HAARF — Healthcare AI Agents Regulatory Framework

HAARF — Healthcare AI Agents Regulatory Framework — 97% of in-scope requirements covered.

279 requirements · 279 in scope (262 enforced · 15 designed · 2 deferred). The 97% is weighted over the in-scope base.

Source: medrxiv 10.64898/2026.04.09.26350519v1 · License: CC-BY-SA-4.0

By category

Category	Reqs	Enforced	Designed	Deferred	Coverage
C1 Unified Risk & Lifecycle Assessment	30	29	1	0	98%
C2 Model Passport & Provenance	34	34	0	0	100%
C3 Cybersecurity for AI Agents	35	33	2	0	97%
C4 Human Oversight & Accountability	38	33	4	1	92%
C5 Agent Registration & Identity	30	26	4	0	93%
C6 Autonomy Governance	35	35	0	0	100%
C7 Bias, Equity & Fairness	35	32	2	1	94%
C8 Tool Use & Integration Security	42	40	2	0	98%

Every requirement → the KYE™ artefact that enforces it

ID	Title	Status	KYE™ enforcement
`haarf.C1.1.1`	Three-factor risk assessment (autonomy × consequence × population)	enforced	audit_events: `kye.risk_assessment.v1`, `kye.evidence.decision_map.v1` engines: `internal`, `internal` agents: `internal` workers: `kye-risk-agent` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C1.1.2`	Autonomy-level classification (advisory → fully autonomous)	enforced	audit_events: `kye.assurance.adoption_stage.v1`, `kye.authority.grant.v1` engines: `internal` workers: `kye-pdp` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C1.1.3`	Consequence-tier classification (reversible → irreversible / safety-critical)	enforced 1 unverified citation	audit_events: `kye.risk_assessment.v1`, `kye.decision.commit_boundary.v1` unverified citation engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C1.1.4`	Population-impact classification (single patient → cohort → population)	enforced	audit_events: `kye.risk_assessment.v1` engines: `internal` sector_packs: `kye:sector-pack:healthcare` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C1.1.5`	Pre-deployment risk register entry	enforced 1 unverified citation	audit_events: `kye.assurance.risk_register.v1` unverified citation engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C1.1.6`	Lifecycle stage gating (design → train → validate → deploy → monitor → retire)	enforced 1 unverified citation	audit_events: `kye.assurance.adoption_stage.v1`, `kye.assurance.review_cycle.v1` unverified citation engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C1.1.7`	Pre-deployment threat model	enforced 1 unverified citation	audit_events: `kye.assurance.threat_model.v1` unverified citation engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C1.1.8`	Independent risk review	enforced 1 unverified citation	audit_events: `kye.assurance.internal_audit.v1` unverified citation, `kye.assurance.audit_pilot.v1` agents: `internal` workers: `kye-audit-pilot-agent` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`haarf.C1.1.9`	Periodic risk re-assessment (≤90 days)	enforced	schemas: `kye.compliance.attestation.v1` audit_events: `kye.compliance.attestation.v1`, `kye.risk_assessment.v1` engines: `internal` workers: `kye-compliance-card-refresh` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C1.1.10`	Risk re-assessment on material change	enforced 1 unverified citation	audit_events: `kye.risk_assessment.v1`, `kye.resilience.drift.detected.v1` unverified citation engines: `internal`, `internal` workers: `kye-drift-detector` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C1.1.11`	Risk-tiered approval modes (auto / single / two-person / two-person+legal)	enforced	audit_events: `kye.decision.record.v1` engines: `internal`, `internal` governedui_modules: `kye.governedui.module.action_approval.v1`, `kye.governedui.module.approval_queue.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`haarf.C1.1.12`	Risk-tiered authority scope minimisation	enforced 1 unverified citation	audit_events: `kye.authority.grant.v1`, `kye.purpose.scope.v1` unverified citation engines: `internal`, `internal` workers: `kye-pdp` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C1.1.13`	Risk register WORM persistence	enforced 2 unverified citations	schemas: `kye.audit.event.v1` audit_events: `kye.assurance.risk_register.v1` unverified citation, `kye.audit.event.appended.v1` unverified citation engines: `internal` workers: `kye-audit-chain-worker` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C1.1.14`	Pre-clinical-deployment red-team	enforced 1 unverified citation	audit_events: `kye.assurance.threat_model.v1` unverified citation engines: `internal`, `internal` agents: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C1.1.15`	Sub-population fairness pre-check	enforced	audit_events: `kye.risk_assessment.v1` engines: `internal` constitution_refs: `constitution/20-ANALYTICS-PLANE.md`
