Define the expected work.
Record the requirements, files, and checks. Keep a fingerprint of that plan so later work can be reviewed against the same version.
COMPLIANCE & AUDIT TRAIL
Follow the work from plan to result.
See what was planned, which actions were captured, what returned, and how the result was checked. Keep the supporting evidence and the unfinished work in view.
An action needs its context.
On configured paths, task and phase references connect recorded activity to the scope and checks declared before work begins. A reviewer can compare the intended work with the measured result.
Keep the request and result.
Captured tool records retain the task reference and available request, result, and timing information. Registered operation codes identify the kind of event.
Measure what happened.
Checks record process exit codes, output fingerprints, and file state. Failed checks, changed files, and missing results keep the declared delivery incomplete.
See how a record supports a review.
Illustrative workflow
Example recordsFollow one evidence review.
Select a step to see how the record relates to the plan. This example uses fictional data and does not run an assessment.
task_started
The review starts with a defined scope.
The example plan names the control, the evidence file, and the check that must run. Its task reference follows the captured work.
- Task
- DEMO-MFA-01
- Scope
- Review MFA evidence for designated users
- Expected file
- mfa-review.json
- Required check
- Confirm evidence for each designated user
What each part contributes.
VIRP, the operation registry, and the action ledger serve different purposes. The review uses them together where those paths are connected.
Authenticate the observation.
The Verified Infrastructure Response Protocol separates observations from intent. Its verification paths check signed records and channel boundaries. A proposed change remains distinct from evidence collected about the system.
A valid signature establishes record integrity under the configured trust model. It does not establish that an interpretation is correct.
Identify the event precisely.
An opcode names an operation, such as an evidence query or a phase check. The namespace matters: an AMP code and a VMRL code can use similar numbers for different operations.
A registered code describes the operation. Its handler, permissions, and returned result determine what actually happened.
Preserve a reviewable sequence.
The configured client ledger signs records with Ed25519 and links each record to the previous fingerprint. Task records bind requirements and check plans. Delivery receipts point to the measured checks and declared file state.
Integrity and capture coverage are reported separately. A signed receipt does not grant permission or replace independent review.
How opcodes relate to the plan.
These examples come from the AMP 16-bit registry. They describe the record types used to connect phases, files, evidence, and differences from the plan.
PCVS_ARTIFACT_ANCHOR
Associate a file fingerprint with a phase.
PCVS_INTENT_DELTA
Record the expected and actual result when work differs from the plan.
PCVS_PHASE_VERIFY
Compare supplied files with their recorded fingerprints during a phase check.
CCG_EVIDENCE_QUERY
Identify a request for a compliance evidence item.
Operation availability and enforcement depend on the deployed handler and configuration. Code numbers alone are not evidence that an action ran.
The tools, in the same working day
See how the work connects.
Start with the whole story. Then take a closer look at the tool your team needs first.
Read the compliance & audit trail walkthrough
- The workflow records scope, expected files, and required checks before the work begins.
- VIRP separates signed observations from proposed changes. Verification checks record integrity within the configured trust model.
- AMP operation codes identify artifact anchors, differences from the plan, and phase checks.
- The action ledger connects captured tool requests and results to task references. Missing results and capture gaps remain visible.
- The native Operator Hub view uses sample compliance data to show control evidence and outstanding work.
Protocol diagrams and compliance records are illustrative. Deployment and capture coverage must be checked separately. The demo does not establish complete capture, an assessment, or certification.
Bring the evidence back to the control.
Operator Hub shows control details, supporting evidence, recorded status, and outstanding work. A gap can retain its owner and next step while the team collects evidence or completes remediation.
Review the chain and the gaps.
Check signatures and fingerprints against the trusted verification material. Then review unmatched requests, missing results, pending records, and the point where capture began. Keep an independently retained checkpoint when completeness matters.
Keep the assessment scope clear.
Evidence collected from connected systems supports readiness work. Your policies, implementation, framework, and assessment scope still determine what an assessor needs. This page does not establish certification or complete capture of every action.
A closer look
Book a demoBring a workflow you need to account for.
Bring one task you'd like to take off your list. We'll walk through the relevant product.