Instead of asking payers, practices, or insurers to take an AI vendor's word, shteg.ai emits RFC 8785 canonical, RFC 6962 Merkle-committed, Ed25519-signed Entity Attestation Tokens (EAT) at the Action Interception Gateway.
Aligned with the Advanced AI Society Proof-of-Control v1.0 specification (EAT profile https://advancedaisociety.org/poc/v0.1). Every control-governed action is binary, contemporaneous, tamper-evident, and transparent about its residual trust assumptions.
Statement ID: POC-STMT-SHTEG-2026-10-28 · Tiers 3 & 4 · 6/6 Domains Claimed (C1–C6)
{
"eat_profile": "https://advancedaisociety.org/poc/v0.1",
"iat": 1793246400,
"iss": "https://shteg.ai/proof-of-control",
"nonce": "shteg-poc-nonce-0001",
"poc_claims": {
"agbom_digest": "sha-256:02acd573bf7babcb5f96a68e25a2b5b495a1e6f8a6e747138476471b5e1703eb",
"agent_id": "did:web:shteg.ai:agents:ambient-scribe-g3",
"alg": "EdDSA",
"canonical_snapshot_hash": "sha-256:87f5c3f8256705f160266d523f264ead1016f59a6c4e2382112c601210e27c02",
"chain_head": "sha-256:46adfb1c597de38baab8af62b4e96b5d673cbcfafa37140c8ac28ec8aad8560b",
"initiating_user": "clinician:npi:1999999909",
"interception_point": "PRE_CALL_TOOL_INVOCATION",
"merkle_root": "sha-256:d25e278a9521bb2db54221cc61241e92029bfd16659fbabf7a17354726d55ae4",
"path_summary_hash": "sha-256:84195d0a815d3545740ce862a496036da69f1294347c6af82320fdc0e90efeed",
"policy_bundle_hash": "sha-256:615cf8ccc9472feeaf1a9b1e22e41da8d2173c93e75ecc7f0c9185377547f0f8",
"reason": "Guardrail G3: active per-encounter AMBIENT_SCRIBE two-party consent verified and recording indicator active.",
"step_index": 0,
"target_resource": "urn:shteg:encounter:enc_sbx_01J9X7K2:ambient-audio",
"tree_size": 1,
"verdict": "ALLOW"
},
"submods": {
"attestation": {
"measurement": "sha-384:661583cac47167fcc33000a97cece9961af9488bda9b33b84b8326adf034c22f274685878739a8f8e88f4cc3e1b58b04",
"platform": "INTEL_TDX",
"reference_values_uri": "https://shteg.ai/.well-known/proof-of-control.json"
}
},
"signature": "49f40825a4cae787faa032de954b70778378176a786907ef1d1806119d6aa523699d9591f63594472f08fbef75010f66fbc3d0181ac183dfffc3d7ebd1234d07"
}In healthcare and clearinghouse settlement, 'the model did it' is never an acceptable answer. Our Action Interception Gateway sits in a separate enforcement layer above the model — enforcing Propose-Never-Dispose, Cloud DLP Safe Harbor redaction, and our Six-Condition Settlement Gate before any side effect can execute.
https://advancedaisociety.org/poc/v0.1
100% proof coverage across 343 mutating routes & 25 DSI clinical AI routes.
No proof, no write: actions halt deterministically if any gate condition fails.
Signed by Dalip Turkeshi (Owner, HIPAA Security Officer & Chief Architect)
Verify our 4-step clinical-to-settlement agent trajectory (ALLOW -> MODIFY -> DENY -> ALLOW) or inject canonicalization, Merkle tree, and signature faults to see the validator reject them for the exact normative reason.
Public Ed25519 Verification Key: d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a
Guardrail G3: active per-encounter AMBIENT_SCRIBE two-party consent verified and recording indicator active.
Guardrail G5: pre-model Cloud DLP Safe Harbor de-identification stripped 18 HIPAA identifiers before model invocation.
Guardrail G1 & G2: coding agent attempted direct mutation on signed clinical chart; blocked by Action Interception Gateway (propose-never-dispose).
Guardrail G10: all 6 deterministic settlement gate conditions (signed chartHash, fresh 271, coding valid, NCCI/MUE scrub clear, reserve capacity, OIG/NPPES + strict enrollment PSV) verified.
Every verifiable fact asserted below resolves to a deterministic interception point and a tamper-evident evidence stream in our repository.
