Runtime Assurance Platform · Evidence receipt layer

The runtime evidence layer for AI systems that act.

Continuous attestation is the steady stream of signed evidence receipts emitted by local runtime controls inside your infrastructure. Receipts are continuously assembled into evidence packs your board, your customers, and your regulators can verify — with zero sensitive-data egress.

OVERT receipt streampolicy:clinical.note.v2.4
notary ed25519
glc_a3f1c98e02
sha256:7bd1e94c8a…3f02 · allowed
glc_b27e4d11ab
sha256:c019fb5d72…a8e1 · allowed
glc_4f0892ce6d
sha256:9e5a16d8c4…b7d2 · flagged
glc_dc73a5602f
sha256:b48f02ad19…5c0f · allowed
glc_91eb22a7d3
sha256:5d2c8e91b6…e304 · withheld
chain depth 1,284 · verifier overt.is
Properties
Zero egressSidecar mode Inline enforcementShadow to enforce Tamper-proofCrypto signatures <50msTotal overhead (p95)

How it works

Five steps. Every AI request.

Every time your AI acts, local runtime controls inside your infrastructure emit a signed evidence receipt for the decision that ran.

01 / REQUEST

Request arrives

An AI request enters the GLACIS Enforce module. Enforce sits inline in your request path — every interaction passes through it before reaching your model or returning to the user.

02 / CONTROLS

Controls execute

Safety controls run: content filtering, bias checks, PII detection, consent verification. Each control’s outcome is recorded as it executes.

03 / POLICY

Policy enforced

Enforce evaluates your active governance posture and renders a decision: PERMIT, DENY, escalate, or flag. The decision is applied inline — non-compliant requests are blocked before they reach the model.

04 / SEAL

Evidence sealed

A cryptographic attestation is generated — signed, timestamped, and chained. Any attempt to modify, delete, or reorder records is cryptographically detectable.

05 / VERIFY

Auditors verify

Auditors, customers, or regulators can independently verify any attestation. No trust required in GLACIS or your organization. The math proves it.

06 / ASSEMBLE

Evidence pack delivered

Receipts continuously assemble into a board- and audit-ready evidence pack mapped to NIST AI RMF, ISO/IEC 42001, the EU AI Act Article 12 logging duty, and Colorado/Texas state requirements.

Deployment modes

Start observing. Enforce when ready.

Every mode change is itself attested.

Shadow

Observe all traffic, evaluate against policy, generate receipts. Never block. Perfect for baselining your governance posture before enforcement.

Warn

Evaluate and alert on policy violations. Generate receipts with violation flags. Don’t block requests — let your team review before enabling enforcement.

Enforce

Block policy violations with denial receipts. Permit compliant requests. Every decision — permit and deny — is independently attested.

Strict

Block violations and circuit-break when violation thresholds are exceeded. For environments where policy breaches require immediate pipeline shutdown.

Fail-closed (default)

Requests denied if Enforce is unavailable. Safety takes priority over availability. No request proceeds without governance evaluation.

Fail-open (configurable)

Requests proceed with a flag if Enforce is unavailable. Availability takes priority. The unevaluated request is logged and flagged for retroactive review.

Why this matters

Annual audits sample. Continuous attestation proves.

Traditional approach

  • Annual audits sample a fraction of interactions
  • Policies say what should happen
  • Logs can be altered after the fact
  • Months between control check and evidence

Continuous attestation

  • Every AI interaction generates proof
  • Attestations prove what actually happened
  • Cryptographic signatures prevent tampering
  • Evidence generated at time of execution

What you can prove

Six classes of evidence, one runtime.

Safety controls

Content filtering, harmful output detection, and safety controls executed on every inference.

Bias testing

Fairness checks ran on model outputs with verifiable test parameters and results.

Data privacy

PII detection, data masking, and access controls applied before data reaches the model.

Audit trails

Complete, immutable record of who accessed what, when, and what the AI did with it.

Model versioning

Proof of exactly which model version processed each request. No confusion about what ran.

Response times

Latency and performance metrics with cryptographic timestamps. SLA compliance evidence.

Start with one high-risk AI workflow.

Book a focused Agent Runtime Security & Evidence Sprint, then deploy runtime assurance where the risk is real.