VerdifaX

Sample audit response

When a regulator, auditor, or counterparty asks "show me how this AI decision was made," the response template below is what you send. Adapt to the specific framework and tone, but the structural elements are the same.

The scenario

A health-insurance plan uses an AI system to assist with prior-authorization decisions. A patient files a complaint after a denial. The state insurance regulator opens a data request: produce evidence of how the AI evaluated the case.

What to include in the response

1. Cover letter (1 page)

Identify the system, the decision, the date, the patient (or de-identified surrogate), and the regulator's reference number. Conclude with: "Cryptographic evidence of this decision is provided as Exhibit A. The decision is independently verifiable using the procedure in Section 3."

2. Exhibit A, Verdifax audit report

Fetch the PDF for the run:

curl -s https://your-orchestrator/runs/{id}/report.pdf \
  -H "X-Verdifax-Key: vfx_..." \
  -o exhibit-A-verdifax-audit.pdf

The PDF contains:

  • The Verdifax wordmark and run number
  • Date and duration of the decision
  • The full sealed ManifestHash
  • Run metadata (program id, route id, payload hash, status)
  • All 18 sealed manifest fields
  • The six DKEC kernel execution IDs
  • Regulatory-mapping section (EU AI Act / HIPAA / SOX, as relevant)
  • Verification statement
  • QR code linking to the run detail view

3. Section 3, Independent verification procedure (outcome-aware)

This is the part that makes the evidence chain credible. Describe the procedure based on the run's outcome:

For OK runs (AllowToken):

The cryptographic seal in Exhibit A may be independently verified by any party in possession of the original input. Verification does not require access to our systems, our databases, or our staff.

Procedure for OK outcome:

  1. Install the Verdifax SDK: pip install verdifax
  2. Reconstruct the canonical input as documented in [the original program registration].
  3. Run: 
    import verdifax
ok = verdifax.verify(
    manifest_hash="<hash from Exhibit A>",
    payload="<reconstructed canonical input>",
    program_id="<from Exhibit A>",
    route_id="<from Exhibit A>",
    registry_record_hash="<from Exhibit A>",
)
assert ok is True
  4. If ok is True, the recorded decision is consistent with the inputs and the registered program. Tampering would invalidate the seal.

For PEPG Deny runs (DenyReceipt):

The sealed denial in Exhibit A proves that the request was rejected at the pre-execution policy gate before any AI model was invoked and before any charges were incurred.

Procedure for PEPG deny outcome:

  1. Fetch the sealed DenyReceipt: 
    curl -H "X-Verdifax-Key: $VERDIFAX_KEY" \
  https://api.verdifax.com/runs/{id}/deny-receipt | jq .deny_receipt > deny.json
  2. Verify the receipt seal (MIT-licensed CLI): 
    cat deny.json | verdifax-pepg-verify
  3. A green checkmark confirms the receipt hash is authentic. The fired_rule_id and decision_reason_code are sealed and cannot be altered.

For CCV Halt runs (CCVHaltReceipt):

The sealed halt receipt in Exhibit A proves that the request was admitted under policy, execution began, but the per-run budget was breached mid-flight. The system halted execution and sealed the partial state.

Procedure for CCV halt outcome:

  1. Fetch the sealed CCVHaltReceipt: 
    curl -H "X-Verdifax-Key: $VERDIFAX_KEY" \
  https://api.verdifax.com/runs/{id}/ccv-halt-receipt | jq .ccv_halt_receipt > ccv_halt.json
  2. Verify the receipt seal: 
    cat ccv_halt.json | verdifax-pepg-verify
  3. The consumed_at_halt field shows the budget consumed before the halt. The partial_execution_hash is the sealed state of work completed.

For MACC Halt runs (MACCHaltReceipt):

The sealed halt receipt in Exhibit A proves that the tenant's cumulative budget was at or beyond the configured limit at execution time. No execution occurred.

Procedure for MACC halt outcome:

  1. Fetch the sealed MACCHaltReceipt: 
    curl -H "X-Verdifax-Key: $VERDIFAX_KEY" \
  https://api.verdifax.com/runs/{id}/macc-halt-receipt | jq .macc_halt_receipt > macc_halt.json
  2. Verify the receipt seal: 
    cat macc_halt.json | verdifax-pepg-verify
  3. The cumulative_at_halt field shows total consumption across all runs in the window. The window_start and budget_limit are sealed, proving the enforcement configuration at halt time.

4. Honest scope statement

Include this paragraph verbatim:

The cryptographic seal proves that the recorded run occurred as described and is byte-for-byte reproducible from the same inputs. It does not certify that the AI system's recommendation was clinically or substantively correct, that determination remains a question of professional judgment and is addressed in [other governance documentation, attached as Exhibit B].

This honesty is the credibility move. Regulators see overstated cryptographic claims constantly; precise scoping reads as serious work.

5. Optional, third-party attestation

If you have an external auditor that has independently verified the same hash, include their letter. This converts your evidence chain from "we say so" to "we say so, and an independent firm with reputational stake confirms."

The pattern, abstracted

Every audit response, regardless of regulatory framework, follows the same shape:

  1. Identify the specific decision under review
  2. Provide the Verdifax PDF as primary evidence
  3. Document the independent-verification procedure
  4. Scope what the cryptographic claim covers and does not cover
  5. Optional third-party verification letter

Continue