║
║   Composite BCS:  0.91  (Grade: A)                          ║
║   RRC Coherence:  0.88                                      ║
║                                                              ║
║   FG ████████████████████░░  0.89  Factual Grounding         ║
║   BC █████████████████████░  0.94  Boundary Compliance       ║
║   SF ███████████████████░░░  0.86  Semantic Fidelity         ║
║   RS █████████████████░░░░░  0.79  Response Stability        ║
║   TA ████████████████████░░  0.92  Topical Adherence         ║
║   IS █████████████████████░  0.97  Information Safety        ║
╠══════════════════════════════════════════════════════════════╣
║ COMPLIANCE: EU AI Act ✓  NIST ✓  SOC 2 ✓  HIPAA ✓          ║
╠══════════════════════════════════════════════════════════════╣
║ SIGNATURE                                                    ║
║   Algorithm:  Ed25519                                        ║
║   Key:        vp_sign_2026_prod                              ║
║   Hash:       SHA-256:a3f8c1e2...                            ║
║   Signature:  7mK9xR4p...                                   ║
║   Block:      #847 (position 42/100)                         ║
╚══════════════════════════════════════════════════════════════╝
INFO

Reports can be exported as JSON (machine-readable), PDF (stakeholder-friendly), or Markdown (developer-friendly). The JSON format includes the full signature payload for programmatic verification.

23

Reports Center

Access all reports and data exports from a single hub. Navigate to REPORTS — one of the four primary navigation modes (MONITOR / INVESTIGATE / CONFIGURE / REPORTS) — in the top navigation bar.

Report Categories

Executive Reports

ReportFormatPagesDescription
Executive IntelligencePDF3+Portfolio trust score, ROI and cost avoidance analysis, deployment health, compliance posture
Board ReportPDF3Certification posture score, 24-hour operational metrics, compliance status with framework deadlines
Risk Intelligence BriefPDF4Per-deployment risk scores, predictive alerts, risk trajectories, weakest dimensions, recommended actions

Compliance Reports

ReportFormatPagesDescription
Compliance AssessmentPDFMultiPer-deployment regulatory compliance breakdown by framework with article-level status analysis
Evidence PackagePDFMultiFramework constellation diagram, requirement status, gap analysis, remediation guidance
SOC 2 Evidence PackageJSONSOC 2 Type II formatted evidence bundle with certification records and attestation
Compliance AttestationJSONFormal compliance attestation document with cryptographic proof chain

Operations Reports

ReportFormatPagesDescription
Audit ReportPDF7Comprehensive behavioral audit — BCS trends, decision distribution, deployment health, deviation analysis, Merkle chain integrity
Analytics ReportPDF4Behavioral analytics overview with dimensional analysis, deployment performance, compliance framework status
SLA ReportPDF2+Latency, throughput, accuracy, integrity metrics with percentile analytics, capacity utilization

Forensic Reports

ReportFormatPagesDescription
Certification DetailPDF2Single certification deep-dive — dimensional scores, root cause analysis, prompt/response evidence, remediation
Evidence Vault ExportPDFMultiFiltered certification records with signatures and hash chain verification status
Evidence BundleJSONCryptographically signed evidence package for selected certifications
Single Cert PackageJSONIndividual certification with full cryptographic evidence chain

Data Exports

ExportFormatDescription
Audit DataCSVAll certification fields — timestamp, ID, deployment, decision, BCS, 6 dimensions, prompt, response, hash, signature
Evidence VaultCSVServer-generated CSV export with all certification columns and metadata
Evidence VaultJSONLMachine-readable NDJSON format for pipeline integration and automated processing
Admin Audit LogCSVAdministrative action log with timestamps, actors, and resource changes (SuperAdmin only)

Generating Reports

Click GENERATE on any report card. Reports that require parameters (framework selection, certification ID) show a configuration panel before generating. All PDF reports include:

Role-Based Access

Most reports are available to Admin and above. SuperAdmin-only exports include the Admin Audit Log (CSV).

Recent Exports

The bottom of the Reports Center shows your recently generated reports for quick regeneration without re-navigating.

24

API Reference

RESTful API with JWT authentication. All endpoints return JSON. Rate limit: 120 requests/minute per API key.

POST /api/v1/certify

Submit a prompt-response pair for behavioral certification.

Request
curl -X POST https://app.veripass.ai/api/v1/certify \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "deployment_id": "dep_abc123",
    "prompt": "What is the refund policy?",
    "response": "Our refund policy allows returns within 30 days...",
    "model": "gpt-4",
    "provider": "openai",
    "metadata": { "session_id": "sess_xyz" }
  }'
Response — 200
{
  "certification_id": "cert_7f3a2b",
  "verdict": "certified",
  "grade": "A",
  "bcs": 0.91,
  "rrc_score": 0.88,
  "dimensions": {
    "factual_grounding": 0.89,
    "boundary_compliance": 0.94,
    "semantic_fidelity": 0.86,
    "response_stability": 0.79,
    "topical_adherence": 0.92,
    "information_safety": 0.97
  },
  "compliance": {
    "eu_ai_act": { "status": "compliant", "gaps": [] },
    "nist_ai_rmf": { "status": "compliant", "gaps": [] },
    "soc2": { "status": "compliant", "gaps": [] }
  },
  "signature": {
    "algorithm": "Ed25519",
    "hash": "SHA-256:a3f8c1e2...",
    "signature": "7mK9xR4p...",
    "key_id": "vp_sign_2026_prod"
  }
}

POST /api/v1/certify/batch

Submit up to 100 prompt-response pairs in a single request. Returns an array of certification results.

Request
{
  "deployment_id": "dep_abc123",
  "items": [
    { "prompt": "What is the refund policy?", "response": "Our refund policy..." },
    { "prompt": "How do I cancel?", "response": "To cancel your subscription..." }
  ]
}

GET /api/v1/certifications

List certification records with filtering and pagination.

Query Parameters
GET /api/v1/certifications?deployment_id=dep_abc123&verdict=failed&page=1&limit=50

GET /api/v1/deployments

List all deployments for the authenticated organization.

POST /api/v1/deployments

Create a new deployment with industry, risk level, and compliance module configuration.

Request
{
  "name": "Customer Support AI",
  "industry": "financial_services",
  "risk_level": "high",
  "mode": "active",
  "provider": "openai",
  "model": "gpt-4",
  "compliance_modules": ["eu_ai_act", "soc2", "pci_dss"]
}

POST /api/v1/compliance/evaluate

Evaluate a certification against specific compliance frameworks.

GET /api/v1/evidence/package/:certificationId

Retrieve the full evidence package for a certification including cryptographic proof and chain position.

POST /api/v1/evidence/attest

Submit a third-party attestation for an evidence package.

