The Standard
No Stamp → No Ship for high-impact AI.
A Good Proof Stamp turns a high-impact action into a contract-referenceable gate: a Status Link (what's true now) + an IDA Evidence Pack (what was true then).
Guardians only when a lane requires human finality.
VALID
→ proceed
NEEDS REFRESH
→ block until re-verified
WITHDRAWN
→ stop relying
NOT VERIFIED
→ fail-closed
Day 30 deliverable: one lane gated end-to-end with a live Status Link counterparties can verify.
Scope-limited verification. Not certification. Acceptance depends on counterparty or programme requirements.
GOOD PROOF
Good Proof Stamp
Copy ID
VALID
Checked Now
GP-2026-0142-XK9
statusVALIDscopetool_execution:high_impactexpires_at2026-06-15T00:00:00Zverified_at2026-01-19T14:32:00Zsignerpolicy_signer_v3version2026.01.19.1
verify_urlverify.goodproof.mindchill.ai/GP-2026-0142-XK9
canonical verifier
Signed (programme-scoped)·Fail-closed·Append-only
Counterparty check: verify.goodproof.mindchill.ai (official)Don't trust links. Type mindchill.ai/official to verify.
Counterparties verify by link — not by asking you.
This is what a counterparty sees. No login. No portal. Just a link that fails closed.
What a Stamp gives you
One Stamp produces both artifacts. Status Link = what's true now. IDA Evidence Pack = what was true then.
Status Link
Authoritative now
Counterparty-verifiable Status Link that shows status, scope, expiry, and signer. Fail-closed: unreachable = NOT VERIFIED.
- Shows status, scope, expiry, signer
- Fail-closed: unreachable = NOT VERIFIED
- Designed for systems, tickets, contracts, UIs
View full details
IDA Evidence Pack
Snapshot then
A time-stamped snapshot you can forward, file, and cite. Built for procurement, disputes, and audit.
- Append-only history pointer
- Prompts/logs/PII excluded by default
- Programme-gated access when required
View full details
Every Stamped IDA Evidence Pack includes:
IDA Evidence Pack
(snapshot view)
Accessible via canonical verify route (or programme-gated access when required)
Exportable snapshot
PDF export available for filing
(programme-scoped)
Receipt digest / version reference
(append-only)
Pack references the append-only record/version; receipt digest is published to the receipted history.
Status history pointer
Track changes over time
Canonical verification route
verify.goodproof.mindchill.ai
Default evidence window
90 days
(configurable 30-365 days)
PDFs are great for filing. Status Links keep them current.
Stamp → Status Link → Verify
1
Define the high-impact action class
Set scope boundaries, evidence windows, and what counts as a material change.
2
Require a Stamp (hard gate)
No Stamp / NOT VERIFIED / NEEDS REFRESH / WITHDRAWN → block or escalate.
No Stamp → No Ship.
Make the gate machine-checkable, not meeting-checkable.
3
Issue the Status Link + generate the IDA Evidence Pack
One verification produces both:
- • Status Link = authoritative now
- • IDA Evidence Pack = time-stamped snapshot then
4
Use Guardians only when required
Programme-scoped human finality for exceptions, disputes, and edge cases.
Live Status States
Every Status Link returns one of four states. Your systems decide what happens next.
VALID
Valid within scope under lane rules (not a guarantee of outcome correctness).
NEEDS REFRESH
Evidence window expired or a material-change trigger fired → re-verify.
WITHDRAWN
Stop relying. Current validity revoked; history remains append-only.
NOT VERIFIED
Treat as unverified. Also returned when verification can't be performed (fail-closed).
Fail-closed rule
If verification can't be performed, default is NOT VERIFIED. Block or escalate—never assume validity.
Default verify fields
statusverification_modescopeexpires_atverified_atsignerverify_url
Excluded by default: prompts, logs, PII, internal identifiers.
Programme-gated access available for authorised verifiers (auditable trail).
Protocols & Rails
Protocols and rails: make tool-using AI operable
When AI can execute, pay, settle, and close disputes, regulated teams need proof that travels. Good Proof turns high-impact execution into a scope-bound verification gate.
Agentic Identity, Reputation, and Payment Rails
Good Proof is the trust layer for portable agent execution rights across tools and rails. Identity and reputation portability is not execution authorization — execution still requires a VALID Status Link per lane.
Portable identity context can travel
Reputation and identity signals cross system boundaries.
Permission-to-act remains scope-bound
Execution rights are revocable by Status Link.
