Show how a governed AI request was decided.
For supported traffic routed through Comply, reviewers can examine the policy context, decision, human action when required, and the resulting audit event. That helps regulated organizations show consistent control operation and accountable internal review without claiming that software alone proves compliance.
What governed this request, who approved it, and what came back?
Identify the caller and authority used.
Show the system, action, endpoint, and fields.
Explain allow, deny, hold, redact, or mask.
Include chain verification results.
Bounded context with request details, policy outcome, and the available active-chain result.
What policy context applied?
Versioned policy state and governance manifests can capture the configured policy, role, principle, integration, and classification context for a selected window.
The review material: a bounded Governance Manifest for the agreed scope and period.
What decision did Comply record?
For governed routes, Comply records request and response decisions, human approvals and denials, classification changes, and consequential policy events with available actor, action, target, request, outcome, policy version, and time context.
The review material: filtered audit event exports for the agreed scope and period.
Can the active chain be checked?
Comply cryptographically links audit events and can verify the active persisted chain. A changed historical entry can produce a chain break. The standard bounded export is useful review evidence, but it is not by itself a portable proof of the entire chain without a trusted checkpoint or anchor.
The review material: the bounded export, its hashes and payload digests, and an active-chain verification result.
How does this help a controls review?
Configured policy enforcement, role context, human decisions, and traceable events can support evidence collection and accountability within an organization's compliance program. The applicable framework, control design, evidence sufficiency, legal interpretation, and certification decision remain with the customer's qualified teams and reviewers.
Define the evidence you actually need
A 30-minute conversation can clarify the business issue and whether a direct product discussion or a separately scoped assessment is the right next step. A formal audit or certification review is a separate engagement.