AIUC-1 asks for evidence. Hexr produces it at runtime, and your auditor verifies it without us.
A certificate says an agent was assessed. It does not say what that agent did in production last Tuesday, which process did it, or whether the record has been edited since. Hexr is the runtime that answers those three questions, in the customer's own cluster, with an artefact an auditor can check on their own laptop.
Hexr is not a certification and does not replace one. It covers the requirements below, and nothing else. Everything on this page runs in production today and can be checked against the sample package in the next section.
Requirement by requirement
- AIUC-1 asks for
- “Log immutability controls — WORM storage, cryptographic hashing of log entries, append-only settings.”
- What Hexr emits
- Each evidence row carries the hash of the row before it, and its own signature made inside the agent process with the private key of its SPIRE-issued X.509-SVID. Integrity and authorship are two separate checks, reported separately.
- How the auditor verifies it
- Open verify.html from the package: the chain is re-walked and every signature re-checked against the customer's root. Edit one byte and the chain breaks at exactly that row.
- AIUC-1 asks for
- “Agent provenance metadata per execution… delegation chain records showing sub-agent handoffs with identity, task context and outcome at each step… approval/authorization records linked to execution.”
- What Hexr emits
- Identity is per operating-system process, not per pod or account: spiffe://…/<tenant>/<framework>/<agent>/<role>/proc-<pid>. Agent-to-agent calls run over mutual TLS and each hop is signed by the process that made it. The policy decision is its own row, written before the call executes, naming the caller and the control.
- How the auditor verifies it
- Every row in the package names its signing identity down to the PID. The authorization row precedes the action row in the same chain.
- AIUC-1 asks for
- What activity is captured; retention, access control, sanitation.
- What Hexr emits
- Tool calls, model calls with token counts, policy decisions, credential exchanges, A2A hops — each mapped to the control it satisfies. Evidence is stored in the customer's own cluster, in their own Postgres. Hexr never holds it.
- How the auditor verifies it
- The package's manifest states the tenant, period, scope and the digest of every file in it.
- AIUC-1 asks for
- “Restricting tool calls to approved functions… validating parameters before execution” and “tracking all tool calls, monitoring for unauthorized access attempts or scope violations.”
- What Hexr emits
- Every tool call is authorized before it runs and the decision is a signed row either way. A refusal is evidence, not a gap: an unregistered process asking for credentials is recorded as denied, with the reason.
- How the auditor verifies it
- controls.json in the package counts allowed and denied per control. The live demo shows a deliberately unregistered process refused on every run.
- AIUC-1 asks for
- “Technical restrictions that limit agent capabilities to authorized scope… service-level authorization preventing access to sensitive systems.”
- What Hexr emits
- Authorization is bound to an attested process, not to a network position or a shared token. A process with no attested identity is refused outright rather than flagged, because no registration entry matches a PID nobody declared.
- How the auditor verifies it
- The denial rows name the process that asked and what it asked for.
- AIUC-1 asks for
- “Access scoping limiting which tools or sessions can retrieve specific credentials… just-in-time credential fetching at tool-call time” rather than persisting them in the agent's context.
- What Hexr emits
- The agent process holds no long-lived key. It presents its identity and receives short-lived cloud credentials at the moment of the call; the secret store releases a secret only to a process that proves which identity it is, enforced by policy that denies by default.
- How the auditor verifies it
- Credential-exchange rows name the identity served. Cache entries are keyed by identity; a process with no identity is never served from cache.
- AIUC-1 asks for
- Who is accountable, and monitoring of third-party access with alerting on anomalies.
- What Hexr emits
- External auditors get a named, scoped, expiring link — never the operator's credentials. Account creation, each page opened, each request, each fulfilment, each download and each revocation is itself a signed row in the same chain.
- How the auditor verifies it
- The record of who accessed the evidence is in the evidence.
Check it yourself, now
The link below opens a real evidence package from a healthcare claims workload running on AWS: seven days, 5,338 chained rows, every signature made inside the process that acted, and the package itself signed by the evidence service. The verifier recomputes every hash and every signature in your browser, against the customer's root certificate, with no network calls and nothing installed.
What Hexr does not do
- Adversarial testing and red-teaming (B001, B002, C010–C012, D002, D004) — that is the work of AIUC's accredited third-party evaluators.
- Hallucination prevention (D001) and output filtering (B005). Hexr records what a model call was and that it happened; it does not judge the answer.
- Policies, failure plans and governance documents (E001–E003, E010–E013). Hexr produces the technical evidence those documents claim.
- Any agent running inside a vendor's managed runtime. Hexr attests processes on infrastructure the customer controls, on any cloud; where there is no machine to place an attestor on, there is nothing to attest, and we say so rather than implying coverage.
Why this matters to underwriting
Certification is point-in-time; an incident is not. When a claim is made, the question is what the agent actually did, which process did it, and whether the record can be trusted — the same questions the SentinelOne investigation into agent activity on Hugging Face had to answer by correlating timestamps across two companies over several weeks. Continuous, signed, per-process evidence turns that reconstruction into a single verification. It is also the only way technical assurance reaches the scale AIUC has argued for: a million audited deployments cannot be reviewed by hand, but a package that verifies itself can be.
Questions, or a walkthrough against your own agents: [email protected].
