Know what you are approving
A clear release boundary
Identify the version, intended use and permissions behind the decision. Reviewers can see what the assessment covers and what remains unresolved.
Reviewable evidence
Connect findings to selected requirements and evaluation cases. Challenge conclusions without reconstructing the entire run.
Responsible change
Preserve historical results while new signals, decisions and versions receive their own records.
Different roles, one accountable process
Business owners
Define permitted outcomes and consequences of a mistake. Own the decision about whether the use case should proceed.
Engineering and security
Describe the system, prepare controlled evaluation access and investigate technical findings.
Risk, compliance and reviewers
Confirm scope, inspect evidence and record decisions or conditions. The platform does not replace their authority.
Start with the obligations that apply
An Assurance Plan links selected requirements to controls and evaluation criteria. Future policy imports support review and mapping; requirements are not silently adopted.
Company managed policies
Bring approved uses, prohibited actions, data boundaries and escalation requirements. Assign each requirement an owner and version.
External requirements
Select applicable regulations, major standards and industry requirements with qualified reviewers. Inclusion does not establish conformity.
Red team practices
Choose adversarial scenarios that exercise actual tools, permissions and operating context.
From registration to reassessment
Register the agent and exact version
Identify code, configuration, model dependencies, tools and the release owner.
Define assurance scope
Record intended users, tasks, environments and exclusions.
Apply policies and external requirements
Confirm which requirements apply and why.
Prepare evaluation criteria
Specify expected behaviour, evidence needs and escalation conditions before testing.
Evaluate and red team behaviour
Collect observations from approved cases and adversarial scenarios.
Review evidence and decisions
An authorized person considers failures, gaps and operating conditions.
Produce the Assurance Scorecard
Summarize results, findings, coverage, limitations and canonical evidence.
Publish an eligible Agent Passport
Select a public safe projection after the appropriate review and publication decision.
Monitor material change and drift
Compare relevant signals with the approved operating context.
Investigate or reassess
Determine whether remediation, new evaluation or an updated artifact is required.
Two artifacts with different audiences
Illustrative artifact structure. No operational results are shown.
Assurance Scorecard
The assessment summary for reviewers: results, findings, coverage, limitations and evidence references.
Agent Passport
A shareable record with approved scope and relevant status. It excludes private evidence and does not turn the assessment into statutory certification.
Keep historical assessment truth intact
A new signal may reveal a changed prompt, new population, failed dependency or revised policy. Investigate its significance before changing the current operating decision. A historical Scorecard records what was assessed at that time.
The same assurance engine governs work started through the workspace, API, CI/CD or approved private connection. Access changes the client or execution boundary, not the evaluation authority.
Adapt the policy engine without losing history
Treat coverage as versioned selections. When a requirement changes, review applicability, map it to controls and evaluations, and decide which agents need reassessment. Keep earlier mappings available to explain previous decisions. Future policy imports require review before use.
One assurance engine, five enterprise delivery choices
Access changes where work starts and which environment it reaches. It does not create a different evaluator. Confirm availability and deployment boundaries during scoping.
Enterprise workspace
Bring scope, Assurance Plans, evidence and human review into one managed workspace.
CI/CD and GitHub assurance gate
Connect assurance decisions to the version your team intends to release.
Customer VPC connection
Connect customer environments with agreed access and evidence boundaries.
Private deployment with backend connector
Keep approved execution in a private environment through a backend connector, with agreed evidence boundaries.
Private deployment through API
Connect a privately deployed agent through an approved API. The same assurance engine governs evaluation and evidence.
The enterprise workspace is available. Other delivery options require engagement-specific technical approval before deployment. Policy imports remain a future option.
Questions about enterprise ai assurance platform
Do API and GitHub requests use different evaluators?
No. The intended architecture uses the shared assurance engine. GitHub is a client of the Gate API; access methods do not create separate evaluation rules.
Can assessment automatically approve a legal obligation?
No. Evaluation supports review. Legal interpretation, risk acceptance and deployment authority remain with the appropriate people.