What is an Evidence Bundle?
An Evidence Bundle is a self-contained, tamper-evident package containing all artifacts needed to prove a governed run occurred exactly as claimed—verifiable completely offline.
Bundle Contents
- ■manifest.json: Index of all bundle contents with checksums
- ■policy.json: The Policy Artifact that governed the run
- ■receipts/: Hash-linked chain of signed receipts
- ■chain_head.json: Pointer to the latest receipt in chain
- ■subject_manifest.json: Details of governed subjects
Verification Guarantees
✓Policy signature validity
✓Receipt chain integrity
✓Hash consistency across files
✓Enforcement action correctness
✓Time ordering (with TSA)
✓Deterministic report hash
Why It Matters
Evidence Bundles provide tamper-evident proof of AI system behavior for audit workflows and accountability. Unlike server-side logs that can be tampered with, bundles are cryptographically sealed and can be verified by any party with the offline verifier tool.
Verification Verdicts
PASS:All checks passed, bundle is valid
PASS_WITH_CAVEATS:Valid but with noted limitations (e.g., no TSA)
FAIL:Tampering detected or verification failed