How Avowa grades evidence

Every rule below is read out of the code that does the grading. Change a rule without republishing this page and our own tests fail.

The point of the product is that a claim is only as good as how it was established. So the method has to be inspectable too — otherwise "we grade honestly" is one more thing you would have to take our word for.

The ladder

Self-declared

Someone typed it. No artifact, nothing to check — the answer a questionnaire produces.

Documented or asserted

A policy, a certificate, or a flag your application sent. Real evidence that Avowa did not witness itself: a PDF says so, or your code says so.

Observed

Avowa read it from the system that would know — your cloud account, your identity provider, the inference call itself. Nobody had to tell us.

Independently attested

A licensed practitioner examined the evidence and signed an opinion. Only an unmodified or qualified opinion raises a claim to L4; an adverse opinion or a disclaimer is sealed and published, and raises nothing.

A claim counts as proven at verifieddocumentedl4_attested — and nowhere else. Avowa currently grades 118 claims across 20 connectors.

Observed or asserted — in the Runtime SDK, field by field

The SDK sits in your inference path. Some facts it works out for itself; the rest your application tells it. Those are not the same thing and are never graded the same, so here is the actual split.

Observed by the SDK (15) — graded L3

Read off the call. Nobody had to declare them.

agent_run_keyautonomy_depthendpointerrorfallback_modelinjection_suspectedlatency_msmcp_methodmcp_servermodelpii_detectedretriestool_calledtools_invokedtools_offered

Asserted by your application (27) — graded L2

Signed and timestamped in transit, which proves the message was not tampered with. It proves nothing about whether the claim is true, so it sits above a questionnaire answer and below an observation.

action_authorizedaction_blockedaction_classaction_loggedagent_runai_disclosedapproval_requiredapproved_by_humanblocked_categorydecision_loggedeval_scorefairness_checkedgroundedguardrailguardrail_blockedhuman_reviewedinjection_blockedmodel_pinnedoutput_validatedpii_redactedrate_limitedrationale_presentrefusedsystem_prompt_protectedtool_authorizedtrain_on_datauncertainty_flagged

Where we will not quote a percentage

Coverage needs a denominator. We hold the complete control list for 3 of 13 frameworks:

SOC 2 — coverage reported against its own 61 criteria.
ISO 42001 — coverage reported against its own 38 controls.
HIPAA Security Rule — coverage reported against its own 48 requirements.

For the other 10 — SIGCAIQISO 27001NIST AI RMFEU AI ActOWASP LLMMITRE ATLASGDPRDPDPACCPA / CPRA — we report the claims we map and assert no coverage percentage at all, because we cannot establish what we would be a percentage of.

The floors

50 calls before "we saw none" is reported as evidence of absence. Below it the observation stands, but it cannot satisfy a control.

10 agent runs before any pattern in agent behaviour is called a pattern. One run is an anecdote, and a card that looks equally confident over 1 run and 400 is the failure this floor exists to prevent.

Human-approval rates are measured over consequential actions only — writeexternalfinancial — never over read-only calls, which would inflate the number and prove nothing.

What we refuse to infer

We do not infer what a tool does from its name.
`send_email` might post a newsletter or wire a payment instruction. The SDK sees a string. Consequence is the vendor's own classification, recorded as theirs — and an unclassified tool stays unknown, never 'harmless'.
We do not assemble a trajectory from calls we cannot order.
Agent runs are correlated by a key the SDK derives. Calls without one are counted and dropped rather than bundled — inventing a sequence the agent never took would be the worst output this system could produce.
We do not claim coverage of a standard whose control list we do not hold.
Coverage needs a denominator. Where Avowa holds the catalogue it reports controls evidenced out of the standard's own total; everywhere else it reports what it mapped and asserts no percentage at all.
We do not treat silence as a pass.
An unclassified tool, an unanswered scope question, a control nothing reaches — each is reported as unknown. Defaulting to the harmless reading would let saying nothing buy a clean result.
We do not grade our own output.
Avowa does not write your policies, and does not sit in your allow/deny path. An independent grader cannot also be the graded thing.

When the seal is withheld

Your own captured evidence contradicts a claim you state. The seal is withheld until the contradiction is resolved or disclosed — proof beats attestation, including yours.
An attestation carries an adverse opinion or a disclaimer. It is sealed and published in full, and raises nothing.

A seal Avowa would not withhold from its own customers would not be worth showing a buyer. Our own trust page carries the same rules, including the parts we have not earned.

Generated from Avowa's grading engine on 2026-09-26. Sources: db.CLAIMS, db.PROVEN_STATUSES, connectors.RUNTIME_OBSERVED, connectors.RUNTIME_ASSERTED, connectors.MIN_ABSENCE_SAMPLE, connectors.MIN_SCOPING_RUNS, db.ASSURING_OPINIONS. · avowa.ai