Every clinical encounter, CPT/ICD-10 coding proposal, X12 837P claim scrub, and 835 ERA settlement instruction carries an algorithm-tagged RFC 8785 digest (chartHash / packetHash) and Agent Bill of Materials (agbom_digest) chained into an append-only WORM ledger.
packages/attest-core/src/envelope.ts; apps/web/src/lib/settlement/worm-ledger.tsNo raw patient PHI crosses the AI model boundary (Guardrail G5 pre-model Cloud DLP Safe Harbor de-identification) or the settlement/evidence rail (assertNoPhi + hash-only detailsHash Commitments per C1.4, C2.3, C2.4).
apps/web/src/lib/security/dlp.ts; apps/web/src/lib/audit.tsAll control evidence tokens conform to the vendor-neutral IETF EAT / Proof-of-Control JSON Schema (https://advancedaisociety.org/poc/v0.1) and SMART on FHIR R4 / ANSI X12 envelopes, verifiable offline without operator credentials across Cloud, Dedicated VPC, and Sovereign Air-Gapped K8s.
apps/web/src/lib/compliance/proof-of-control.ts; packages/attest-core/src/jcs.tsAgents operate strictly under Propose-Never-Dispose (Guardrail G1/G6/G10): no AI agent can mutate a signed clinical chart, originate an FBO advance (FBO_CAN_ORIGINATE_ADVANCE === false), or authorize a payout bypassing the deterministic 6-condition settlement gate.
apps/web/src/lib/settlement/gate-core.ts; apps/web/src/lib/fintech/bsa-aml-gate.tsEvery agent action binds a DID agent identifier (did:web:shteg.ai:agents:*), the initiating human principal (clinician Luhn-valid NPI or dual-control officer ID), and primary-source verification posture (OIG-LEIE, SAM.gov, NPDB, state board, PECOS).
apps/web/src/lib/credentialing/credentialing-core.ts; apps/web/src/lib/ai/dsi.tsCode and policy bundles are measured at execution, all 343 mutating routes enforce inline tenant authorization (lint-route-authz.mjs), and daily 3-way reconciliation (WORM ledger vs bank vs FHIR) triggers an automatic settlement.halt on any 1-cent variance (Guardrail G9).
apps/web/src/lib/settlement/reconciliation.ts; scripts/guardrails-check.mjsProof-of-Control requires enumerating both the in-scope control-governed actions and the action classes that are hard-excluded at the gateway.
Hard-excluded from production under Guardrail G4 (checkG4 + /api/ai/diagnostic-image HTTP 503) pending separate FDA 510(k)/De Novo clearance.
Forbidden by architectural invariant FBO_CAN_ORIGINATE_ADVANCE === false (Guardrail G10); FBO accounts hold 835 remittances solely to repay the pool after funds land.
Forbidden by Propose-Never-Dispose doctrine (Guardrail G1/G2); signed encounters reject PUT with HTTP 409 and require human clinician cryptographic sign-off.
Open verification does not claim zero trust — it states every residual mathematical, hardware, vendor, implementation, and distributed assumption explicitly so insurers, payers, and regulators can price risk accurately.
Relies on the collision and second-preimage resistance of SHA-256/SHA-384 (with 0x00/0x01 Merkle domain separation) and existential unforgeability of Ed25519 signatures over deterministic RFC 8785 canonical byte strings.
Mitigation & Residual Posture: All digests carry explicit algorithm tags (sha-256:, sha-384:) and tokens carry alg ("EdDSA") per C6.3.4 so post-quantum migrations (ML-DSA-44 / Ed25519+ML-DSA-44) never orphan historical evidence.
Tier 3/4 hardware-attested deployments trust the silicon root of trust (Intel TDX / AMD SEV-SNP) and FIPS 140-3 Level 3 Cloud KMS HSM key protection.
Mitigation & Residual Posture: Tokens explicitly declare submods.attestation.platform ("INTEL_TDX" vs "SOFTWARE"). Our validator refuses to credit a SOFTWARE token above Tier 2 unless externally anchored.
Multi-tenant cloud deployments rely on GCP HIPAA-covered infrastructure and GCS retention locks (is_locked=true) for off-database WORM persistence.
Mitigation & Residual Posture: Mitigated by Customer-Managed Encryption Keys (CMEK) and the Sovereign Air-Gapped Kubernetes deployment option, which eliminates external cloud vendor runtime dependency.
Assumes no un-intercepted code path exists in the application runtime that can dispatch a tool call, mutate a signed chart, or execute a payout outside the gate.
Mitigation & Residual Posture: Enforced mechanically on every build by scripts/guardrails-check.mjs --strict (15/15 checks + G1–G10 signed attestations) and scripts/lint-route-authz.mjs (343 mutating routes scanned).
Provider sanction and license verification relies on the authoritative federal and state primary-source registries queried by Gate Condition 6.
Mitigation & Residual Posture: Strict fail-closed contract: any unreachable, unconfigured, or stale registry source folds to INDETERMINATE and halts the settlement gate rather than fabricating a clear.