Cryptographic vs declarative evidence for Art. 12
Record-keeping under the EU AI Act is not a PDF export problem. Art. 12 asks for tamper-evident, retrievable logs. Art. 14 asks whether oversight happened before side effects - not whether a checkbox said HITL was enabled. Most AI-SPM stacks still ship the second kind of answer.
Declarative evidence says “we claim we comply.” Cryptographic evidence says “prove what happened before side effects.”
The distinction
Declarative evidence includes dashboard exports, configuration attestations, framework-mapping slides, and verifiable credentials that are not bound to a live enforcement session. Useful for inventory and policy narrative. Insufficient when a regulator or insurer asks whether a specific agent action was authorized and logged immutably.
Cryptographic evidence is hash-anchored ledger rows, offline-verifiable receipts, and fail-closed invariants on the execution path. Integrity can be recomputed without logging into the vendor that produced the record.
Why declarative falls short for Art. 12 / 14
| Pattern | Example | Gap |
|---|---|---|
| Platform audit log | Databricks / Cyera UI history | Vendor-scoped; not portable after access lapses |
| W3C Agent Receipt (VC) | Identity attestation without session binding | No enforcement plane; decoupled from the tool call |
| SIEM aggregation | Splunk deny line | Post-hoc; mutable pipeline |
| GRC checkbox | “HITL enabled” in a control matrix | Config ≠ executed oversight |
What cryptographic accountability looks like
- Receipt-before-action - the tool does not run if the ledger cannot commit.
liability-receipt/v1- session-bound permit and DENIED profiles.@aevesa/verify/ verify.aevesa.com - offline verify without an operator session.- Witness cosign - independent guardian inclusion on material decisions.
That stack is accountability infrastructure - the Prove specialty beside gateways and AI-SPM - not a competing discovery dashboard. Framework mapping remains useful; it is not proof.
How to evaluate a vendor claim
Ask four questions in the RFP:
- Can a third party verify a high-value agent action completely offline?
- Is deny proven before execution, with the authority chain?
- Does multi-agent delegation remain a portable chain across frameworks?
- Can incident evidence be cryptographically frozen for Art. 73?
Run the open conformance path yourself:
npm run test:conformance-lab and
npm run interop:gateway-to-verify (<5 minutes) - no Aevesa login.
Companion internals:
docs/standards/CRYPTOGRAPHIC_VS_DECLARATIVE_EVIDENCE.md ·
Trust Bundle ·
Wave 3.1 standards leadership.