Skip to content
borderv0.1.0

Use case

What a stamp is, and what it is not

This page has almost no code in it. It is about the artifact the library produces and what somebody who does not write Python can do with it.

checks runverdict redact9f2b4c81crossingtext out

The situation

A risk function has been asked to show that the AI assistant checks what it sends and receives. The engineering team says it does. The evidence is a dashboard that shows how many requests were blocked last month.

That is a count, not evidence. It cannot show that a specific answer to a specific customer was checked, which control was applied, or which version of which model made the decision.

What breaks without a check

Counts survive right up until somebody asks about one interaction. At that point you need a record that ties this text to these checks to that model revision, and a number in a dashboard cannot be narrowed to a single crossing after the fact.

Which detectors apply

The policy is data, not code. A reviewer who does not write Python should be able to read this and say whether it is right.

border-code.yaml
# Signing is optional and the library never holds your key.# sign_record takes one you own.policy_id: defaultversion: 1fail_mode: open

The same case in code

The one snippet this page needs: how a stamp becomes something a third party can verify. Signing is optional, the key is yours, and the library never stores it.

sign_and_archive.py
from flowx_border import scan_output, sign_record out = scan_output(answer, policy) # Ed25519 over the canonical JSON. The record is frozen, so what# was signed is what gets archived, byte for byte.record = sign_record(out.evidence, key=your_signing_key)archive(record) # Reproducible elsewhere: the same text hashes to the same# input_hash on any machine, with no key and no library needed.

What the stamp holds

A UUIDv7 record id, an RFC 3339 timestamp, the direction, the policy id and a hash of the resolved policy document, the library version, one attestation per detector naming its model and weight hash, a hash of the input text, the verdict, and a summary of each finding as detector, label, score and action. Optionally an Ed25519 signature over the canonical JSON of all of it.

Read by a risk officer, an internal auditor, or a supervisor.

What this does not catch

  • It never contains the text. That is the point and it is also the limitation: you cannot reconstruct what was said from a stamp, only prove that a given text was the one checked.
  • It proves a control ran. It does not prove the control was correct, and it makes nobody compliant with any regulation.
  • The policy hash covers the resolved document. If two deployments resolve different defaults, they produce different hashes, which is intended and occasionally surprising.
  • A signature is only as good as the key handling around it. The library never stores your key and cannot help you if it leaks.

The full detector set, or the per-language numbers.