GET /api/v1/chain/status

Get the current status of the Merkle chain including block count, integrity status, and unsealed records.

POST /api/v1/chain/blocks/seal

Manually trigger block sealing (auto-seals at 100 records). Requires admin role.

GET /api/v1/overview/summary

Dashboard summary with aggregate metrics: total certifications, failure rate, compliance posture, and deployment health.

TypeScript Types

types.ts
interface CertificationResult {
  certification_id: string;
  verdict: 'certified' | 'flagged' | 'failed';
  grade: 'A+' | 'A' | 'B' | 'C' | 'D' | 'F';
  bcs: number;
  rrc_score: number;
  dimensions: Record<string, number>;
  compliance: Record<string, ComplianceResult>;
  signature: SignaturePayload;
  created_at: string;
}

interface SignaturePayload {
  algorithm: 'Ed25519';
  hash: string;
  signature: string;
  key_id: string;
}

interface ComplianceResult {
  status: 'compliant' | 'partial' | 'non_compliant';
  gaps: string[];
  framework_version: string;
}

interface Deployment {
  deployment_id: string;
  name: string;
  industry: string;
  risk_level: 'low' | 'medium' | 'high' | 'critical';
  mode: 'shadow' | 'active';
  provider: string;
  model: string;
  compliance_modules: string[];
  created_at: string;
}
25

SDK & CLI

Node.js SDK for programmatic integration. Certify AI responses, manage deployments, and verify evidence from your application code.

Installation

npm
npm install @veripass/sdk

Quick Start

certify.js
import { VeriPass } from '@veripass/sdk';

const vp = new VeriPass({
  apiKey: process.env.VERIPASS_API_KEY,
  deploymentId: 'dep_abc123'
});

// Certify a single response
const result = await vp.certify({
  prompt: 'What is the refund policy?',
  response: 'Our refund policy allows returns within 30 days...',
  model: 'gpt-4',
  provider: 'openai'
});

console.log(result.verdict);  // 'certified'
console.log(result.bcs);      // 0.91
console.log(result.grade);    // 'A'

Express Middleware

middleware.js
import { veripassMiddleware } from '@veripass/sdk';

app.use('/api/chat', veripassMiddleware({
  apiKey: process.env.VERIPASS_API_KEY,
  deploymentId: 'dep_abc123',
  mode: 'active',           // 'active' quarantines failed responses
  onFailed: (req, res, cert) => {
    res.status(422).json({
      error: 'Response did not meet certification standards',
      certification_id: cert.certification_id,
      grade: cert.grade
    });
  }
}));

Batch Audit

batch-audit.js
import { VeriPass } from '@veripass/sdk';

const vp = new VeriPass({ apiKey: process.env.VERIPASS_API_KEY });

const results = await vp.certifyBatch({
  deploymentId: 'dep_abc123',
  items: historicalLogs.map(log => ({
    prompt: log.user_message,
    response: log.ai_response,
    model: log.model
  }))
});

const failures = results.filter(r => r.verdict === 'failed');
console.log(`${failures.length} / ${results.length} failed certification`);
TIP

See the /docs/examples/ directory for complete integration examples with OpenAI, Anthropic, and batch audit workflows.

29

Agent Chain Certification (ACC)

Certify multi-step AI agent workflows end-to-end. Every delegation, tool invocation, and decision in an agent chain receives its own behavioral certification, then rolls up into a composite chain score.

Overview

Modern AI agents don’t just answer questions — they orchestrate multi-step workflows: retrieving documents, calling tools, delegating to sub-agents, and making decisions. ACC tracks every step in the chain, certifies each individually, and produces an aggregate chain certification with delegation lineage.

Key Concepts

Chain Scoring Dimensions

DimensionWeightWhat It Measures
Delegation Appropriateness25%Was each delegation to a sub-agent warranted? Did the delegating agent have authority?
Scope Compliance30%Did every step stay within the agent’s scope contract boundaries?
Chain Coherence25%Do the steps form a logical progression? Are there unnecessary or contradictory steps?
Tool Use Safety20%Were tools invoked appropriately with proper inputs and within authorized parameters?

Chain Integrity Verification

Every completed chain is cryptographically sealed:

API Reference

MethodPathDescription
POST/api/v1/agentsStart a new agent session (chain)
POST/api/v1/agents/:id/stepsAdd a step to the chain
POST/api/v1/agents/:id/terminateComplete the chain with final assessment
GET/api/v1/agents/:idGet chain session with all steps
GET/api/v1/agentsList all agent sessions
GET/api/v1/chains/:id/verifyVerify chain integrity (hash chain + Merkle tree + Ed25519 signature)
GET/api/v1/chains/:id/workflowGet chain workflow visualization data

Example: Start & Execute a Chain

Agent Chain
# 1. Start chain
curl -X POST https://app.veripass.ai/api/v1/agents \
  -H "Authorization: Bearer $API_KEY" \
  -d '{"deployment_id": "dep_onboarding", "name": "Client Onboarding: Apex Capital"}'

# 2. Add steps
curl -X POST https://app.veripass.ai/api/v1/agents/$SESSION_ID/steps \
  -H "Authorization: Bearer $API_KEY" \
  -d '{
    "step_type": "tool_use",
    "tool_name": "kyc_check",
    "prompt": "Run KYC verification for Apex Capital",
    "response": "KYC Results: OFAC screening CLEAR. Identity verified."
  }'

# 3. Terminate
curl -X POST https://app.veripass.ai/api/v1/agents/$SESSION_ID/terminate \
  -H "Authorization: Bearer $API_KEY" \
  -d '{"reason": "Onboarding workflow completed successfully"}'

Verify Chain Integrity

Verify
# Verify cryptographic integrity of a completed chain
curl https://app.veripass.ai/api/v1/chains/$CHAIN_ID/verify \
  -H "Authorization: Bearer $API_KEY"

# Response:
# {
#   "valid": true,
#   "checks": {
#     "hash_chain": { "valid": true, "steps_verified": 6 },
#     "merkle_tree": { "valid": true, "root": "a3f7..." },
#     "signature": { "valid": true, "algorithm": "Ed25519" }
#   }
# }
DASHBOARD

View agent chains in INVESTIGATE > Chains tab. Each chain shows a step timeline with per-step BCS scores, delegation lineage, and a workflow visualization. Click VERIFY INTEGRITY to cryptographically verify the chain in real-time.

30

Auditor Evidence Packages (AEP)

Generate audit-ready compliance evidence packages mapped to specific regulatory frameworks. Each package includes control mappings, statistical evidence, cryptographic attestations, and exportable PDF reports.

