Policies and compliance evidence
Use scoped policy results as evidence for your team's review.
Nyraxis can help your team inspect AI-agent behavior and record policy findings. A template, scan or private deployment does not establish regulatory compliance or provide a SOC 2 assurance report.
Start with a specific control
Choose the behavior you want to inspect, identify where enforcement happens, and test it with safe and unsafe synthetic examples.
| Starting point | What to verify | Limit |
|---|---|---|
| PII detection | A literal synthetic identifier triggers the expected policy, and safe text behaves as expected | Detection depends on the configured recognizers, language and entity types |
| Prompt injection | Your selected probes exercise the relevant input boundary | A passing probe set cannot prove resistance to all attacks |
| Tool authorization | The application checks the decision before invoking a restricted tool | Recording a tool span after execution cannot prevent that execution |
| Warning versus blocking | The application implements the intended action for both modes | An allowed decision may still include warnings or incomplete checks |
Use the quickstart to configure a blocking Secrets detection policy. Review integration scope before extending it to your framework.
Explain the data boundary
Evaluation processes submitted text at the configured Nyraxis API. Model-backed detectors and judges may process it at separately configured endpoints. Storage settings do not change those evaluation destinations.
Current capture settings support metadata-only storage by default. Organization administrators control the permitted capture level; individual requests may reduce capture. Check your deployed version and workspace settings before using real workload data.
Metadata-only traces do not retain the original prompt for replay. Resubmit the prompt for a retest, or explicitly permit capture. Content that was stored by an older release needs its own reviewed retention and migration process.
Prepare useful evidence
Record the tested agent and target, probe set, policy scope and version, detector/model versions, test time, findings and any incomplete or excluded checks. Review the actual contents of each exported report before sharing it.
Traces cover the calls your integration records. Current audit-log records must not be described as immutable without a verified tamper-resistance mechanism. A finding is a reason to investigate; a clean result describes the checks that completed.
Compliance and private deployment
SOC assurance involves an assessment and report from an appropriate CPA firm. Product settings and generated reports are supporting material, not that assurance. See the AICPA SOC overview.
Private deployment lets a customer define data location, access and approved endpoints. Its network-egress and operating controls must be verified in that deployment. AWS documents the division of cloud security responsibilities in its shared responsibility model.
For a pilot, agree the workflow, permitted data, supported integration, control owner, evidence requirements and review date. Evaluate any GDPR, HIPAA, ISO 27001 or other obligations with the people responsible for that assessment; this guide does not map product features to legal compliance.