attest
Record AI governance actions as compliance evidence, mapping each event to EU AI Act, SOC 2, ISO 42001, and NIST AI RMF controls to create an audit trail and update your readiness score.
Instructions
Record a compliance evidence event in the Mima governance ledger, mapped to EU AI Act, SOC 2 Type II, ISO 42001, and NIST AI RMF controls.
Call this when the AI system performs a governance-relevant action that requires an audit trail: a human reviewing or overriding an AI decision, a risk assessment being completed, a model being evaluated for accuracy or bias, an access review, a policy being acknowledged, or an incident being reported.
Do NOT call this for routine AI inference calls — only for actions where a regulator or auditor would expect documented evidence.
Returns the record_id and the list of compliance controls earned (e.g. EUAIA_ART14, SOC2_CC6.1). The GRC manager sees these in the Mima governance dashboard and they count toward the readiness score.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| payload | Yes | Event-specific fields. Unknown fields are stored but do not earn additional controls. For human_oversight: { decision, reviewer, outcome_summary, system_prompt_version? }. For ai_risk_assessment: { risk_level, risk_summary, art5_self_assessment?, mitigations? }. For model_evaluation: { accuracy, robustness_score?, bias_metrics?, evaluated_by? }. For incident_report: { severity, description, resolution? }. | |
| identity | No | User or service identity performing the action. E.g. 'user@example.com'. | |
| resource | No | The resource or entity acted upon. E.g. 'customer-id:12345'. | |
| environment | No | Deployment environment. Defaults to 'production' on the server side. | |
| occurred_at | No | ISO 8601 timestamp of when the event occurred. Defaults to now. | |
| record_type | Yes | The governance event type. Maps to the SDK's 11 record types. | |
| system_name | Yes | Name of the AI system generating this record. E.g. 'loan-scoring-v2'. Alphanumeric, spaces, hyphens, underscores, and dots only. | |
| enforce_gates | No | If true, checks all required governance gates before writing. Recommended for production actions and high-risk systems. If a required gate is failing, the write is blocked — use dry_run_attest to confirm this record would earn controls that close the gap, then re-call attest without enforce_gates once you have verified the impact. |