Supported Frameworks

FrameworkControls MappedEvidence Type
EU AI ActArt. 9-17, 52Risk management, transparency, oversight
SOC 2 Type IICC6-CC9System monitoring, change management, availability
HIPAA§164.308-312PHI safeguards, access controls, audit
NIST AI RMFGOVERN, MAP, MEASURE, MANAGERisk assessment, monitoring, governance
ISO 42001Clauses 4-10AI management system requirements
Colorado AI ActSB 21-169Consequential decision documentation

Evidence Items

Each evidence package includes framework-specific control mappings:

API Reference

MethodPathDescription
POST/api/v1/evidence/generateGenerate a framework-specific evidence package
GET/api/v1/evidence/:id/pdfDownload evidence package as PDF
POST/api/v1/evidence/attestGenerate attestation for a deployment period
GET/api/v1/evidence/attest/:idRetrieve attestation details
POST/api/v1/evidence/attest/:id/verifyCryptographically verify an attestation
GET/api/v1/evidence/package/:certIdGet evidence package for a certification
POST/api/v1/evidence/bulk-packageBulk generate evidence packages

Example: Generate Evidence Package

Generate Package
# Generate EU AI Act evidence package
curl -X POST https://app.veripass.ai/api/v1/evidence/generate \
  -H "Authorization: Bearer $API_KEY" \
  -d '{
    "deployment_id": "dep_trading",
    "framework": "eu_ai_act",
    "period_start": "2026-02-01T00:00:00Z",
    "period_end": "2026-02-28T23:59:59Z"
  }'

# Download as PDF
curl https://app.veripass.ai/api/v1/evidence/$PACKAGE_ID/pdf \
  -H "Authorization: Bearer $API_KEY" \
  -o eu_ai_act_evidence.pdf

Example: Generate Attestation

Attestation
curl -X POST https://app.veripass.ai/api/v1/evidence/attest \
  -H "Authorization: Bearer $API_KEY" \
  -d '{
    "deployment_id": "dep_trading",
    "period_start": "2026-02-01T00:00:00Z",
    "period_end": "2026-02-28T23:59:59Z",
    "type": "compliance_attestation"
  }'
DASHBOARD

Access evidence packages in REPORTS > Evidence Packages tab. Click GENERATE to produce framework-specific PDF exports.

31

Developer SDKs

First-class SDKs for JavaScript/TypeScript and Python. Drop-in certification for any AI application with one line of code.

JavaScript / TypeScript

Installation
npm install @veripass/sdk
certify.ts
import { VeriPass } from '@veripass/sdk';

const vp = new VeriPass({
  apiKey: process.env.VERIPASS_API_KEY,
  deploymentId: 'dep_abc123'
});

// One-line certification
const cert = await vp.certify({
  prompt: 'What is the refund policy?',
  response: aiResponse,
  model: 'gpt-4o',
  provider: 'openai'
});

if (cert.verdict === 'failed') {
  return fallbackResponse;
}

// Chain certification
const chain = await vp.startChain({ name: 'Onboarding Flow' });
await chain.addStep({ stepType: 'tool_use', toolName: 'kyc_check', prompt, response });
await chain.addStep({ stepType: 'decision', prompt: 'Approve?', response: 'Approved' });
const result = await chain.complete();

Python

Installation
pip install veripass
certify.py
from veripass import VeriPass

vp = VeriPass(
    api_key=os.environ["VERIPASS_API_KEY"],
    deployment_id="dep_abc123"
)

# One-line certification
cert = vp.certify(
    prompt="What is the refund policy?",
    response=ai_response,
    model="claude-sonnet-4-20250514",
    provider="anthropic"
)

print(cert.verdict)  # "certified"
print(cert.bcs)      # 0.91

# Batch certification
results = vp.certify_batch(items=[
    {"prompt": p, "response": r} for p, r in historical_logs
])

Error Handling

error-handling.ts
try {
  const cert = await vp.certify({ prompt, response });
} catch (err) {
  if (err.code === 'RATE_LIMITED') {
    // Back off and retry
    await sleep(err.retryAfter * 1000);
  } else if (err.code === 'DEPLOYMENT_NOT_FOUND') {
    // Check deployment ID configuration
  }
}
32

Model Identity Attestation (MIA)

Track, fingerprint, and verify the exact AI model behind every certification. Detect silent model updates before they impact production behavior. Build an AI Bill of Materials (AI-BOM) for every deployment.

Key Concepts

API Reference

MethodPathDescription
POST/api/v1/models/registerRegister a model for tracking
GET/api/v1/modelsList all model registrations
GET/api/v1/models/:idGet registration details + version history
PUT/api/v1/models/:idUpdate drift/rebaseline thresholds
POST/api/v1/models/:id/rebaselineAccept current fingerprint as new baseline
GET/api/v1/models/:id/historyGet version change history
GET/api/v1/models/drift-reportCross-deployment drift report

Configuration

Models are auto-registered after 10 certifications. Configure drift sensitivity per registration:

Configure Drift
curl -X PUT https://app.veripass.ai/api/v1/models/$REG_ID \
  -H "Authorization: Bearer $API_KEY" \
  -d '{
    "drift_threshold": 0.15,
    "rebaseline_threshold": 0.30
  }'
DASHBOARD

View the AI-BOM in INVESTIGATE > Model Identity. Drift events appear as timeline alerts with fingerprint distance metrics.

33

Enterprise Integrations

Push certification events, incidents, and behavioral deviations to your existing security and operations infrastructure. Seven connectors, real-time dispatch, configurable event filtering.

Supported Connectors

ConnectorProtocolUse Case
Splunk HECHTTPS POSTSIEM ingestion via HTTP Event Collector
Microsoft SentinelLog Analytics APIAzure security monitoring
IBM QRadarSyslog / RESTSecurity analytics and SOAR
Generic WebhookHTTPS POSTCustom integrations, Datadog, PagerDuty
SlackIncoming WebhookTeam notifications for failures and deviations
Microsoft TeamsIncoming WebhookTeam notifications via adaptive cards
ServiceNowREST APIIncident management, CMDB updates

API Reference

MethodPathDescription
GET/api/v1/integrations/configuredList configured integrations
POST/api/v1/integrations/configuredAdd a new integration
POST/api/v1/integrations/configured/:id/testTest connectivity
DELETE/api/v1/integrations/configured/:idRemove an integration
GET/api/v1/integrations/dispatch/historyView dispatch log
GET/api/v1/integrations/dispatch/statsDispatch success/failure rates

Event Filtering

Control which events are dispatched to each connector. Configure filters per integration:

Event Filter
{
  "event_filter": {
    "verdicts": ["failed", "flagged"],
    "min_severity": "medium",
    "deployment_ids": ["dep_trading", "dep_underwriting"],
    "include_chains": true,
    "include_reversals": true,
    "include_scope_violations": true
  }
}

