Governance
Evidence an auditor will accept.
Most agent tooling produces logs. Logs are not evidence. Cognition Engines ingests events, links them to the decisions they support, maps them to named controls in recognised frameworks, and exports a bundle whose chain can be independently verified.
The distinction most systems skip
Evidence is classified by where it came from, and the two classes are not interchangeable. This is enforced in the mapping rules themselves, not left to the reader.
observed
Third-party events the agent cannot author — GitHub pull request opens, reviews, approvals and merges. This is the class that carries weight, because the agent is not the source.
attested
First-party CSTP decision records — the agent's own account of its reasoning, confidence and stakes. Useful corroboration, but an agent can write anything here. Controls satisfied only by attested rules are flagged attested_onlyin the exported bundle.
Fail closed, not open.Controls that assert independent human review require a human actor signal on the upstream event — actor_is_humanon approvals, human_approval_counton merges. If the webhook does not supply them, the rule grants no control credit and the gap is surfaced rather than silently passed.
Control frameworks mapped
3 mapping files ship in the repository. Each rule names the framework function it satisfies, the lifecycle stage it belongs to, and the event pattern that triggers it.
SR 11-7
Federal Reserve Supervisory Guidance on Model Risk Management
NIST AI RMF
NIST Artificial Intelligence Risk Management Framework 1.0
CSTP Attested
First-party decision records recorded by the agent itself
The evidence pipeline
- 01
cstp.ingestEvidenceTake in an event from an upstream system.
- 02
cstp.linkEvidenceBind that event to the decision it evidences.
- 03
cstp.mapControlsResolve which framework controls the event satisfies.
- 04
cstp.exportEvidenceBundleEmit the packaged bundle for review.
- 05
cstp.verifyEvidenceChainRe-check the chain's integrity independently.
5 of 34 CSTP methods, verified present in the dispatcher.
Prevention and self-assessment
Expression guardrails
Guardrails can be written as CEL expressions evaluated against the proposed action, alongside the built-in rule logic. Policies live in version control and are reviewed like any other change.
Circuit breakers
Repeated failures in a category trip a breaker, whose state is inspectable and resettable through the protocol rather than buried in process memory.
Calibration
Brier scoring against logged outcomes, reported per category, with reason-type statistics showing which kinds of justification actually predict success.
Drift detection
Calibration is tracked over time, so a quietly degrading agent becomes a signal you can act on rather than an incident you discover.
Verify this page. Every count above is generated directly from the source repository at build time. Nothing here is hand-typed prose about the system's size or surface.