Proof requires two artifacts and a comparison between them. The signed approval states which controls the system must enforce. The deployed code states which controls the system does enforce. Comparing the two names every row where they disagree.
Akka Verify reconstructs an Eval Matrix from the deployed code and compares it against the signed matrix. The comparison runs at the deploy gate and on demand against a system already in production.
The Eval Matrix is the signed list of every safeguard a system must implement and demonstrate. Each row carries its citation, the runtime binding that enforces it, and the evidence event that proves the binding ran.
Approval is granted against that list at a point in time. The code then changes. Someone edits a prompt, adds a tool, relaxes a guardrail to clear an incident, or swaps a model. Each change moves the deployed system away from the list that carries the signature.
Confirming the match by attestation depends on someone describing the deployed system from memory. Reconstructing the matrix from the deployed code removes that dependency, because the comparison reads what the code enforces.
A build-and-deploy gate runs the control evaluations at build time and fails the deploy when the matrix is unmet. The gate produces a versioned, hash-chained report, so the release that shipped carries the conformance result that permitted it.
After deployment a review starts from a declared change in the AI events taxonomy, a regulation update from the monthly corpus watch, a scheduled review, or drift the runtime detected. The scope of the review follows the trigger. A prompt change is a half-day cycle. A foundation-model swap runs for weeks and is budgeted before it starts.
The signed matrix, the matrix reconstructed from the deployed code, and every row where the two differ. Each row carries its citation and the evidence events its binding emitted, and the report is versioned and hash-chained.
A log shows what the system did on the runs it recorded. Reconstruction reads the bindings compiled into the deployed code, which states what the system will do on a run that has not happened yet.
A build-time check fails the deploy. For a system already running, the missing row is reported as a finding against the control and the regulation it cites.
An orphan row is a control operating in production that no approval covers. The control constrains what the system does, and nobody reviewed the constraint or the behaviour it produces.
The reconstruction reads runtime bindings the platform compiled from the matrix. A control enforced outside that runtime leaves no binding for the comparison to find.