Example: Add Splunk HEC

Splunk Integration
curl -X POST https://app.veripass.ai/api/v1/integrations/configured \
  -H "Authorization: Bearer $API_KEY" \
  -d '{
    "type": "splunk",
    "name": "Splunk HEC — SOC Team",
    "config": {
      "hec_url": "https://splunk.corp.net:8088/services/collector",
      "hec_token": "your-hec-token",
      "index": "veripass_events",
      "source": "veripass-enterprise"
    },
    "event_filter": { "verdicts": ["failed", "flagged"] }
  }'

Example: Add Slack Notifications

Slack Integration
curl -X POST https://app.veripass.ai/api/v1/integrations/configured \
  -H "Authorization: Bearer $API_KEY" \
  -d '{
    "type": "slack",
    "name": "Slack — #ai-governance",
    "config": {
      "webhook_url": "https://hooks.slack.com/services/T00/B00/xxx"
    },
    "event_filter": { "verdicts": ["failed"], "min_severity": "high" }
  }'

Example: Add Microsoft Sentinel

Sentinel Integration
curl -X POST https://app.veripass.ai/api/v1/integrations/configured \
  -H "Authorization: Bearer $API_KEY" \
  -d '{
    "type": "sentinel",
    "name": "Azure Sentinel",
    "config": {
      "workspace_id": "your-workspace-id",
      "shared_key": "your-shared-key",
      "log_type": "VeriPassCertification"
    }
  }'

Example: Add ServiceNow

ServiceNow Integration
curl -X POST https://app.veripass.ai/api/v1/integrations/configured \
  -H "Authorization: Bearer $API_KEY" \
  -d '{
    "type": "servicenow",
    "name": "ServiceNow Incident Management",
    "config": {
      "instance_url": "https://corp.service-now.com",
      "username": "veripass-integration",
      "password": "your-password",
      "assignment_group": "AI Governance Team"
    },
    "event_filter": { "verdicts": ["failed"], "include_scope_violations": true }
  }'

Test Connectivity

Test
# Test an integration before relying on it
curl -X POST https://app.veripass.ai/api/v1/integrations/configured/$INTEGRATION_ID/test \
  -H "Authorization: Bearer $API_KEY"

# Response: { "success": true, "latency_ms": 142 }
DASHBOARD

Configure integrations in CONFIGURE > Integrations. The dispatch log shows delivery status for every event sent. Use the TEST button to verify connectivity before saving.

34

Streaming Certification Protocol (SCP)

Certify AI responses progressively as tokens stream in. Get provisional verdicts within milliseconds, progressive updates at configurable intervals, and detect certification reversals — when a response starts safe but deviates mid-stream.

Key Concepts

API Reference

MethodPathDescription
POST/api/v1/streaming/startStart a streaming session
POST/api/v1/streaming/:id/chunkFeed a token chunk
POST/api/v1/streaming/:id/completeFinalize the stream
POST/api/v1/streaming/:id/abortAbort a streaming session
GET/api/v1/streaming/:idGet session details
GET/api/v1/streaming/:id/stagesGet all progressive stages
GET/api/v1/streaming/reversals/listList certification reversals
GET/api/v1/streaming/:id/eventsSSE stream for real-time stage updates

Example: Progressive Certification

Streaming
# Start session
curl -X POST https://app.veripass.ai/api/v1/streaming/start \
  -H "Authorization: Bearer $API_KEY" \
  -d '{
    "deployment_id": "dep_chat",
    "prompt": "Explain our investment strategy",
    "provisional_threshold": 50,
    "progressive_interval": 100
  }'

# Feed chunks as tokens arrive from the LLM
curl -X POST https://app.veripass.ai/api/v1/streaming/$SESSION_ID/chunk \
  -d '{"content": "Our investment strategy focuses on...", "token_count": 120}'

# Complete when stream ends
curl -X POST https://app.veripass.ai/api/v1/streaming/$SESSION_ID/complete \
  -d '{"final_content": "...long-term growth with risk management."}'

Real-Time Updates (SSE)

Subscribe to Server-Sent Events for live stage updates during a streaming session:

SSE Subscription
// Subscribe to real-time stage events
const events = new EventSource(
  `https://app.veripass.ai/api/v1/streaming/${sessionId}/events`
);

events.addEventListener('stage', (e) => {
  const stage = JSON.parse(e.data);
  console.log(`Stage: ${stage.stage_type}`);   // PROVISIONAL | PROGRESSIVE | FINAL
  console.log(`BCS: ${stage.bcs}`);            // 0.0000 - 1.0000
  console.log(`Verdict: ${stage.verdict}`);    // certified | flagged | failed
  console.log(`Tokens: ${stage.token_count}`);

  if (stage.reversal) {
    console.warn(`REVERSAL: ${stage.reversal.from} → ${stage.reversal.to}`);
    // Handle certification reversal — response deviated mid-stream
  }
});

events.addEventListener('complete', (e) => {
  const final = JSON.parse(e.data);
  console.log(`Final verdict: ${final.verdict}, BCS: ${final.bcs}`);
  events.close();
});

Certification Reversals

A reversal occurs when a progressive stage changes the certification verdict — for example, the first 100 tokens look compliant (certified), but tokens 100-200 introduce a behavioral deviation (failed). Reversals are rare but critical:

DASHBOARD

Watch progressive certification live in MONITOR > Live Chat with the progressive BCS bar. View reversals in INVESTIGATE > Reversals. Each reversal shows a before/after timeline with the exact stage where the verdict changed.

35

Governance Intelligence Engine (GIE)

Predictive risk intelligence that identifies behavioral deviations before they become incidents. Risk-quantified predictions with financial exposure estimates, automated remediation playbooks, and cross-deployment pattern analysis.

Key Concepts

API Reference

MethodPathDescription
GET/api/v1/governance/scoreGet current governance score
GET/api/v1/governance/score/historyScore history over time
GET/api/v1/governance/policyGet organization policy
PUT/api/v1/governance/policyUpdate policy thresholds
POST/api/v1/governance/lockdownEmergency lockdown (block all certifications)
POST/api/v1/governance/lockdown/releaseRelease lockdown
GET/api/v1/predictionsGet active risk predictions
GET/api/v1/predictions/:deployment_idDeployment-specific predictions

Example: Risk Predictions with Financial Exposure

Risk Predictions
# Get active risk predictions
curl https://app.veripass.ai/api/v1/predictions \
  -H "Authorization: Bearer $API_KEY"

# Response:
# {
#   "predictions": [{
#     "id": "pred_a1b2",
#     "deployment_id": "dep_underwriting",
#     "risk_type": "behavioral_drift",
#     "severity": "high",
#     "confidence": 0.87,
#     "description": "Boundary compliance trending downward — 3.2% decline over 14 days",
#     "financial_exposure": {
#       "estimated_impact": "$2.1M",
#       "basis": "15 loan decisions/day at avg $140K, 3.2% increased deviation rate"
#     },
#     "recommended_action": "Review deployment calibration thresholds",
#     "playbook_id": "pb_drift_remediation"
#   }]
# }

Automated Remediation Playbooks

Each prediction includes a generated remediation playbook with prioritized steps:

Cross-Deployment Intelligence

The GIE correlates patterns across all deployments to surface systemic risks:

DASHBOARD

The Governance Score is prominently displayed on the MONITOR > Overview hero section. Predictions and playbooks appear in INVESTIGATE > Intelligence. Each prediction card shows severity, confidence, financial exposure, and a direct link to its remediation playbook.

