BlindOracle · AI Agent Governance
BLINDORACLEAUDIT · VERIFY · ATTESTAgent AAgent BProof

The AI Agent Audit Evidence Kit

Your teams are deploying AI agents. When an auditor, a customer questionnaire, or the EU AI Act asks "what are these agents actually doing — and who authorized it?", this kit is how you answer with evidence instead of a spreadsheet. It pairs with our methodology whitepaper and the broader question we keep returning to: who audits the agents?

Get the kit (free)

Methodology whitepaper · a 5-framework control crosswalk · a sample evidence pack. No spam — this is a demand check; we'd genuinely like to know who finds it useful.

Prefer email? Write [email protected].

✅ Here it is. Everything below is self-contained — save this page and it reads offline. For the full argument, read the verifiable-audit methodology whitepaper and the companion audit methodology overview.

1 · What's inside

  • The methodology — how to produce an agent audit that survives a hostile reviewer: completeness, integrity, and independence. The full treatment lives in the methodology whitepaper, with the proof-chain mechanics in auditable AI proof chains.
  • The 5-framework crosswalk — every OWASP ASI category mapped to NIST AI RMF, ISO/IEC 42001, CSA AICM, and MAESTRO (§3). We published a fully worked MASSAT → MiCA crosswalk so you can see the method end to end.
  • A sample evidence pack — per-framework coverage %, a gap matrix, a remediation roadmap, and an independently-verifiable integrity proof (§4). The same shape we ship when we answer who audits the agents.

2 · The three properties that make an agent audit defensible

Completeness — "did you look at everything?"

The agent inventory and finding count are committed together (a Merkle root with the count bound in). A reviewer can confirm no finding was dropped after the fact — the basis for the auditable proof chains we use.

Integrity — "was this report altered after issuance?"

Findings are content-hashed and the report is signed. Change one character and the hash no longer matches — the same signing discipline behind agent trust via Nostr proofs and verifiable agent delegation.

Independence — "do I have to trust you?"

No. The evidence pack ships with a key-free verifier: your auditor re-computes the hashes and confirms the signature without any BlindOracle secret or API. This is the design goal we describe in agents without surveillance — verify the math, not the vendor. New to the model? Start with how it works.

Optional and off by default: the integrity root can be anchored to independent public witnesses for a notarized timestamp. Most compliance teams don't need it — the signed, hashed, key-free-verifiable pack already satisfies chain-of-custody. The broader trust stack is covered in the trust gap in the agent economy.

3 · MASSAT → 5-framework control crosswalk

Each OWASP ASI Top-10 (2026) finding maps to controls across four other frameworks. This is the actual mapping our compliance engine applies — drop it straight into an ISO 42001 Annex or NIST AI RMF evidence file. For a real example, see the worked crosswalk; for how the control checks are wired in code, the compliance-hook codewalk walks it line by line.

OWASP ASIRiskNIST AI RMFISO 42001 clauseCSA AICM domainMAESTRO
ASI01Agent Goal HijackingGOVERN, MAP, MEASURE6 Planning / 9 PerformanceRisk Mgmt / System IntegrityPrompt Injection
ASI02Tool MisuseMAP, MEASURE8 OperationOperations SecurityTool Abuse
ASI03Identity & Privilege AbuseGOVERN, MANAGE7 SupportAccess / Identity MgmtIdentity & Access
ASI04Supply ChainMAP7 SupportSupply ChainSupply Chain
ASI05Code ExecutionMEASURE, MANAGE8 OperationOperations SecurityTool Abuse
ASI06Memory PoisoningMEASURE, MANAGE8 OperationData ProtectionData Poisoning
ASI07Inter-Agent CommsMEASURE, MANAGE8 OperationCommunication SecurityCommunication
ASI08Cascading FailuresMAP, MANAGE4 ContextIncident ResponseCascading
ASI09Trust ExploitationGOVERN5 LeadershipAI GovernanceTrust
ASI10Rogue AgentsGOVERN5 LeadershipAI Governance / System IntegrityRogue Behavior

Coverage rule: a category is "covered" when residual risk is below medium (< 4.0 / 10). Frameworks: OWASP Agentic Top-10 (2026), NIST AI RMF 1.0, ISO/IEC 42001, CSA AI Controls Matrix (243 controls / 18 domains), MAESTRO. Regulatory context for why this matters now: the legal agent stack and the Wyoming wrapper architecture.

4 · Sample evidence pack ILLUSTRATIVE — your fleet's numbers will differ

What a finished audit returns. Percentages below are a representative example, not a specific customer.

7/10
OWASP ASI — partial
60%
NIST AI RMF — partial
53%
ISO 42001 — partial
39%
CSA AICM — low

Gap matrix (excerpt)

ControlCurrent stateSeverityRemediation
ASI04 — Supply ChainNo SBOM, partially pinned depshighSBOM + dependency pinning + vuln scanning (~24h)
ASI06 — Memory PoisoningNo provenance tracking on memory writesmediumProvenance + write-isolation (~40h)
ASI03 — Identity AbuseDelegation not cryptographically attributedhighSigned delegation chain — see verifiable agent delegation

Remediation roadmap — most-gaps-closed-per-hour, ranked

#ActionFrameworks improvedEffort
1Supply-chain controls (SBOM, pinning, scanning)OWASP +10% · NIST +5% · ISO +7%~24h
2Memory provenance + isolation — see CaMeL content-trap securityOWASP +10% · NIST +5%~40h
3Signed delegation attributionOWASP +10% · ISO +7%~16h

The integrity proof — verified independently, no vendor trust

Every engagement in BlindOracle's own production fleet is signed and the delegation chain recorded. As a live proof of the method on real data (2026-05-30):
30
real engagements, each signed
60
record delegation chain (who→whom)
4/4
key-free verifier checks PASS

The verifier confirms hashes and signatures with no BlindOracle key or API. That's the difference between "trust our PDF" and "verify it yourself." We run this on our own fleet and publish the result — the self-audit is the credential. Background: the agent security crisis and trusting an agent you've never met.

5 · Where this fits

An audit is one piece of a working agent economy. Adjacent reading: when agents pay agents (settlement + the trust envelope) and the how-to on BlindOracle (onboard, get audited, transact). Pricing for a managed audit is on the pricing page.

Want this run on one of your agents — free?

No cost, no commitment. We'll inventory one agent, map findings to your framework, and hand back a verifiable evidence pack. 20 minutes to scope it.

Book a free audit →