`haarf.C1.1.16`	Risk classification for AI-as-medical-device class	enforced	audit_events: `kye.risk_assessment.v1` engines: `internal`, `internal` dictionaries: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C1.1.17`	Lifecycle stage transition evidence pack	enforced	audit_events: `kye.evidence.pack.v1`, `kye.assurance.adoption_stage.v1` engines: `internal` workers: `kye-evidence-pack-assembler` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C1.1.18`	Decommissioning plan attached to every agent	designed 1 unverified citation	audit_events: `kye.assurance.risk_register.v1` unverified citation constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md` registries: `internal`
`haarf.C1.1.19`	Retirement triggers (drift / failure / breach / regulatory)	enforced 2 unverified citations	audit_events: `kye.resilience.drift.detected.v1` unverified citation, `kye.resilience.intent_drift.v1` unverified citation engines: `internal`, `internal` workers: `kye-revocation-cascade` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C1.1.20`	Risk register publication to regulators on demand	enforced 1 unverified citation	audit_events: `kye.evidence.pack.v1`, `kye.report.quarterly_drift.v1` unverified citation engines: `internal`, `internal` workers: `kye-oscal-exporter` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`haarf.C1.1.21`	Risk-acceptance sign-off by accountable executive	enforced 1 unverified citation	audit_events: `kye.assurance.management_review.v1` unverified citation engines: `internal` governedui_modules: `kye.governedui.module.action_approval.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`haarf.C1.1.22`	Risk-budget envelope per agent	enforced	audit_events: `kye.authority.grant.v1`, `kye.risk_assessment.v1` engines: `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C1.1.23`	Lifecycle audit trail end-to-end	enforced 1 unverified citation	schemas: `kye.audit.event.v1` audit_events: `kye.audit.event.v1`, `kye.audit.event.appended.v1` unverified citation engines: `internal` workers: `kye-audit-chain-worker` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C1.1.24`	Risk-class governance differential (low vs high)	enforced	audit_events: `kye.risk_assessment.v1` engines: `internal` workers: `kye-rules-gateway-worker` dictionaries: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C1.1.25`	Risk-disclosure to clinical end-user	enforced 1 unverified citation	audit_events: `kye.consent.receipt.v1` unverified citation, `kye.consent.acceptance.v1` engines: `internal` comms_templates: `expert-review.brief.v1` constitution_refs: `constitution/38-COMMS-RAIL.md`
`haarf.C1.1.26`	Population-level risk reporting cadence	enforced 2 unverified citations	audit_events: `kye.report.quarterly_drift.v1` unverified citation, `kye.report.monthly_decision_summary.v1` unverified citation engines: `internal` workers: `kye-reporting-worker` constitution_refs: `constitution/20-ANALYTICS-PLANE.md`
`haarf.C1.1.27`	Risk-assessment replay-proof	enforced 1 unverified citation	audit_events: `kye.evidence.replay_proof.v1` unverified citation, `kye.replay.context_seal.v1` engines: `internal` workers: `kye-replay-proof-generator` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C1.1.28`	Sector-specific risk extensions (healthcare)	enforced	audit_events: `kye.risk_assessment.v1` engines: `internal` sector_packs: `kye:sector-pack:healthcare` constitution_refs: `constitution/29-PROFILES-LITE.md`
`haarf.C1.1.29`	Risk re-classification on safety-critical update	enforced 1 unverified citation	audit_events: `kye.resilience.drift.detected.v1` unverified citation, `kye.risk_assessment.v1` engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C1.1.30`	Cross-tenant risk-class isolation	enforced	audit_events: `kye.authority.grant.v1` engines: `internal`, `internal` workers: `kye-gateway` constitution_refs: `constitution/25-EDGE-GOVERNANCE.md`
`haarf.C2.2.1`	Unique model identifier (kye:model:<...>)	enforced 1 unverified citation	audit_events: `kye.assurance.model_validation.v1` unverified citation engines: `internal`, `internal` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`
`haarf.C2.2.2`	Model passport — declared capabilities, scope, intended use	enforced 1 unverified citation	audit_events: `kye.assurance.model_validation.v1` unverified citation, `kye.assurance.adoption_stage.v1` engines: `internal` governedui_modules: `kye.governedui.module.entity_passport.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`haarf.C2.2.3`	Training-data provenance disclosure	enforced 1 unverified citation	audit_events: `kye.assurance.model_validation.v1` unverified citation engines: `internal` agents: `internal` constitution_refs: `constitution/31-DATA-GOVERNANCE-PACK.md`
