Question 1

What does governed AI actually mean here?

Accepted Answer

Every consequential action an agent takes is a held write. It waits for a human to approve it, and only then does it commit — sealed to a tamper-evident evidence chain an auditor can replay. The model proposes. It is never the source of truth.

Question 2

What is a Governed Receipt?

Accepted Answer

A cryptographically signed, offline-verifiable record that an AI system did a given piece of work under a given set of controls. It is signed with Ed25519 over the canonical body and carries an optional hash-linked evidence chain, so anyone can re-derive the proof in their browser — no account, no network call. The open spec lives at /governed-receipt-spec and the public verifier at /verify.

Question 3

You call /verify a neutral referee. How is it neutral if you built it?

Accepted Answer

It never trusts a dashboard. It re-derives every proof from the receipt's own bytes using public cryptography on your device — no LockedIn Labs key or server in the trust path. It even grades a rival's receipt: paste a Microsoft Agent-Governance Toolkit or EMILIA Protocol receipt and it certifies it under that format's own rules, then reports an honest PASS, PARTIAL, or FAIL.

Question 4

Does this help with the EU AI Act and audits?

Accepted Answer

Yes. The /evidence surface assembles an Article-12-style logging and record-keeping pack from signed receipts, and /verify scores a receipt against the Article-12 conformance profile. We are in active readiness for SOC 2 Type II and ISO/IEC 42001 — we will say so plainly when each is achieved, and not before.

The Difference