Reference architecture · public spec

The Proofpane Architecture for AI Governance

Gate every AI action in the execution path. Chain every decision into tamper-evident evidence. Prove it to someone who doesn't trust you.
v1.0 · July 2026 CC BY 4.0 DOI 10.5281/zenodo.21402332 6 invariants · 7 planes · 3 conformance levels proofpane.com/architecture
Proofpane home Read the v1.0 spec Cite the DOI GitHub archive Download the 4:5 PNG Proof Index
Click any element to read what it is and why it exists.
01AI surfaces — what arrives

Subscription clients → protocol layer

Coding agentshooks · MCP
Chat assistantsMCP · usage

API-key clients → broker / egress

Agents & workflowsnative
Automation platformsgateway
Any app calling a modelbroker
▼ every action, one pipe ▼
02The governed execution pipeline
Identity & tenantwho · which org
→
Policy gateallow · deny · human
→
DLP redactionbefore the model
→
Budget gatecaps · refusals
→
Model / tool callany provider
→
Meteringone choke point
→
Evidence appendatomic
deny / refuse / pauserecorded as evidence — a denial is not an error
▼
03Human oversight — autonomy is earned
HITL checkpointsdesigned + runtime
Approve & rememberprecedent ratchet
Risk-tier triggerspause mid-run
Pause / killcontracts instantly
Acceptance criteriaper step · fallback
▼
04Quality & change plane
Eval gatesgolden sets
Calibrated judgesα vs human gold
Significance-gated changeno vibes
Version everything+ rollback
05Economic plane
Emit-time attributionorg · dept · user
Invoice reconciliation1 : 1
SOP → workflow → ROImeasured, not asserted
▼
06Evidence plane
Hash-chained logappend-only · org-scoped
Signed anchorschain head, periodically
Evidence packself-contained export
Gap disclosuresilence is forbidden
the verification wall

Outside the audited entity

Offline verifierstandalone · no callback
Auditor · board · regulatortrusts nobody — verifies
NIST AI RMFISO/IEC 42001EU AI ActGDPRSOC 2
▼ everything above stands on ▼
07The six invariants
IEvidence by enforcement
IIVerification without trust
IIICompliance by construction
IVSurface-calibrated observation
VEarned autonomy
VIHonest boundaries

Conformance

L1 · OBSERVED
you can see
L2 · GOVERNED
you can stop
L3 · PROVABLE
you can prove

Coverage classes

Gate + transform
Gate only
Observe
Blind — disclosed