Where you see KYE™ enforcing — six rows per action, live.

The console you'd run in production — refreshing every 2 seconds.

Six rows per action, mapped 1:1 to the PDP decision contract. The stream below cycles through a representative sample of AI-agent actions (procurement wire, clinical recommendation, refund issuance, contract amendment, delegation transfer) so you can watch the state transitions in your own time. In production the rows update on every real action, signed against your tenant's JWKS.

CFO · GC · CISO · DPO — same six rows, role-tuned filters.

• CFO. Default filter: action_class = financial · amount > 0. Pin on the FP&A team's wall. Refused-wires-prevented becomes a measurable KPI for Treasury risk.
• General Counsel. Default filter: action_class = contractual · scope = exceeded OR delegation = invalid. Every refusal is a pre-litigation exhibit; the Console shows the queue of exhibits accruing in real time.
• CISO. Default filter: policy = blocked · delegation = invalid. Structural failures surface first; lateral-movement attempts read as scope exceeded.
• DPO. Default filter: decision = approval_required · action_class = data_processing. GDPR Art 22 human-in-the-loop becomes a board-reportable count.
• Compliance / internal audit. Default filter: evidence = signed. Every refused or approved action with a verifiable envelope; click any row to download the pack.

When the agent calls a non-deterministic tool, the Evidence Pack™ still replays bit-identical offline.

Decision replay (does the same policy verdict come out of the same inputs?) has shipped since v1.0. KYE Trace Replay™ is the v1.1 contract that closes the harder gap: re-running the agent's reasoning trace itself — model + seed + tool versions + content hashes — so the trajectory that produced the decision is independently reconstructible months later, on a different box, from public keys alone.

• Model pin · kye.evidence.model_params.v1. Provider · model_id · model_version · seed · sampling parameters (temperature, top-p, top-k, max-tokens, stop sequences, response format) · input/output content hashes. Captured at the moment of the call. The schema is structural; algorithm internals stay in the proprietary track.
• Tool pin · kye.evidence.tool_call_pin.v1. Per-tool: tool_id · tool_version · endpoint · MCP server id · input/output hash · deterministic boolean · side_effects[] enum (none · external-mutation · billable · irreversible · rate-limited · personal-data-egress · cross-border). One pin per tool call, not one per session.
• Replay claim · kye.evidence.trace_replay_spec.v1. Either trace-replayable (every tool pin deterministic = true + model_params present + corpus snapshot bound) or decision-replayable-only with a typed reason (tool-nondeterministic · model-seed-unavailable · external-state-mutation). The Console shows the claim per action; counsel can filter to trace-replayable for litigation-ready exhibits.
• Wire shape (no algorithm). The fixture at public/examples/evidence/ is structural. The verifier recipe — how a third party reconstructs the trace from pins alone — is part of the v1.1 Evidence Pack™ conformance program; algorithm internals are not disclosed in the public spec.

v1.1 · KYE Model Capability Binding™ + KYE Model Influence Envelope™ · model layer bound to every decision.

v1.0 + v1.1 captured the per-call pins — model_params, tool_call_pin, trace_replay_spec, federated delegation. The remaining gap is the upstream layer: what is this model permitted to do, and what steered it at the moment of the call? KYE™ closes that gap with two structural schemas that bracket the call from above and from the side, so a verifier auditing an Evidence Pack™ can answer not just "did the policy verdict come out right?" but "was this model even permitted to be the one taking this action, and which prompt + corpus + tools steered it there?" — without re-running the agent. Authority Finality™ extends down into the model layer.

• Capability binding · kye.model.capability_profile.v1. Declared capabilities (12 classes: code-generation, tool-use, web-retrieval, image-understanding, voice-synthesis, document-extraction, summarisation, translation, function-calling, reasoning-chain-of-thought, agentic-orchestration, pii-handling) · prohibited tasks (7 classes including autonomous-financial-execution, clinical-diagnosis-final, weapons-targeting, personal-data-egress-cross-border, unsupervised-irreversible-action) · risk class (EU AI Act levels: prohibited / high / limited / minimal / unspecified) with framework-control pointers · training provenance (base-model lineage pin + fine-tune dataset pins + optional RLHF dataset pin) · permitted tool families aligned with the per-tool side-effect taxonomy. Attested by a named principal, signed, time-bounded.
• Influence envelope · kye.model.influence_envelope.v1. Per decision: system prompt pin + system_prompt_version label · RAG corpus snapshot pin + the specific retrieved-doc pins that landed in the prompt context · tool manifest pin (the menu the model saw, distinct from which tools it actually called) · fine-tune adapter pin (when one is loaded) · ambient session context pin. The envelope wraps the call from above; the per-call model_params pins what came out from inside.
• Drift detection vs the prior envelope. Each envelope carries a typed comparison against the previous one on the same model: previous_envelope_hash · drift_detected boolean · drift_reasons[] closed enum (system-prompt-changed · rag-corpus-changed · tool-manifest-changed · adapter-changed · ambient-context-changed). A reviewer can ask "show me every decision where the system prompt changed silently between calls" — the answer is a query over public envelopes, not a forensics exercise.
• The 7th row on the Runtime Console™. Capability · inside_envelope / outside_envelope. Green when the action the agent took fell within the declared capability profile and the influence envelope was successfully captured and signed; red when the action crossed into a prohibited-task class, the model_id was outside the bound capability profile's effective window, or the influence envelope failed to bind. The row is read-only over the same signed envelopes; the Console doesn't decide — the PDP does, and the row reflects what it decided.
• IP-safety statement. Algorithm internals — capability inference, drift scoring, prompt-graph reconstruction, capability-vs-action admissibility evaluation — are proprietary and are not disclosed in the public spec. The public surface declares structure only: which fields are captured, which enum values exist, which framework controls the risk class maps against. The mechanism that makes the binding meaningful in front of a regulator stays private.