Skip to main content

Prove-It: verifiable answers

An assistant that reads governed data has a problem no amount of model quality solves: a fluent answer is not necessarily an authorized one. It can be correct, well-sourced, confidently phrased, and still have been assembled from something the asker was not cleared to see.

Prove-It makes that checkable rather than trusted. Every chat answer can return a signed verification bundle recording why the answer is what it is, and whether every classification marking that applied was actually dominated by the asker's clearance.

The guardrail this is built against, stated in the implementation itself: coherence is not alignment. A fluent, even signed, answer is not necessarily an authorized one.

What the bundle records​

RecordedDetail
The question and the answerWhat was asked and what came back
The tool callsWith hashed result digests, never raw data
The lineage of sources touchedWhich assets the answer drew on
The markings that appliedAnd, for each, whether the asker dominated it
The entity identitiesThe asker, the agent, and the services involved

The digest choice is deliberate. A verification bundle that carried raw tool results would itself become an exfiltration path: a record you hand to an auditor must be safe to hand over. So the bundle proves what happened by content hash rather than by reproducing the content.

Verification fails on either leg​

The bundle is signed over canonical bytes using the platform's existing bundle signer rather than any hand-rolled crypto. Verification then checks two independent things, and failing either fails the answer:

  1. The signature holds. The bundle is what it claims to be and has not changed.
  2. Every marking was dominated. The asker's clearance actually covered every classification that applied to the material behind the answer.

That second check is the one with no counterpart elsewhere. It converts "the assistant is supposed to respect classification" into "here is the record of which markings applied and whether you were cleared for each, and the record is signed."

Receipts chain per session​

A per-session receipt log hash-chains the receipts, so a sequence of answers is tamper-evident as a chain rather than as a set of independently-signed artifacts.

The difference matters for the question an investigator actually asks, which is rarely about one answer. It is "what did this person ask, and what were they told, over this session", and a chain answers it in a way a bag of signed receipts cannot: you can tell whether one was removed.

A verification route exists for checking a chain rather than only a single bundle.

Where it sits​

Prove-It is wired into the chat session path, so recording is part of answering rather than a separate audit step someone must remember to run, and a failed verdict fails the answer rather than being logged beside it.

It composes with the rest of the chat governance rather than replacing it:

  • The chat principal means the assistant reaches data through the asker's own access path, so the marking check is verifying a boundary that was already enforced rather than substituting for one.
  • Classification markings render on the conversation itself, so the asker sees what applied.
  • The data-security plane already carries which policies applied and the effective versus required clearance. Their comparison is the dominance check the bundle attests, which is why this is a bridge over existing evidence rather than a new trust assumption.

Why this is the sharpest thing in the chat surface​

Ask an AI platform vendor: when your assistant answers a question using classified or regulated data, what can you hand an auditor?

The usual answer is a transcript and a log line. A transcript proves what was said. It proves nothing about what was read, under whose authority, or whether a marking was honoured on the way.

A signed bundle naming the sources by lineage, the tool results by digest, the markings that applied, and the dominance verdict for each, chained per session, is a different artifact. As far as the platform's own competitive register records, no competitor offers this.