Skip to content

Compliance Reports

3. Compliance Reports

The Compliance Reports module (/dashboard/prove/compliance) is the enterprise regulatory reporting surface of Theseus Guard. It synthesizes real-time enforcement logs, human oversight records, Zero-Data masking audits, and cryptographic ledger proofs into audit-ready compliance packages aligned with global AI standards.

3.1 Architecture & Integrity Principles

Every compliance report generated by Theseus Guard operates under rigorous assurance and evidence principles:

  • Evidence-Backed, Never Fabricated: Reports are constructed exclusively from measured runtime telemetry. If an evidence window has zero events or unconfigured metrics, the platform reports not_yet_measured or no_data rather than generating synthetic baseline percentages.
  • Content-Free Privacy: In alignment with the Zero-Data AI Data Plane (ZT-ADP), compliance reports expose aggregated metrics, control statuses, and cryptographic hash proofs—never raw customer prompts or sensitive payloads.
  • Tamper-Evident Lineage: Each generated report references immutable ledger events anchored by HMAC chains, providing external auditors with mathematical chain-of-custody verification.
  • Run Comparison: Supports side-by-side delta analysis between any two reporting periods to track governance improvements, drift reductions, and SLA trends over time.

3.2 Supported Compliance Report Catalog

Theseus Guard provides 10 pre-built regulatory and operational report templates covering major enterprise AI governance frameworks:

Report ID Title Core Frameworks Description & Primary Telemetry Frequency
ghi_posture Monthly AI Governance Posture EU AI Act Art. 14, Data Residency Monthly executive summary aggregating Governance Health Index (GHI) trends, active Guard kernel coverage, human oversight ratios, and cross-border data residency audits. Monthly
sla_audit Runtime Reviews SLA Audit SOC 2 Type II (CC7 Criteria) Detailed Mean Time to Respond (MTTR) analytics for the human review queue, pending review backlog tracking, safety overrides, and SOC 2 CC7 operational control mapping. Weekly
drift_anomaly Model Drift & Anomaly Report ISO/IEC 27001 (Annex A.12) Telemetry logs tracking behavioral drift velocity, Sentinel decision severity distribution, and ISO 27001 operational correction plans. On-Demand
visual_posture Executive Visual Posture Enterprise GRC & Board Oversight Consolidated executive dashboard visualizing guard enforcement rates, LLM drift trends, and operational reviews for leadership and GRC presentations. On-Demand
owasp_llm_top10 OWASP Top 10 for LLM Applications OWASP Top 10 (2026), EU AI Act, NIST AI RMF Executes live multi-category guarded chat probes across all deployed agent DNA profiles, combining real-time enforcement outcomes with agent-scoped historical telemetry. On-Demand
pii_gdpr PII & GDPR Data-Protection Report GDPR (Art. 9 & Art. 32), Data Privacy Audits ZT-ADP Format-Preserving Encryption coverage across 100+ entity types, special-category data handling, residency compliance, and audited operator disclosure logs. Monthly
ast10_skills AST10 Skill Security Evidence Report OWASP Agentic Skills Top 10 (AST10) Evidence projection across AST01–AST10 agentic skill security controls from tenant-scoped artifact registry scalars, evaluating tool/skill execution boundaries. On-Demand
provenance_integrity Provenance / Audit-Trail Integrity SOC 2 Type II, Cryptographic Audit Content-free mathematical verification of the tenant HMAC ledger, reporting total checked entries, chain continuity anchors, date coverage, and zero-tamper attestations. On-Demand
incident_enforcement Incident / Enforcement Summary Incident Response / SecOps Operational audit evidence detailing blocked threats, held reviews, rewritten outputs, alert resolution lifecycles, measured MTTR, and active policy overrides. On-Demand
regulatory_alignment Regulatory Alignment Report ISO/IEC 42001:2023, NIST AI RMF 1.0 Parameterized framework evidence mapping against specific AI standards. Generates detailed control-by-control evidence without unsupported certification claims. On-Demand

3.3 Deep Dive: Regulatory Alignment Frameworks

The parameterized Regulatory Alignment report (regulatory_alignment) allows compliance teams to generate focused evidence packages for specific standards:

ISO/IEC 42001:2023 (Artificial Intelligence Management System - AIMS)

  • Maps tenant governance controls to ISO 42001 clauses covering organizational roles, risk assessments, continuous monitoring, and impact documentation.
  • Controls evaluate policies from Policy Studio, Agent DNA registrations, and active Guard kernels.
  • Each requirement reports an honest state: measured, partial, no_data, or not_applicable.

NIST AI Risk Management Framework (NIST AI RMF 1.0)

  • Structures evidence across the four core NIST AI RMF functions: GOVERN, MAP, MEASURE, and MANAGE.
  • Surfaces runtime enforcement statistics, model behavioral boundary tests, and human-in-the-loop audit histories mapped to NIST subcategories.

3.4 Report Lifecycle & Generation Workflow

  1. Generation Request: Operators initiate a report run via the dashboard (Generate Report) or via API (POST /compliance/reports/{report_type}/generate).
  2. Asynchronous Processing: Long-running evaluations (such as OWASP live agent probing or full-chain provenance verifications) are queued and executed by worker services to ensure zero impact on runtime inference.
  3. Idempotency & Resilience: Automated generation requests utilize unique idempotency keys. If an evaluation encounters a transient infrastructure issue, operators can resume the existing run without losing completed agent progress.
  4. Inspection & Compare: Completed runs appear in the report history table. Operators can inspect individual findings, view framework control breakdowns, or select two runs for side-by-side metric comparison.
  5. Auditor Export: Structured, timestamped JSON and audit packages can be exported for direct submission to external compliance auditors, GRC platforms, or SIEM connectors.