Prove — triage findings & prove control

Prove is where security reviews the risk, decides what to do, and produces the audit trail that shows AI is under control — for boards, auditors, and customers.

Added value

Without Prove	With Prove
Scanner CSV dumps	Idempotent findings with triage that survives re-scans
“Trust us, we scan”	Hash-chained evidence you can verify
Checkbox compliance	11 frameworks with evidence + human attestation
Equal-weight alerts	Blast-radius scoring so high-exposure issues float first

Findings triage

Upload scans (unveilr scan --upload) and Code Findings (/findings) lists every issue — severity, location, scanner, status, mode, risk score, blast radius. For each finding you can:

• Triage — acknowledge and keep it open for work,
• Ignore — accept the risk (records who and why; survives re-scans),
• Reopen — bring back a resolved or ignored finding,
• Open a ticket — Jira / ServiceNow from the finding or Remediation hub.

Re-scanning is idempotent: fixed issues auto-resolve; returning ones reopen; manual decisions are preserved.

Screenshot to capture — Findings triage

Console path: /findings
Capture: filters + a triaged/ignored finding with reason visible.
Story it tells: “Risk acceptance is intentional and recorded.”

Statuses at a glance

Status	Meaning
open	New or reopened; needs attention
triaged	Acknowledged, being worked
resolved	Fixed (auto, when a scan no longer sees it)
ignored	Risk accepted by a person (with a reason)

Evidence — tamper-evident by design

Every scan, decision, gateway decision, and status change can feed a hash-chained evidence ledger, per tenant. Each event links to the previous one; changing any event breaks the chain.

From Evidence (/evidence) or the API:

• Verify — recomputes the chain and reports the exact first break,
• Export — streams the full audit trail (NDJSON).

curl -H "authorization: Bearer $TOKEN" https://your-instance/v1/evidence/verify
curl -H "authorization: Bearer $TOKEN" https://your-instance/v1/evidence/export -o evidence.ndjson

Screenshot to capture — Evidence

Console path: /evidence
Capture: successful verify result + export control.
Story it tells: “The audit trail is tamper-evident, not editable folklore.”

Prioritized risk — blast radius

Unveilr amplifies each finding's priority by the real exposure of the repo: a secret in a repo that also deploys a public bucket with a bedrock:*/iam:* role is reachable and high-blast-radius; the same secret in an internal-only repo is not.

Each finding gets a risk score (0–100) and a blast radius (low / medium / high). Filter with blastRadius=high in the console or API.

note

Today, exposure is derived deterministically from the IaC/AI-IAM in your repos (offline, reproducible). Live cloud-account reachability is the online extension.

Compliance packs

Auditor-ready coverage against 11 AI-governance and security frameworks, generated from your own data:

NIST AI RMF · EU AI Act · SOC 2 · OWASP Agentic SAMM · ISO/IEC 42001 · NIST SSDF (800-218 + 218A) · DORA · NIS2 · HIPAA · PCI DSS · ISO/IEC 27001.

curl -H "authorization: Bearer $TOKEN" https://your-instance/v1/compliance
curl -H "authorization: Bearer $TOKEN" https://your-instance/v1/compliance/eu-ai-act

Evidence is automated; attestation is human

Automated signals establish evidence coverage only — Unveilr never marks a control satisfied on its own. Each control reports:

• an evidence statement — e.g. "AI-BOM: 35 assets across 3 repos", "tamper-evident evidence chain: 240 events", "12 agents registered with named owners" — hashed at generation time; and
• an attestation status — a named human with an admin / auditor / compliance / security role signs off against that evidence.

curl -H "authorization: Bearer $TOKEN" -X POST \
  https://your-instance/v1/compliance/eu-ai-act/controls/Art.%2012/attestations \
  -d '{"status":"confirmed","statement":"Reviewed the evidence ledger for Q3.","evidenceRefs":["…"]}'

Attestations are append-only and bound to the evidence hash at signing time — if underlying evidence later changes, the attestation is flagged stale. A framework reports both evidence coverage % and attested %.

Screenshot to capture — Compliance + attestation

Console path: /compliance (list) and a control detail with attest UI
Capture: coverage % vs attested %; attestation form with evidence statement.
Story it tells: “Auditors get evidence + named human sign-off — not auto-green.”

Why this matters

In an audit or board review, "we scan for AI risk" isn't enough — you need to show that risk was found, governed, and either fixed or knowingly accepted, without the record being editable after the fact. That's what Prove delivers.