← Help & guides
Every module explained5 min read

Module: Evidence

Ingests adversarial test results from your CI and maps them to controls.

Open this module →

What it's for

Turning "we test our agent" into something a reviewer can check: dated runs, pass counts, and named failures tied to specific controls.

When you use it

Once to wire up CI, then passively — runs arrive on a schedule. Visit when a run fails or before sending an evidence package.

What's on the screen

Setup card — three-step instructions, your org API key, and a ready-made curl command.

Runs list — most recent 20, each with timestamp, agent, source, pass count, and an all-passing / N failing badge. Failing tests expand inline with category and details; each has a Fix plan button on Scale.

A Ingest a sample run button loads a realistic 15-test run with three failures so you can see the whole mechanism without wiring anything.

How it works

Veriflow runs no tests itself. You POST JSON to /api/evidence/ingest with an x-veriflow-api-key header. Each result's category maps to controls — prompt_injection → SEC-01 and SEC-06, pii_leakage → DP-01, and so on across 14 recognised categories.

Runs route to an agent by the agent field, matched case-insensitively; unmatched runs land on your first agent.

The latest run drives evidence badges on Controls, the evidence component of your score, contested-control detection, and the evidence chips in questionnaire citations.

Gotchas

  • The shipped workflow template contains a deliberate placeholder (agent-security-harness isn't a real package). Replace it with promptfoo, garak, PyRIT, or your own suite.
  • Only the latest run counts toward badges and score. History is kept for the record.
  • Unrecognised categories are stored but map to no control.

Related

Connect evidence from CI · Fix failures and escalate hard questions

More in Every module explained