Compliance

VIGIL produces evidence. It does not certify anything, and this page never says "compliant." What it gives an auditor is a set of artifacts that serve as evidence toward specific controls, each one traceable to ledger records that verify offline.

The export bundle

The compliance export bundle (POST /exports/bundle) is in the wave that follows this documentation and is not yet on main. When it ships, one bundle for a date range will contain:

Artifact	What it is	Evidence toward
Ledger JSONL	Every ledger record in the range, plus verify.py	Record-keeping and traceability; tamper-evidence
Policy versions	Every policy in effect during the range, with digests	Documented risk thresholds and their change history
System cards	One per agent: what it does, what it may touch, its gate history	Technical documentation of the AI system
Incident records	For each hold, alert or collapse: nature, detected at, contained at, affected agent, human oversight, ledger range	Incident reporting in the shape regulators ask for
Human-oversight CSV	Every review decision with reviewer identity, outcome, note and latency	Human oversight measures, proven to have happened
Control mapping	Which artifact serves which clause	The auditor's index
MANIFEST.json	Hashes of every file above	Appended to the ledger as record_type = "export", so the bundle itself is sealed

The control mapping will state, artifact by artifact, which EU AI Act articles, OWASP Agentic Security Initiative items, MITRE ATLAS techniques, ISO/IEC 42001 clauses and SOC 2 criteria each one serves. The wording will be "evidence toward" throughout. Whether your deployment meets a given obligation is a judgment your auditor makes with the evidence in hand; VIGIL supplies the evidence.

What you can export today

• The verified ledger. GET /audit/export returns the raw records; tools/vigil_verify.py verifies the chain and the HMACs with no dependency on VIGIL. See the ledger.
• Provenance per agent. GET /audit/{agent_id} joins events to gate outcomes and ledger positions.
• Review decisions. Every release, reject or escalate is a review record on the chain with the reviewer's identity, and GET /enforcement/{action_id} shows the outcome.
• Policy history. GET /policies lists every version with its digest.
• Usage. GET /usage?days=30 gives daily counts of events, holds, alerts, collapses and API calls.

Pull the evidence you can pull now

curl -sf -H "Authorization: Bearer $VIGIL_KEY" "$VIGIL_URL/usage?days=7"
curl -sf -H "Authorization: Bearer $VIGIL_KEY" "$VIGIL_URL/policies"

Questions about a specific framework: louis@supertruth.ai.