Platform
How EvidentAI works.
EvidentAI sits alongside the GRC platform already in place. Controls stay where they are, bound once and evaluated against what the agents actually do.
The governance loop
Every inference passes through five stages.
Capture the decision, evaluate it against policy, decide, seal the verdict, push it to the GRC. All five stages apply to everything the agents do. Every decision, not a sample.
Capture
Policy Evaluation
Enforcement Decision
Evidence Sealed
GRC Outflow
Governance does not slow the application down. Agents do not wait for a verdict before continuing, except where blocking is deliberately wired into the action itself. Verdicts and findings, once written, do not change.
The same loop governs cost and fairness. Token budgets enforce spend limits per workflow. Bias cohort definitions are evaluated on the same controls once volume builds.
Frameworks
One control across every framework.
LangChain has chains, agents, tools, and memory. CrewAI has crews and tasks, and its agent comes with a role, a goal, and a backstory. AutoGen thinks in conversations, with assistants, teams, and streams of events. OpenAI Agents has assistants, threads, and runs. A decent chunk of most estates is custom code that matches none of them.
Every one of these is a reasonable way to model the work. None of them agree with each other.
So governance built on framework concepts falls apart the moment there are two frameworks in the estate. Most companies get there fast.
Underneath the vocabulary, what policy needs to know does not really move.
Something acted. It ran under some policy. It saw an input. It pulled a document, at a version. It reached outside itself. It produced an output. Sometimes a person approved that output before it went anywhere. All of that happened whatever the framework calls the thing that did it.
That is the layer the policy engine governs. Each framework's vocabulary is translated into it once.
| What policy needs to know | LangChain / LangGraph | CrewAI | AutoGen | OpenAI Agents |
|---|---|---|---|---|
| what acted | agent, runnable | agent (role, goal, backstory) | AssistantAgent | agent |
| one unit of work | chain, graph node | task | run() returning TaskResult | run step |
| the grouping it belongs to | graph | crew, process | team, group chat | thread |
| what it reached for | tool call | tool | ToolCallRequestEvent | tool call |
| what it carried forward | memory | memory, knowledge_sources | model context | thread state |
That is what makes one control library possible. An obligation is bound once, and it governs the credit workflow one team built and the claims workflow another team built in something else, because the engine never sees either framework. It sees an actor, a workflow, and a policy.
Two things follow. Cross-system questions get an answer at all. Whether personal data reached any output is a question about the company rather than about somebody's stack. And a framework migration stops being a governance event. When only the translation layer changes, controls and verdict history come through intact.
The evidence format underneath is published openly, so nothing here depends on the vendor staying in business.
Foundation
How the layers sit
The tracing layer can be self-hosted on private cloud, under whatever retention policy already applies.
How it connects
EvidentAI connects to what is already running. GRC platforms including OneTrust, Archer, ServiceNow GRC, and MetricStream. Cloud control planes across Azure, AWS, and GCP, plus identity through Microsoft Entra. Air-gapped environments import controls and policies through structured files.
Connections read agent definitions, tool permissions, model versions, and deployment settings. Posture updates as the estate changes. It changes more than anyone expects.
The models behind evaluation
Four kinds of model do the work here. Only one is large. Purpose-built small language models handle policy interpretation and control mapping. Deterministic checks handle model versions, tool permissions, and anything else that should never be probabilistic.
Predictive models watch the estate for drift. Large language models are used where the thing being judged is itself language, and nowhere else.
Next step
Ask for the architecture walk-through.
The demo covers control mapping and rollout options.