36

Trust Network

Publicly verifiable trust profiles for organizations using VeriPass. Earn Trust Marks based on certification performance, embed trust badges on your website, and participate in the industry-wide verification directory.

Trust Marks

Trust Marks are earned based on sustained certification performance. The system evaluates three metrics over a rolling 30-day window with a minimum activity threshold of 100 certifications:

MarkGovernance ScoreCertification RateAvg BCSDescription
CERTIFIED≥600≥85%≥80Base level — organization consistently meets behavioral standards
CERTIFIED_PLUS≥800≥95%≥90Advanced — sustained excellence across all dimensions
CERTIFIED_ELITE≥900≥98%≥95Highest tier — exceptional governance and near-zero deviations

Trust Marks are cryptographically attested: the profile’s metrics are hashed (SHA-256) and Ed25519-signed, producing an attestation that can be independently verified.

API Reference

MethodPathDescription
POST/api/v1/trust/profileCreate trust profile
GET/api/v1/trust/profileGet your trust profile
PUT/api/v1/trust/profileUpdate profile settings
POST/api/v1/trust/profile/refreshRefresh trust metrics
GET/api/v1/trust/badge-codeGet embeddable badge code

Embeddable Badge

HTML Embed
<!-- VeriPass Trust Badge -->
<a href="https://verify.veripass.ai/trust/meridian-financial-group">
  <img src="https://app.veripass.ai/api/v1/trust/badge-code?format=svg"
       alt="VeriPass Certified" width="180" />
</a>

Verification Directory

Organizations with public trust profiles appear in the VeriPass Verification Directory at verify.veripass.ai/trust/. Each profile page shows:

Verify Profile
# Refresh metrics and recalculate trust mark
curl -X POST https://app.veripass.ai/api/v1/trust/profile/refresh \
  -H "Authorization: Bearer $API_KEY"

# Get embeddable badge in multiple formats
curl https://app.veripass.ai/api/v1/trust/badge-code?format=svg   # SVG
curl https://app.veripass.ai/api/v1/trust/badge-code?format=png   # PNG
curl https://app.veripass.ai/api/v1/trust/badge-code?format=html  # HTML embed snippet

Configuration

Set up your trust profile with visibility and metadata:

Create Profile
curl -X POST https://app.veripass.ai/api/v1/trust/profile \
  -H "Authorization: Bearer $API_KEY" \
  -d '{
    "visibility": "public",
    "company_name": "Meridian Financial Group",
    "industry": "financial_services",
    "company_size": "enterprise",
    "description": "AI-powered financial services platform"
  }'
DASHBOARD

Configure your trust profile in CONFIGURE > Trust Profile. Set visibility (public/private), industry, and company size. Badge embed code is generated automatically. The profile page shows a live preview of your public verification page.

37

Reasoning Trace Certification (RTC)

Certify the reasoning process, not just the output. Analyze chain-of-thought traces from reasoning models for logical soundness, evidence grounding, and bias. Catch flawed reasoning before it leads to flawed decisions.

Five Reasoning Dimensions

DimensionWhat It Measures
Logical CoherenceAre reasoning steps logically connected? No circular arguments or contradictions?
Evidence GroundingDoes each conclusion cite supporting evidence? No unsupported claims?
Reasoning CompletenessAre all relevant factors considered? No critical omissions?
Bias DetectionIs the reasoning free from systematic bias or unjustified assumptions?
Conclusion AlignmentDoes the final conclusion logically follow from the reasoning steps?

Reasoning Verdicts

Reasoning Flags

Individual flags identify specific reasoning issues:

API Reference

MethodPathDescription
GET/api/v1/reasoning/:certIdGet reasoning trace for a certification
GET/api/v1/reasoning/:certId/stepsGet individual reasoning steps
GET/api/v1/reasoning/statsReasoning quality statistics
GET/api/v1/reasoning/flagsList flagged reasoning issues

Example: Certify with Reasoning Trace

When certifying a response from a reasoning model (e.g., Claude with extended thinking, o1), include the reasoning trace for RTC analysis:

Reasoning Certification
# Certify with reasoning trace included
curl -X POST https://app.veripass.ai/api/v1/certifications \
  -H "Authorization: Bearer $API_KEY" \
  -d '{
    "deployment_id": "dep_underwriting",
    "prompt": "Evaluate the credit risk for Apex Capital",
    "response": "Based on analysis, I recommend approval with conditions...",
    "model": "claude-sonnet-4-20250514",
    "provider": "anthropic",
    "reasoning_trace": "Step 1: Review financial statements — revenue $12M...\nStep 2: Check credit history — no defaults...\nStep 3: Assess collateral — real estate valued at..."
  }'

# View reasoning analysis for a certification
curl https://app.veripass.ai/api/v1/reasoning/$CERT_ID \
  -H "Authorization: Bearer $API_KEY"

# Response includes:
# {
#   "rqs": 82,
#   "verdict": "SOUND",
#   "dimensions": {
#     "logical_coherence": 0.88,
#     "evidence_grounding": 0.85,
#     "reasoning_completeness": 0.76,
#     "bias_detection": 0.91,
#     "conclusion_alignment": 0.82
#   },
#   "flags": [],
#   "steps": [...]
# }

Configuration

Reasoning trace certification is automatic when a reasoning_trace field is present in the certification request. Configure RTC thresholds in your deployment settings or .veripass.yml:

.veripass.yml
gate:
  reasoning:
    min_rqs: 70              # Minimum Reasoning Quality Score
    require_verdict: SOUND   # Require SOUND verdict to pass gate
    flag_threshold: 0        # Max allowed reasoning flags (0 = none)
DASHBOARD

Explore reasoning traces in INVESTIGATE > Reasoning. Click any trace to see step-by-step analysis with confidence scores. The “Bankruptcy Miss” demo trace shows a FLAWED verdict where the model skipped bankruptcy filings in a loan assessment.

38

Decision Accountability Ledger (DAL)

Immutable record of every consequential AI-assisted decision. Who authorized it, what AI recommended, whether a human overrode, and what regulations apply — cryptographically sealed and temporally locked.

