HexaSec
REQUEST PILOT
01 / EVIDENCE

Evidence that survives the run.

HexaSec treats evidence as a first-class output: retained run context, scenario outcomes, policy decisions and integrity material that can be inspected after execution.

02 / BUNDLE ANATOMY

What a decision leaves behind.

A gate outcome is accompanied by the artefacts needed to understand the run, its results and the decision that followed.

SYNTHETIC REFERENCENO CUSTOMER DATA08 ARTEFACTS / CANONICAL SAMPLE
SELECTED ARTEFACTmanifest.json
TYPEJSON
CLASSRUN CONTEXT
WHAT IT CONTAINS

Run identity, target and reproducibility metadata.

PURPOSE

Identify the run, target, pack and configuration represented by the bundle.

ROLE IN RELEASE RECORD

Root index for the retained release record.

{
  "run_id": "AAG-RUN-0247",
  "created_at": "2026-08-14T09:42:17Z",
  "pack": "rag-tool-safety-v3.2",
  "target": "reference-assistant-hardened",
  "configuration_hash": "sha256:7f4a0b8d…9c21",
  "decision": "GO",
  "evidence_version": "1.2"
}
WHAT IS RETAINED?RUN CONTEXT → RESULTS → DECISIONS → TRACES → INTEGRITY MATERIAL
03 / EVIDENCE LIFECYCLE

From execution to retained proof.

Evidence moves from observed runtime behaviour to a retained record that can be inspected and, where integrity material is configured, independently checked.

PROCESS / EVIDENCE RETENTIONSIGNING / CONFIGURED INTEGRITY MECHANISM
ACTIVE STAGEEXECUTE
INPUT / CONTEXTSCENARIO PACK + TARGET CONFIGURATION

Run the selected, versioned assurance scenarios against the configured target system.

OUTPUTEXECUTION CONTEXT
RUN→RESULT→DECISION→EVIDENCE→REVIEW
04 / TRACEABILITY

From finding to release decision.

A retained decision record should show more than the final outcome. AAG links the scenario, observed behaviour, deterministic checks, policy evaluation and resulting gate contribution so reviewers can inspect why a release state was produced.

RETAINED DECISION LINEAGESELECT A RECORD STAGE
  1. 01SCENARIOScenario definition and run reference
  2. 02OBSERVATIONObserved runtime evidence
  3. 03DETECTORDeterministic check result
  4. 04POLICY DECISIONPolicy evaluation outcome
  5. 05GATE CONTRIBUTIONDecision-lineage contribution
  6. 06FINAL DECISIONRelease decision
  7. 07RETAINED ARTEFACTSPortable evidence record
RECORD TYPEObserved runtime evidence
QUESTION ANSWEREDWhat did the target system actually do?
RETAINED ASresults.ndjson / trace artefact
ROLE

Provides evidence consumed by deterministic checks.

OUTCOME ALONE IS NOT THE RECORDTRACE / INSPECT / RETAIN
05 / INTEGRITY

Know if the retained record changed.

Where integrity material is configured, a retained evidence bundle can be checked later to determine whether the artefacts being reviewed still match the record that was produced.

SYNTHETIC REFERENCE / NOT CUSTOMER DATAILLUSTRATIVE INTEGRITY CHECK
01manifest.jsonJSON
02results.ndjsonNDJSON
03policy_decisions.jsonJSON
04tool_traces.jsonlJSONL
05retrieval_traces.jsonlJSONL
06assurance-graph.jsonJSON
07report.htmlREPORT
BUNDLE DIGESTDIGEST MATCHARTEFACTS CORRESPOND TO RETAINED DIGEST
OPTIONAL / CONFIGURED SIGNATURE MATERIALINCLUDED WHEN CONFIGUREDREPRESENTED BY BUNDLE.SIG IN THIS SYNTHETIC REFERENCE
VERIFICATIONVERIFICATION SUCCEEDSRETAINED RECORD CORRESPONDS
  1. 01MANIFESTCHECKED
  2. 02RESULTSCHECKED
  3. 03POLICY DECISIONSCHECKED
  4. 04BUNDLE DIGESTMATCH
  5. 05SIGNATURECHECKED
06 / REVIEW

Inspect the record without the runtime.

Once evidence has been retained, reviewers can examine the execution, decision inputs and supporting artefacts without requiring continued access to the live assistant or the original AAG workspace.

RETAINED-RECORD REVIEW MODELPOSSIBLE REVIEW CONTEXTS / NOT CERTIFICATION CLAIMS
01 / SOURCE

LIVE SYSTEM

STATUS
RUNTIME ACCESS
RETAINED-RECORD REVIEW
NOT REQUIRED

This statement is limited to review of the retained evidence record.

02 / BRIDGE

RETAINED EVIDENCE BUNDLE

  • 01manifest.jsonRun identity, target and reproducibility metadata.
  • 02results.ndjsonOne deterministic outcome record per executed scenario.
  • 03policy_decisions.jsonPolicy outcomes linked directly to scenario evidence.
  • 04tool_traces.jsonlSanitised tool requests and deterministic enforcement results.
  • 05retrieval_traces.jsonlSynthetic retrieval events with provenance and trust decisions.
  • 06assurance-graph.jsonCompact evidence lineage from control to release decision.
  • 07report.htmlPortable human-readable summary of the assurance run.
  • 08bundle.sigDetached signature for the static sample evidence bundle.
03 / CONTEXT

REVIEW CONTEXT

Retained evidence may support contexts such as:

  • SECURITY REVIEW
  • ASSURANCE REVIEW
  • CHANGE REVIEW
  • PROCUREMENT / TECHNICAL DUE DILIGENCE
  • AUDIT SUPPORT
01INSPECTABLE

Review the evidence contributing to a decision.

02PORTABLE

Retain the release record outside the live workspace.

03VERIFIABLE

Where integrity material is configured, check the retained record later.

07 / NEXT STEP

See the evidence produced by your own AI workflow.

A focused AAG pilot evaluates one agreed AI workflow against an agreed threat model, produces a release decision and retains the evidence behind it for inspection.

REQUEST A PILOTEXPLORE AAG
TARGET
ONE AI WORKFLOW
OUTPUT
RETAINED EVIDENCE
DECISION
GO / CONDITIONAL / NO-GO
DEPLOYMENT
CUSTOMER ENVIRONMENT