EVE AI Core
The Infrastructure of No.
Six plain-English explainers on the ideas behind regulated AI — governance, control planes, model risk, audit trails, and the difference between advising and enforcing. Each is the clearest answer we can write to one question.
Two organizations can say “we do AI governance” and mean completely different things. This glossary fixes the vocabulary so the words carry weight.
“AI governance is the set of policies, controls, and evidence that determine what an AI system is allowed to do — and prove those rules were enforced on each decision.”
Real governance is not a document or a dashboard. It is three things working together — and the third is the one most teams are missing.
The rules an AI decision must satisfy — expressed precisely enough to evaluate automatically, not just as a PDF of principles.
A control point that applies the policy before the action runs, so a disallowed decision never reaches production — not a score you read afterward.
A signed, reproducible record of each decision that an auditor or examiner can verify independently — not logs you ask them to trust.
The standards, protocols, and product terms that come up across EVE’s governance, evidence, and compliance surface — defined plainly.
| Term | Meaning |
|---|---|
| API / SDK / SaaS | Application Programming Interface / Software Development Kit / Software-as-a-Service |
| LLM | Large Language Model |
| MCP | Model Context Protocol |
| A2A | Agent-to-Agent protocol |
| RBAC | Role-Based Access Control |
| RLS | Row-Level Security |
| HMAC | Hash-based Message Authentication Code |
| JWT | JSON Web Token |
| SSO / SAML / OIDC | Single Sign-On / Security Assertion Markup Language / OpenID Connect |
| SBOM / AI-BOM | Software / AI Bill of Materials |
| SLSA | Supply-chain Levels for Software Artifacts |
| SPIFFE | Secure Production Identity Framework For Everyone |
| OSCAL | Open Security Controls Assessment Language |
| DSSE / in-toto | Signing-envelope and attestation formats for tamper-evident evidence |
| SSE | Server-Sent Events |
| PII | Personally Identifiable Information |
| GDPR / CCPA | EU / California data-privacy regulations |
| SOC 2 | System & Organization Controls 2 — EVE is pursuing Type II (readiness in progress) and provides evidence and readiness packages, not an issued attestation |
| SR 26-2 | U.S. Federal Reserve model-risk supervisory guidance (superseding SR 11-7); policy-pack mappings reference the current framework |
| ECOA | Equal Credit Opportunity Act (fair-lending) |
| EU AI Act | European Union Artificial Intelligence Act |
| Term | Meaning |
|---|---|
| EVE CoreGuard | Deterministic decision-enforcement engine for regulated AI — ALLOWED / BLOCKED / MODIFIED before an action runs |
| EVE Proof | ECDSA P-384-signed, offline-verifiable Governed Decision Certificate for each decision |
| Agent Gateway | Governs an AI agent’s tool and action calls behind CoreGuard before execution |
| Sovereign SDK | Tenant-isolated governance-as-a-service for enterprises |
| Authority Lab | Public “run your agent through EVE” scanner with a signed report |
| Policy Compiler | Author and validate governance policy packs (draft-only; never auto-activates) |
Plain-English explainers on the concepts behind regulated AI governance — each one written to be the clearest answer to a single question, and each linking to the products and documentation that put it into practice.
We’ll run one of your real decisions through the deterministic control plane, show you the same verdict twice, and hand you the signed certificate your auditors verify offline.