Cross-rail actions stay fail-closed
Payments, tool calls, physical actions require VALID status.
1
Stamp the surface
Version + capability scope. If it changes → NEEDS REFRESH.
2
Stamp high-impact execution
Status Link check before action. No Stamp → No Ship.
3
Stamp delegation and permissions
Expiry + revocation. Verifiers confirm what was allowed.
AI ad integrity
Runtime verification for sponsored AI outputs at serve time. Complementary to brand safety measurement and legal review—not a replacement.
- Stamp sponsor reference + disclosure payload + policy version
- Gate serving by live status: No Stamp → No Serve
- Non-VALID blocks sponsored path; optional non-sponsored fallback where policy allows
Guardians are exception-only, not required for normal real-time serve.
Voice & wearables integrity
Runtime verification of consent/disclosure/context state at output time. Complementary to privacy and legal review—not a replacement.
- Stamp consent state + disclosure payload + context gate (child mode, driving mode)
- Gate high-impact voice outputs: No Stamp → No Speak
- Non-VALID blocks sponsored/high-impact path; optional safe fallback where policy allows
Guardians are exception-only, not required for normal real-time speak.
Agentic AI security
Prompt injection is inevitable. The question is whether it can ship. Good Proof turns high-impact agent execution into a scope-bound gate with live revocation.
- Stamp the tool boundary: tool surface + capability scope for a defined lane
- Gate high-impact execution: No Stamp → No Ship
- Revoke fast when compromise is suspected: WITHDRAWN propagates stop-rely signals immediately
AI work OS safety
Agentic work OS tools can plan and execute across files, inboxes, spreadsheets, and connected systems. Good Proof makes high-impact execution operable in regulated environments by turning it into a scope-bound gate with live revocation.
- Stamp workspace + tool surface with policy version
- Stamp irreversible actions: No Stamp → No Ship
- Stamp delegation and session authority with expiry
Identity & authority safety
When AI can request access, approve actions, or act as a user, the real risk is authority. Good Proof turns delegated power into a scope-bound, revocable object that auditors and counterparties can verify by link.
- Stamp the authority object: OAuth scopes, API key policy, signing mandates, approval thresholds
- Stamp high-impact authority use: No Stamp → No Ship for authority
- Stamp revocation and session control with expiry + withdrawal
Change-control safety: stop 'silent drift' in production
Most "AI governance" fails at the moment of change. Good Proof makes releases verifiable and revocable so production doesn't drift into "nobody signed this."
- Stamp the release bundle: model/policy/prompt pack + evaluation window + deployment target
- Stamp promotion to production: No Stamp → No Ship for production changes
- Stamp rollback and incident withdrawals with immediate stop-rely signals
MCP safety
MCP connects models to external tools. Good Proof makes that operable in regulated environments by turning high-impact tool use into a scope-bound verification gate.
- Stamp the MCP server surface: server version + declared capability scope for a defined lane
- Gate high-impact tool calls: No Stamp → No Ship for tools
- Revoke on compromise: WITHDRAWN propagates immediately
Agentic commerce safety (UCP)
UCP accelerates agent-driven commerce. Good Proof makes high-impact commerce actions operable by turning them into a scope-bound verification gate with live status and revocation.
- Stamp the commerce surface: merchant capability set + server version + payment handler configuration
- Gate high-impact actions: checkout, refunds, payout holds, merchant bans, dispute closure
- Revoke fast when risk changes: WITHDRAWN propagates immediately
UCP can coexist with MCP, A2A, and signed payment mandates.
Quantum readiness
Quantum timelines are uncertain. Migration is not. Good Proof makes crypto posture and cutovers verifiable, scope-bound, and revocable.
- Stamp the crypto posture: algorithm suite + key policy + custody boundary for a defined scope
- Gate high-impact signing: No Stamp → No Ship for custody, settlement, critical signing
- Stamp cutovers and revoke legacy: issue new Stamp, WITHDRAW the old
Tokenised settlement safety
Atomic settlement proves it moved. Good Proof proves it was permitted — within policy, limits, and the approved setup — with live status and revocation.
- Stamp the settlement surface: rails/venue + signing policy + limits + workflow version
- Gate high-risk execution: No Stamp → No Ship for money movement
- Revoke on compromise or incident: WITHDRAWN propagates immediately
Physical autonomy safety
When software can move in the physical world, the gate must be verifiable and revocable. Good Proof turns high-impact robot actions into a scope-bound verification gate.
