What it's for
Turning "we test our agent" into something a reviewer can check: dated runs, pass counts, and named failures tied to specific controls.
When you use it
Once to wire up CI, then passively — runs arrive on a schedule. Visit when a run fails or before sending an evidence package.
What's on the screen
Setup card — three-step instructions, your org API key, and a ready-made curl command.
Runs list — most recent 20, each with timestamp, agent, source, pass count, and an all-passing / N failing badge. Failing tests expand inline with category and details; each has a Fix plan button on Scale.
A Ingest a sample run button loads a realistic 15-test run with three failures so you can see the whole mechanism without wiring anything.
How it works
Veriflow runs no tests itself. You POST JSON to /api/evidence/ingest with an x-veriflow-api-key header. Each result's category maps to controls — prompt_injection → SEC-01 and SEC-06, pii_leakage → DP-01, and so on across 14 recognised categories.
Runs route to an agent by the agent field, matched case-insensitively; unmatched runs land on your first agent.
The latest run drives evidence badges on Controls, the evidence component of your score, contested-control detection, and the evidence chips in questionnaire citations.
Gotchas
- The shipped workflow template contains a deliberate placeholder (
agent-security-harnessisn't a real package). Replace it with promptfoo, garak, PyRIT, or your own suite. - Only the latest run counts toward badges and score. History is kept for the record.
- Unrecognised categories are stored but map to no control.
Related
Connect evidence from CI · Fix failures and escalate hard questions