Compliance evidence bundle

When an auditor asks how you govern your AI agents, the evidence bundle is the answer: a one-click zip, assembled live from your control plane, that an auditor can verify offline without an AxioRank account. By default every artifact is mapped to SOC 2 (Trust Services Criteria) and ISO/IEC 27001:2022 Annex A controls in the bundled CONTROLS.md. Other framework profiles (HIPAA, NIST AI RMF, ISO 42001, and more) are one query parameter away (see Framework profiles).

The bundle is a point-in-time snapshot. Activity counts cover the trailing 90 days; the integrity artifacts cover the audit ledger's entire checkpoint history. Everything in it is already redacted and safe to leave the platform: the governance config carries no secrets, and the ledger artifacts are signatures and hashes.

Generate it

Download it from Dashboard → Zero Trust Maturity (/maturity) or Dashboard → Audit Integrity (/integrity), or hit the route directly:

GET /api/compliance/evidence-bundle

This is a dashboard route authenticated by your signed-in session (it is a download link, not an API-key endpoint). The response is application/zip, named axiorank-evidence-YYYY-MM-DD-90d.zip from the generation date, where the trailing 90d is the evidence window in days (90 by default).

Contents

Verify offline

The integrity/ artifacts are designed so an auditor needs nothing but the published public key:

1. Signature: the signed tree head's Ed25519 signature verifies against a key in integrity/jwks.json. Pin the JWKS out of band (or refetch it from /api/v1/audit/public-key) so verification does not trust the bundle itself.
2. Chain: each entry in integrity/checkpoints.json links to the previous via prevHash, so any altered, deleted, inserted, or reordered row breaks the chain from that point forward.
3. Per-row proof: any individual audit row can be proven with a verifiable receipt against the tree head in this bundle.

The open-source verifier runs entirely offline:

npm install @axiorank/audit-verify

import { verifyReceipt } from "@axiorank/audit-verify";

const result = verifyReceipt(receipt, jwks); // jwks pinned out of band
console.log(result.ok, result.checks); // leaf, inclusion, sthSignature, provenance

pip install "axiorank[verify]"

from axiorank import verify_receipt

assert verify_receipt(receipt, jwks) is True

The bundled VERIFY.md walks your auditor through the same steps, so they can verify without ever reading these docs.

Use cases

• Auditor handoff: drop one zip into the evidence request portal instead of screenshotting a dozen dashboards.
• Quarterly access review: access/access-review.json is a member, role, MFA, and SSO snapshot you can archive and sign off each quarter.
• Vendor questionnaires: the scorecard and control mapping answer most "how do you govern agent actions?" questions verbatim.

Framework profiles

The default bundle maps to SOC 2 and ISO 27001. The same machinery assembles a pack mapped to a different framework with a ?profile= query parameter on the download route:

GET /api/compliance/evidence-bundle?profile=hipaa

An unrecognized value falls back to the default SOC 2 pack. Scheduled evidence delivery takes the same profile, so a recurring HIPAA or EU AI Act pack can land on your evidence endpoint automatically.

Next steps

• Audit integrity: how sealing, tree heads, and receipts work.
• Config as code: the export behind governance/config.json.
• Privacy & data rights: the retention policy the bundle reports.
• Enforcement benchmark: the receipt-backed, model-free methodology for measuring what the gateway enforces.