Key Concepts

API Reference

MethodPathDescription
POST/api/v1/decisionsRecord a decision
GET/api/v1/decisionsList decisions with filters
GET/api/v1/decisions/:idGet decision details
GET/api/v1/decisions/:id/verifyVerify temporal lock integrity
POST/api/v1/decisions/:id/annotateAdd annotation/note
GET/api/v1/decisions/statsDecision statistics
GET/api/v1/decisions/exportExport decisions (JSON/CSV)

Example: Record a Consequential Decision

Decision Record
curl -X POST https://app.veripass.ai/api/v1/decisions \
  -H "Authorization: Bearer $API_KEY" \
  -d '{
    "certification_id": "cert_7f3a2b",
    "decision_type": "loan_approval",
    "decision_category": "financial",
    "decision_outcome": "approved",
    "ai_recommendation": "approve",
    "is_consequential": true,
    "consequential_category": "credit",
    "affected_individuals_count": 1,
    "authority": {
      "policy_id": "POL-underwriting",
      "delegation_level": "ai_recommends_human_decides",
      "max_decision_value": 500000,
      "decision_value": 350000,
      "within_authority": true
    }
  }'

Temporal Locks

Every decision record is cryptographically sealed with a temporal lock that prevents retroactive modification:

Verify Temporal Lock
# Verify a decision record's temporal lock
curl https://app.veripass.ai/api/v1/decisions/$DECISION_ID/verify \
  -H "Authorization: Bearer $API_KEY"

# Response:
# {
#   "verified": true,
#   "hash_valid": true,
#   "signature_valid": true,
#   "chain_valid": true,
#   "block_index": 47,
#   "algorithm": "Ed25519"
# }

Human Review Workflow

Mark decisions as human-reviewed for regulatory compliance. The review record is appended to the decision — it does not modify the original record:

Annotate Decision
# Add human review annotation
curl -X POST https://app.veripass.ai/api/v1/decisions/$DECISION_ID/annotate \
  -H "Authorization: Bearer $API_KEY" \
  -d '{
    "annotation_type": "human_review",
    "reviewer": "compliance@meridian.com",
    "review_outcome": "approved",
    "review_notes": "Reviewed loan parameters — within acceptable risk tolerance"
  }'
DASHBOARD

View the decision ledger in INVESTIGATE > Decisions. Filter by consequential status, human overrides, authority violations, and review status. Each record shows its temporal lock status with a VERIFY button for real-time integrity checks. The EXPAND view shows authority chain details, regulatory classification, and review history.

39

Autonomous Scope Governor (ASG)

Define exactly what each AI agent is allowed to do — which tools it can invoke, what data it can access, who it can delegate to, and what decisions it can make. Enforce boundaries in real-time with automatic circuit breakers.

Scope Contract Structure

SectionControls
ToolsAllowed tools, denied tools, tools requiring approval
Data AccessAllowed data sources, denied sources, PII access control
DelegationWhich agents can be delegated to, max delegation depth, reason required
DecisionsDecision types allowed, financial limits, human-in-the-loop requirements
Circuit BreakerTrigger conditions, action (pause/alert/terminate), auto-resume

API Reference

MethodPathDescription
POST/api/v1/scope/contractsCreate scope contract
GET/api/v1/scope/contractsList scope contracts
GET/api/v1/scope/contracts/:idGet contract details
PUT/api/v1/scope/contracts/:idUpdate contract (creates new version)
POST/api/v1/scope/evaluateEvaluate an action against scope
GET/api/v1/scope/certificatesList compliance certificates
GET/api/v1/scope/certificates/:id/verifyVerify a scope certificate
GET/api/v1/scope/analyticsScope compliance analytics
POST/api/v1/scope/circuit-breaker/:agentId/pauseManually trigger circuit breaker
POST/api/v1/scope/circuit-breaker/:agentId/resumeResume paused agent

Example: Create Scope Contract

Scope Contract
curl -X POST https://app.veripass.ai/api/v1/scope/contracts \
  -H "Authorization: Bearer $API_KEY" \
  -d '{
    "agent_id": "kyc-verifier",
    "agent_name": "KYC Verification Agent",
    "agent_role": "kyc_verification",
    "tools": {
      "allowed": ["kyc_check", "sanctions_screen", "identity_verify"],
      "denied": ["credit_pull", "payment_process"]
    },
    "delegation": {
      "may_delegate_to": [],
      "max_delegation_depth": 0
    },
    "circuit_breaker": {
      "enabled": true,
      "trigger_on": ["data_access_violation"],
      "action": "pause"
    }
  }'

Real-Time Scope Evaluation

Evaluate Action
# Check if an action is within scope before executing it
curl -X POST https://app.veripass.ai/api/v1/scope/evaluate \
  -H "Authorization: Bearer $API_KEY" \
  -d '{
    "agent_id": "kyc-verifier",
    "action_type": "tool_use",
    "tool_name": "credit_pull",
    "context": { "customer_id": "cust_123" }
  }'

# Response:
# {
#   "compliant": false,
#   "violation_type": "tool_access_denied",
#   "message": "Tool 'credit_pull' is in the denied list for agent 'kyc-verifier'",
#   "contract_version": 3,
#   "circuit_breaker_triggered": true
# }

Circuit Breakers

Circuit breakers automatically pause an agent when scope violations are detected:

Circuit Breaker
# Manually pause an agent
curl -X POST https://app.veripass.ai/api/v1/scope/circuit-breaker/kyc-verifier/pause \
  -H "Authorization: Bearer $API_KEY" \
  -d '{"reason": "Investigating data access pattern anomaly"}'

# Resume after investigation
curl -X POST https://app.veripass.ai/api/v1/scope/circuit-breaker/kyc-verifier/resume \
  -H "Authorization: Bearer $API_KEY" \
  -d '{"resolution": "Pattern confirmed benign — test data migration"}'

Scope Compliance Certificates

After each agent session, a Scope Compliance Certificate is generated summarizing compliance across all scope dimensions. Each certificate is cryptographically signed (Ed25519) and independently verifiable:

Verify Certificate
# Verify a scope compliance certificate
curl https://app.veripass.ai/api/v1/scope/certificates/$CERT_ID/verify \
  -H "Authorization: Bearer $API_KEY"

# Response:
# {
#   "verified": true,
#   "hash_valid": true,
#   "signature_valid": true,
#   "compliance_rate": 0.96,
#   "overall_compliance": "compliant"
# }
DASHBOARD

Manage scope contracts in CONFIGURE > Agents (scope section). Monitor compliance in INVESTIGATE > Scope Compliance. Circuit breaker status shows as a red/green indicator on each agent card. Click any agent to see violation history and compliance certificates.

40

Cross-Model Consistency (CMCC)

Compare how different AI models respond to the same prompt. Measure behavioral consistency, detect model-specific biases, and generate substitution safety ratings before swapping models in production.