- Stamp the capability surface: robot/software version + allowed action classes + safety envelope
- Gate irreversible actions: No Stamp → No Ship for movement, force, access, shutdown overrides
- Revoke fast when risk changes: WITHDRAWN stops reliance at the source
Not a certification. Scope-limited verification. Acceptance depends on counterparty or programme requirements.
Common questions
Lifecycle Security
ETSI EN 304 223 readiness:
lifecycle security you can prove
Europe is standardising baseline AI cybersecurity. Good Proof makes lifecycle security operable by turning high-impact deployment, change, and incident actions into a scope-bound verification gate with live status and revocation.
Stamp the lifecycle posture
Approve a defined security posture for a model/system within a lane: scope boundaries, evidence window, and ownership references. If conditions change → NEEDS REFRESH.
Stamp change-control (no silent drift)
Retraining, policy changes, tool-surface changes, and new deployments are treated as security events. No Stamp → No Ship for high-impact production changes.
Stamp accountability across roles
Bind signer authority to the lane: developer/operator/data-custodian responsibility becomes verifiable by link. If compromise is suspected → WITHDRAWN propagates stop-rely immediately.
PDFs are great for filing. Status Links keep them current.
We don't certify EN 304 223 compliance. We make your lifecycle controls verifiable, refreshable, and withdrawable by link.
This is the operational layer buyers will ask for in audits and vendor due diligence.
Not a certification. Scope-limited verification. Acceptance depends on counterparty or programme requirements.
Global Coverage
Regulatory reality
No hype, no compliance claims — Organisations are being pushed toward decision transparency, accountability, and defensible record-keeping.
EUContestability expectations + automated decision safeguards + public-sector AI governance pressure.
UKAlgorithmic transparency/recording expectations + tribunal evidence duties + administrative justice scrutiny.
USAdministrative review standards + records retention/FOI duties + increasing AI oversight.
CanadaAlgorithmic Impact Assessment expectations + transparency and recourse requirements.
AustraliaPost-Robodebt accountability expectations + administrative law review scrutiny.
Asia hubsAI governance frameworks emphasizing traceability, controllability, and bounded risk.
Middle EastPublic-sector digital transformation programmes are increasing expectations for decision traceability, authority control, and defensible records.
AfricaScrutiny is rising around administrative fairness, records, recourse, and privacy-aware handling of case decisions.
Good Proof does not certify compliance. It provides verifiable governance evidence that is portable across review contexts.
Jurisdictional Configuration
Country overlays can be configured per programme
Examples include programme-specific mapping for UAE, Saudi Arabia, Kenya, Nigeria, South Africa, and other jurisdictions where disclosure, retention, appeal handling, and verifier access requirements differ.
Configure scope boundaries, evidence windows, redaction matrix, and verifier checklist per jurisdiction.
Not legal advice. Final legal mapping is owned by programme counsel.
Optional Add-On
Optional anchoring: Good Proof LIVE Ledger
For high assurance programmes, the IDA snapshot hash can optionally be anchored to Good Proof LIVE Ledger for tamper evident timestamp durability. Anchoring does not disclose prompts, logs, or PII by default.
Procurement ready
Use the Contract Clause Pack to require Stamps for defined high impact action classes, specify refresh and withdrawal triggers, and give counterparties verification rights.
Request clause packStage 2
Hardware-backed finality (optional)
Some buyers need more than software assurances. Hardware-backed signing makes verification keys non-exportable and makes Status Links harder to spoof, even under hostile scrutiny.
Vault Signer (HSM/TPM-backed)
- Stamp issuance and signed verify responses can be backed by non-exportable keys.
- Procurement-friendly: clear key custody boundaries without sharing prompts/logs/PII.
- If key policy or signer configuration changes → NEEDS REFRESH.
Edge Gate (for autonomy + physical execution)
- Enforce "No Stamp → No Ship" at the boundary where actions execute (edge/device/gateway).
- If Status Link is not VALID → block or safe-stop.
- Revocation propagates by Status Link, not by chasing configs.
Attestation-ready (optional, programme-scoped)
- Prove what signer/workflow version was authorised without exposing internals.
- When the trusted version or capability scope changes → NEEDS REFRESH.
- Minimal disclosure by default; programme-gated access when required.
Not a certification. Scope-limited verification. Acceptance depends on counterparty or programme requirements.
Frequently asked questions
Make high-impact AI shippable
Define your high-impact action classes. Require the Stamp. Let the Status Link do the rest.
Not a certification. Scope-limited verification. Acceptance depends on counterparty or programme requirements.