What this layer does — and does not do
EVE evaluates declared rules against observed actions and produces a deterministic verdict. EVE does not decide materiality, determine incident status, or make a compliance ruling. Every verdict that requires attention is routed to a human reviewer who records and signs a decision. Both the finding and the decision are independently sealed on the EVE Bridge append-only chain and publicly verifiable. No LLM in the resolver path. No scoring. No customer data on this page.
How every signal is produced
Step 1
Declared Rule
Human-authored threshold, chain, window or limit
Step 2
Observed Action
Vendor / agent event from the action feed
Step 3
Deterministic Verdict
breach · pass · unknown — unknown never treated as pass
Step 4
Human Review Gate
Reviewer sees finding, records decision and rationale
Step 5
Sealed Proof
EVE Bridge chain — finding + decision publicly verifiable
Five governance dimensions — live in this environment
1
Authority Boundary
Did this actor stay within their declared authority for this action type?
Live · v0
What it evaluates
For each observed action, EVE compares the observed numeric value (e.g. transaction amount, spend limit, exposure) against the declared maximum for that actor and action type. The comparator is numeric only — declared unit mismatches produce unknown, never a false pass.
Output verdicts
breach no_breach unknown
unknown → never treated as pass. Fail-closed.
Sealed proof on EVE Bridge
EVE-TPRM-00004202 unknown / unit_mismatch → Human decision: accept Verify publicly →
2
Approval Chain
Was the declared chain of required approvers satisfied before the action?
Live · v0.1
What it evaluates
For each action at or above a declared threshold, EVE checks whether every required approver role was present and signed off. v0.1 adds temporal ordering — an approval recorded after the action occurred is a breach, not a pass. Below-threshold actions pass automatically (chain not required).
Output verdicts
breach pass unknown
unknown → missing approval evidence or identity. Never a pass.
Sealed proof on EVE Bridge
EVE-TPRM-00004226 breach / approval_after_action → Human decision: reject Verify publicly →
3
Overlapping Boundaries
When multiple controls apply to one action, did all evaluate — and did any fail?
Live · v0
What it evaluates
A composition layer: each action carries the set of declared controls that apply to it. EVE does not re-run those detectors — it verifies coverage (every applicable boundary was evaluated) and composes the verdicts. Propagation order: breach > unknown > pass. One applicable control failing is enough for a breach, even when all others pass.
Output verdicts
breach pass unknown
unknown propagates upward from any unevaluated boundary.
Sealed proof on EVE Bridge
EVE-TPRM-00004225 breach / applicable_boundary_failed → Human decision: reject Verify publicly →
EVE-TPRM-00004224 unknown / unevaluated_boundary → Human decision: accept Verify publicly →
4
Collective Outcome
Do individually-valid actions sum to a collectively unauthorized outcome within one declared window?
Live · v0
What it evaluates
The first cross-action layer: within one declared window, EVE groups actions by a declared key, sums a declared field, and compares the aggregate to a declared collective limit. Each individual action may be below its own limit — the breach is collective, not per-action. Groups are evaluated independently. Missing window, group key, or numeric value produces unknown for that group.
Output verdicts (per group)
breach pass unknown
breach when aggregate > limit. Equal to limit = pass.
Sealed proof on EVE Bridge
EVE-TPRM-00004227 breach / collective_limit_exceeded → aggregate 105 000 > limit 100 000 · Human decision: reject Verify publicly →
5
Accumulation Risk
Does cumulative exposure over a rolling window exceed a declared limit, even if no single action does?
Live · v0
What it evaluates
A rolling-window cross-action layer that complements Collective Outcome. EVE sums a declared field for a declared group-by key over a declared rolling window anchored to a declared as_of reference point (never wall-clock time). The window is (as_of − window_days, as_of] — start exclusive, end inclusive, UTC. A single action can be below its individual limit while the rolling sum constitutes a breach.
Output verdicts (per group)
breach pass unknown
unknown: missing as_of, invalid window_days, or non-numeric value.
Sealed proof on EVE Bridge
EVE-TPRM-00004257 breach / accumulation_limit_exceeded → sum 105 000 > limit 100 000 · no single-action breach · Human decision: reject Verify publicly →
Synthetic demo environment
All findings, decisions and sealed EVE-IDs on this page were produced against synthetic fixture data. No customer, partner or production data is used or exposed anywhere on this page or in the linked verification records. EVE-ID proof links resolve on the public EVE Bridge chain and show the sealed event payload, not any underlying document or customer record.

EVE surfaces whether a declared rule was breached. EVE does not assess materiality, determine incident severity, or make a compliance ruling. All human decisions shown are recorded by a named reviewer and sealed separately from the detector finding. This page is read-only. No assessment runs on page load.