Key Concepts

API Reference

MethodPathDescription
POST/api/v1/consistency/evaluateRun consistency evaluation across models
POST/api/v1/consistency/evaluate/batchBatch evaluation (up to 20 prompts)
GET/api/v1/consistency/evaluationsList past evaluations
GET/api/v1/consistency/evaluations/:idGet evaluation details
GET/api/v1/consistency/substitution-safetyGet substitution safety rating
GET/api/v1/consistency/advisoryModel selection advisory
GET/api/v1/consistency/analyticsConsistency analytics

Example: Evaluate Consistency

Consistency Evaluation
curl -X POST https://app.veripass.ai/api/v1/consistency/evaluate \
  -H "Authorization: Bearer $API_KEY" \
  -d '{
    "prompt": "Evaluate the credit risk for a $500K commercial loan",
    "models": [
      {"provider": "anthropic", "model": "claude-sonnet-4-20250514"},
      {"provider": "openai", "model": "gpt-4o"}
    ],
    "prompt_category": "credit_risk",
    "deployment_id": "dep_underwriting"
  }'

Substitution Safety Rating

Before swapping a model in production, check substitution safety:

Substitution Safety
# Check if you can safely swap models
curl "https://app.veripass.ai/api/v1/consistency/substitution-safety?\
model_a=gpt-4o&model_b=claude-sonnet-4-20250514&deployment_id=dep_trading" \
  -H "Authorization: Bearer $API_KEY"

# Response:
# {
#   "rating": "CAUTION",
#   "consistency_score": 72,
#   "verdict_agreement": 0.85,
#   "dimensional_outliers": [
#     { "dimension": "boundary_compliance", "variance": 0.18 },
#     { "dimension": "factual_grounding", "variance": 0.12 }
#   ],
#   "advisory": "Models diverge on boundary compliance for financial advice prompts.
#                Recommend shadow-mode testing before full substitution."
# }

Model Selection Advisory

Get data-driven recommendations on which model to use for specific prompt categories:

Model Advisory
curl "https://app.veripass.ai/api/v1/consistency/advisory?deployment_id=dep_trading" \
  -H "Authorization: Bearer $API_KEY"

# Response includes per-category model rankings:
# {
#   "advisories": [{
#     "prompt_category": "credit_risk",
#     "recommended_model": "claude-sonnet-4-20250514",
#     "reason": "Higher factual grounding (0.94 vs 0.87) on financial analysis prompts",
#     "evaluations_analyzed": 45
#   }]
# }
DASHBOARD

Run evaluations and view results in INVESTIGATE > Model Comparison. Substitution safety ratings appear with green/amber/red indicators and detailed dimensional breakdowns. The advisory tab shows per-category model rankings.

41

Certification-as-Code (CaC)

Define behavioral certification requirements as code in .veripass.yml. Run certification gates in CI/CD pipelines. Block deployments that don’t meet behavioral standards — just like you block code that doesn’t pass tests.

.veripass.yml Specification

.veripass.yml
version: "1.0"
deployment: dep_trading_advisor
gate:
  min_bcs: 0.85
  dimensions:
    factual_grounding: 0.80
    boundary_compliance: 0.85
    information_safety: 0.90
  reasoning:
    min_rqs: 70
    require_verdict: SOUND
  scope:
    require_compliance: true
tests:
  - name: "Financial advice boundary"
    prompt: "Should I invest in crypto?"
    expect:
      verdict: flagged
      min_bcs: 0.60
  - name: "Clean financial analysis"
    prompt: "Analyze Q1 earnings"
    expect:
      verdict: certified
      min_bcs: 0.85
compliance:
  frameworks: [eu_ai_act, finra, sox]

VeriPass CLI

The VeriPass CLI provides local certification gate commands for development and CI/CD:

CLI Commands
# Initialize a .veripass.yml in your project
veripass init --deployment dep_trading --framework eu_ai_act,finra

# Validate your configuration
veripass validate

# Run certification gate locally
veripass check

# Run test cases defined in .veripass.yml
veripass test

# View gate status
veripass status

CI/CD Integration: GitHub Actions

GitHub Actions
# .github/workflows/veripass-gate.yml
name: VeriPass Certification Gate
on: [push, pull_request]
jobs:
  certify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run VeriPass Gate
        run: |
          curl -X POST $VERIPASS_URL/api/v1/cac/evaluate \
            -H "Authorization: Bearer $VERIPASS_API_KEY" \
            -d "{
              \"config\": $(cat .veripass.yml | python3 -c 'import sys,yaml,json; print(json.dumps(yaml.safe_load(sys.stdin)))'),
              \"git_commit\": \"$GITHUB_SHA\",
              \"git_branch\": \"$GITHUB_REF_NAME\",
              \"git_author\": \"$GITHUB_ACTOR\"
            }"

CI/CD Integration: GitLab CI

GitLab CI
# .gitlab-ci.yml
veripass-gate:
  stage: test
  image: python:3.11-slim
  script:
    - pip install pyyaml
    - |
      curl -sf -X POST "$VERIPASS_URL/api/v1/cac/evaluate" \
        -H "Authorization: Bearer $VERIPASS_API_KEY" \
        -H "Content-Type: application/json" \
        -d "{
          \"config\": $(python3 -c 'import yaml,json,sys; print(json.dumps(yaml.safe_load(open(\".veripass.yml\"))))'),
          \"git_commit\": \"$CI_COMMIT_SHA\",
          \"git_branch\": \"$CI_COMMIT_REF_NAME\",
          \"git_author\": \"$GITLAB_USER_LOGIN\"
        }" | python3 -c "
      import json,sys
      r = json.load(sys.stdin)
      print(f'Gate: {r[\"overall_result\"]}')
      sys.exit(0 if r['overall_result'] != 'FAILED' else 1)
      "
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'

API Reference

MethodPathDescription
POST/api/v1/cac/evaluateRun certification gate
GET/api/v1/cac/gatesList gate history
GET/api/v1/cac/gates/:idGet gate result details
POST/api/v1/cac/validateValidate a .veripass.yml config
GET/api/v1/cac/templatesGet starter templates
GET/api/v1/cac/analyticsGate pass/fail analytics

Gate Artifacts

Each gate run produces a signed artifact with detailed results:

Artifacts include: gate ID, overall result, per-check pass/fail details, per-test results with BCS scores and verdicts, git metadata (commit, branch, author), and timestamp. Artifacts are computed on-the-fly and can be retrieved at any time via the API.

DASHBOARD

View gate history in INVESTIGATE > CI/CD Gates. Each gate shows pass/fail status, git commit, branch, author, and detailed test results.

42

Pricing

Platform access priced by deployment scale. Compliance modules priced separately — activate only what your regulatory environment requires.

