EVE CoreGuard
What is EVE CoreGuard?
EVE CoreGuard governs what an AI system is allowed to do, and proves what it did.
An agent proposes an action. CoreGuard evaluates it against deterministic policy packs and returns ALLOWED, BLOCKED, or MODIFIED before the protected executor is entered. The boundary is fail-closed: without an ALLOW bound by digest to that exact operation, the executor refuses to run.
No language model participates in the verdict. Policy packs are deterministic predicates over a request context, so identical input yields identical output and identical rule identifiers — the same decision, reproducible on demand for an examiner months later.
Every decision emits an evidence record: a content hash over the decision payload, a signature over that hash, the signing key id, and a position in a hash chain. Production signing is ECDSA P-384 with the private key resident in AWS KMS. A third party verifies a certificate offline using the published public key alone — no access to EVE, and no vendor attestation required.
CoreGuard governs what is declared by the user. CoreGuard enforces against an operator-declared registry of agents, tools, and systems; it does not scan or enumerate the user's estate.
Built for teams that have to answer for an AI decision after the fact: lending, insurance, healthcare, and government.
Categories & Use Cases
Media
1 / 4
Screenshot of Pre-execution enforcement: a blocked AI action. CoreGuard intercepts a proposed AI action, evaluates it against deterministic policy, and terminates execution before it runs. Shows the live gate round-trip, the CRD score, and the policy class that fired. No LLM anywhere in the decision path.
