AI Governance Proof (AIGP)
Validation Evidence & Cryptographic Proof

Abstract#

This document presents the validation evidence for the AI Governance Proof (AIGP), an open spec for cryptographically provable governance of AI agent systems. To validate the AIGP thesis in a real-world agentic AI context, we built AgentGP — a production-grade AI governance platform that implements the spec end-to-end. We demonstrate that AIGP achieves 97.4% governance accountability across 38 traces and 267 events spanning15 regulated and internal governance tenants covering trading, banking, risk management, compliance, and AI governance.

The validation program tests 5 formal claims through deterministic event simulation, cryptographic verification, and multi-tenant isolation checks. All results are reproducible from a single seed value and all verification scripts are open-source.

Claims Under Test#

The AIGP validation program tests 5 specific, falsifiable claims. Each claim has a defined measurement methodology and pass/fail criteria. We present the claims with full transparency about what “100%” means and what it does not.

Methodology#

The validation program operates in 4 phases, all driven by deterministic seed values for reproducibility:

Industry Coverage#

The validation program uses 15 tenants representing distinct regulated industries. Each tenant has its own agents, policies, prompts, tools, and organizational hierarchy AI-generated to ensure realistic, domain-appropriate configurations.

Per-Tenant Cryptographic Results#

Every tenant achieves zero verification failures across SHA-256 hash chains, Merkle roots, and JWS ES256 signatures. The table below is generated from the validation artifacts:

Parent Hash Chain Verification#

Every AIGP event contains a parent_hash field: the SHA-256 digest of the canonicalized previous event in the trace. This creates a tamper-evident linked chain — modifying any event invalidates all subsequent hashes.

Canonicalization Rules

Before hashing, the event is canonicalized:

• Keys sorted alphabetically (deterministic ordering)
• Compact JSON (no whitespace)
• Falsy values omitted (null, empty string, 0, false)
• Three fields excluded: event_signature, signature_key_id, parent_hash

# Verification pseudocode
for i in range(1, len(events)):
    canonical = canonicalize(events[i-1])  # sort keys, compact JSON, exclude 3 fields
    expected_hash = sha256(canonical).hexdigest()
    assert events[i].parent_hash == expected_hash  # must match exactly

Merkle Root Verification#

The AIGP Merkle root provides a single cryptographic commitment covering all governed resources in a trace. The root is computed from the resource leaf hashes (policy, prompt, tool, and any additional governed resources):

# Merkle root verification (v0.12 — binary tree from governance_merkle_tree)
for trace in governed_traces:
    proof_event = trace.events[-1]  # GOVERNANCE_PROOF event
    tree = json.loads(proof_event.governance_merkle_tree)
    leaf_hashes = [r["hash"] for r in tree["resources"]]

    # Recompute binary Merkle tree (pairwise SHA-256)
    level = leaf_hashes[:]
    while len(level) > 1:
        next_level = []
        for i in range(0, len(level), 2):
            left, right = level[i], level[i+1] if i+1 < len(level) else level[i]
            next_level.append(sha256(f"{left}:{right}").hexdigest())
        level = next_level

    assert proof_event.aigp_hash == level[0]  # root must match
    # Result: 37/37 = 100.0% match

JWS ES256 Signature Verification#

Governance-critical events carry a JWS ES256 signature covering the canonicalized event body — any modification to the event content invalidates the signature.

Trace Anatomy — Verified Example#

Below is a complete 7-event governed trace from the validation run, showing the full lifecycle from policy creation to governance proof:

Merkle verification for this trace:

aigp_hash       = d64b97206ada92a3...
leaf_count      = 5
resource_types  = [policy, prompt, context, context, context]

Formula: binary_merkle_tree(resource_hashes)
Result:  MATCH — recomputed root equals stored aigp_hash

Zero Governance Blind Spots#

The central claim of AIGP is that every agent run is governance-accounted. This does not mean every run is approved — it means every run produces either a full governance proof (GOVERNED) or an explicit denial with audit trail (DENIED). There are no silent bypasses.

Deny Rate Analysis#

The 2.63% deny rate is by design — the validation program intentionally includes adversarial scenarios (policy violations, data residency breaches, unregistered agent attempts) alongside normal workflows. A high deny rate under adversarial conditions is a feature: it proves the enforcement layer is working.

In a production deployment, the deny rate would depend on the organization's policy configuration, agent behavior, and input distribution. A deny rate of 0-5% would be typical for well-configured production systems, with the enforcement layer catching only genuine violations.

Scenario Distribution#

The event driver generates traces across three scenario categories — normal governance workflows, adversarial violations, and infrastructure failure modes. Per-scenario trace counts are not yet aggregated by the validation harness.

Known Limitations#

Reproducibility#

Every result in this white paper can be independently reproduced. The validation scripts, seed data, and event driver are all open-source.

Step 1: Generate tenant dictionary

python scripts/db/generate_tenant_seed.py \
  --seed 42 \
  --output scripts/db/data/tenant_dictionary.json

Step 2: Load seed data into the database

python scripts/db/generate_seed_sql.py --tenants --load

Step 3: Run event simulation

# --traces 50 = max traces per tenant; actual count varies by scenario distribution
# with 15 tenants, produces 38 traces / 267 events
python .build-event-driver/agentgp_event_driver.py \
  --all-tenants \
  --dictionary scripts/db/data/tenant_dictionary.json \
  --seed 42 \
  --traces 50 \
  --include-adversarial \
  --metrics \
  --sink dry-run

Step 4: Verify cryptographic integrity

python scripts/validation/verify_crypto.py \
  --from-driver \
  --traces 50 \
  --seed 42 \
  --include-adversarial \
  --output scripts/db/data/crypto_appendix.json

Step 5: Run full validation harness

python scripts/validation/run_validation.py --traces 50 --seed 42
# Produces: validation_metrics.json, crypto_appendix.json

Path to Standards-Grade Evidence#

The current validation program proves the AIGP spec's cryptographic design through deterministic simulation. The following phases are planned to elevate this evidence to standards-grade (e.g., SOC 2, ISO 42001, or regulatory submission quality):