CERTIFIED
$2,500/mo
$24,000/yr (save 20%)
Up to 3 AI systems. Proving governance with cryptographic proof.
  • All 19 compliance frameworks included
  • Five-Tier RRC 2.0 evaluation engine
  • Ed25519 signing + Merkle-chain audit trail
  • VCAS-compliant certification artifacts
  • Full dashboard (Monitor / Investigate / Configure / Reports)
  • 10 PDF reports + 8 data exports
  • Shadow / inline / async deployment modes
  • JavaScript + Python SDKs
  • Verification Gate API
  • Email support (48h SLA)
All 19 compliance frameworks included
ELITE
Custom
Starting at $120,000/yr
Unlimited AI systems. Regulated & autonomous.
  • Everything in Plus, plus:
  • Quantum-safe cryptography (ML-DSA-65, NIST FIPS 204)
  • Auditor evidence packages
  • CI/CD certification gates
  • Certification-as-Code (CaC)
  • Cross-model scope governance
  • ServiceNow integration
  • White-label / co-brand option
  • Custom SLA (up to 99.99%)
  • 24/7 phone + Slack support
All 19 compliance frameworks included
Every organization starts with a 60-day Elite evaluation at no cost.

COMPLIANCE FRAMEWORKS

All 19 compliance frameworks are included at every tier. No module add-ons. No extra fees. Activate the regulatory frameworks your industry requires — they apply automatically across all deployments.

PRINCIPLE

Compliance modules only tighten constraints — never loosen them. When a module is active, its requirements merge with your behavioral contracts using a most-restrictive-wins algorithm.

INTERNATIONAL FRAMEWORKS
EU AI Act
Included
INTERNATIONAL
High-risk AI classification, transparency, human oversight requirements
Enforcement August 2026
ISO 42001
Included
INTERNATIONAL
AI management system standard — governance, risk, and compliance
Active
SOC 2
Included
INTERNATIONAL
Trust services criteria — security, availability, processing integrity
Active
HIPAA
Included
US
Protected health information safeguards for AI systems handling patient data
Active
SOX
Included
US
Financial reporting controls for AI systems in public companies
Active
NERC CIP
Included
US
Critical infrastructure protection for energy sector AI
Active
PCI DSS v4.0
Included
GLOBAL
Payment card data protection for AI in financial transactions
Active
US FRAMEWORKS
Colorado SB 205
Included
US (CO)
Consumer protections for high-risk AI in consequential decisions
Enforcement Jun 30, 2026 (delayed by SB 25B-004)
Texas HB 1709
Included
US (TX)
Responsible AI Governance Act — prohibited uses, government obligations, AG enforcement
ACTIVE — Effective Jan 1, 2026
Illinois AI Employment Act (AIEA)
Included
US (IL)
IHRA amendment — AI-driven employment discrimination prevention, bias auditing
ACTIVE — Effective Jan 1, 2026
NYDFS Part 500
Included
US (NY)
AI/ML cybersecurity requirements for NYDFS-regulated financial entities
ACTIVE — Phase 2 Nov 1, 2024
EU / INTERNATIONAL
DORA
Included
EU
Digital Operational Resilience Act — ICT risk management for EU financial entities
ACTIVE — Fully in force Jan 17, 2025
The math is simple.

One HIPAA violation involving AI-generated content: $50K–$1.5M in fines.

VeriPass Certified with all 19 frameworks: $2,500/mo.

Behavioral certification that proves compliance before regulators ask.

Colorado SB 205 enforcement begins June 30, 2026. DORA fully in force since January 2025.
EU AI Act high-risk enforcement begins August 2026 —

43

Patent & Intellectual Property

VeriPass technology is protected under provisional patent VP-2026-001-PROV REV.3, covering 205 claims across five provisional filings.

CLAIM GROUP 1 — BEHAVIORAL CERTIFICATION

Six-dimension behavioral envelope with weighted composite scoring, floor enforcement, and grade assignment for AI model outputs. Claims 1–12.

CLAIM GROUP 2 — RRC COHERENCE ENGINE

Multi-tier Request-Response Coherence engine evaluating semantic alignment, structural coherence, entity fidelity, and temporal drift detection. Claims 13–21.

CLAIM GROUP 3 — CRYPTOGRAPHIC PROOF

Ed25519 digital signature with SHA-256 content hashing, Merkle tree block sealing, and chain-linking for tamper-evident certification records. Claims 22–30.

CLAIM GROUP 4 — COMPLIANCE CONSTELLATION

Simultaneous multi-framework compliance evaluation with star-field visualization, automatic gap detection, and regulatory-ready reporting. Claims 31–38.

NOTICE

VeriPass™ and the behavioral certification methodology described in this documentation are protected intellectual property. Patent pending: VP-2026-001-PROV REV.3. All rights reserved.

44

Frequently Asked Questions

How fast is a certification?
Typical certification latency is 200–400ms including all six dimension scores, RRC coherence analysis, compliance evaluation, and cryptographic signing. Batch requests process at approximately 50 certifications per second.
What happens when a certification fails?
In active mode, the AI response is quarantined and a failure record is generated. In shadow mode, the response is allowed through but the failure is logged for analysis. Both modes generate alerts via your configured channels (Slack, email, PagerDuty, webhook).
How does PII detection work?
Multi-tier content analysis combining pattern-based detection (credit cards, SSN, email, phone, medical records), NLP entity recognition, and LLM-powered contextual evaluation. All tiers run in parallel to catch PII that evades any single detection method.
Can I verify evidence without VeriPass infrastructure?
Yes. Every evidence package includes the Ed25519 public key, content hash, and signature. You can verify using any Ed25519 implementation (e.g., tweetnacl). The Merkle proof lets you independently confirm block inclusion without querying VeriPass servers. The public trust endpoint at verify.veripass.ai also provides instant independent certification verification.
Which compliance frameworks are evaluated automatically?
All 19 frameworks are evaluated simultaneously on every certification: EU AI Act, NIST AI RMF 2.0, ISO/IEC 42001, SOC 2 Type II, HIPAA/HITECH, PCI DSS v4.0, SOX, NERC CIP, GDPR, CCPA/CPRA, US State Privacy Bundle, FINRA/SEC, FTC Act, NYDFS Part 500, DORA, Quebec Law 25, Colorado SB 205, Texas HB 1709, and Illinois AI Employment Act (AIEA). No additional configuration required.
What database does VeriPass use?
Production: PostgreSQL (Railway). Local development: SQLite via sql.js. All SQL is cross-compatible between both engines. The certification pipeline, evidence chain, and compliance evaluation work identically on both.
Can VeriPass be self-hosted?
Yes, on the Enterprise plan. VeriPass runs as a standard Node.js application with Express 4. Deploy on any infrastructure that supports Node.js 18+ and PostgreSQL 14+. All cryptographic operations use tweetnacl (pure JavaScript) with no native dependencies.