`haarf.C2.2.4`	Training-data licence audit	enforced 1 unverified citation	audit_events: `kye.assurance.model_validation.v1` unverified citation engines: `internal` constitution_refs: `constitution/31-DATA-GOVERNANCE-PACK.md`
`haarf.C2.2.5`	Training-data deduplication & contamination check	enforced 1 unverified citation	audit_events: `kye.assurance.model_validation.v1` unverified citation engines: `internal` constitution_refs: `constitution/31-DATA-GOVERNANCE-PACK.md`
`haarf.C2.2.6`	Model version pinning	enforced 1 unverified citation	audit_events: `kye.assurance.model_validation.v1` unverified citation, `kye.assurance.adoption_stage.v1` engines: `internal` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`
`haarf.C2.2.7`	Model artefact integrity hash	enforced 2 unverified citations	audit_events: `kye.evidence.signature.v1` unverified citation, `kye.assurance.model_validation.v1` unverified citation engines: `internal`, `internal` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C2.2.8`	Model card published	enforced 1 unverified citation	audit_events: `kye.assurance.model_validation.v1` unverified citation engines: `internal` governedui_modules: `kye.governedui.module.entity_passport.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`haarf.C2.2.9`	Capability declaration (read / write / autonomous-action)	enforced 1 unverified citation	audit_events: `kye.authority.grant.v1`, `kye.assurance.model_validation.v1` unverified citation engines: `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C2.2.10`	Limitations disclosure	enforced 1 unverified citation	audit_events: `kye.assurance.model_validation.v1` unverified citation engines: `internal` governedui_modules: `kye.governedui.module.entity_passport.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`haarf.C2.2.11`	Intended-population declaration	enforced 1 unverified citation	audit_events: `kye.assurance.model_validation.v1` unverified citation engines: `internal` sector_packs: `kye:sector-pack:healthcare` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`
`haarf.C2.2.12`	Off-label / out-of-scope detection	enforced 2 unverified citations	audit_events: `kye.resilience.drift.detected.v1` unverified citation, `kye.resilience.intent_drift.v1` unverified citation engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C2.2.13`	Model provenance chain (training → fine-tune → deploy)	enforced 2 unverified citations	audit_events: `kye.assurance.model_validation.v1` unverified citation, `kye.audit.event.appended.v1` unverified citation engines: `internal`, `internal` workers: `kye-audit-chain-worker` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C2.2.14`	Model passport WORM persistence	enforced 1 unverified citation	schemas: `kye.audit.event.v1` audit_events: `kye.audit.event.appended.v1` unverified citation engines: `internal` workers: `kye-audit-chain-worker` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C2.2.15`	Model validation reports linked	enforced 1 unverified citation	audit_events: `kye.assurance.model_validation.v1` unverified citation, `kye.assurance.audit_replay_report.v1` engines: `internal` workers: `kye-conformance-runner` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`haarf.C2.2.16`	Pre-deployment validation evidence pack	enforced 1 unverified citation	audit_events: `kye.evidence.pack.v1`, `kye.assurance.model_validation.v1` unverified citation engines: `internal` workers: `kye-evidence-pack-assembler` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C2.2.17`	External audit hook (Approved Body, CE, third-party)	enforced	audit_events: `kye.assurance.audit_pilot.v1`, `kye.assurance.audit_replay_report.v1` agents: `internal` workers: `kye-audit-pilot-agent` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`haarf.C2.2.18`	Model passport machine-readable export (OSCAL / SCAP / OpenC2)	enforced 1 unverified citation	audit_events: `kye.assurance.model_validation.v1` unverified citation engines: `internal` workers: `kye-oscal-exporter` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`haarf.C2.2.19`	Pre-training risk classification	enforced 1 unverified citation	audit_events: `kye.risk_assessment.v1`, `kye.assurance.model_validation.v1` unverified citation engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C2.2.20`	Training pipeline reproducibility	enforced 1 unverified citation	audit_events: `kye.assurance.model_validation.v1` unverified citation engines: `internal` workers: `kye-replay-proof-generator` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C2.2.21`	Model dataset card published	enforced 1 unverified citation	audit_events: `kye.assurance.model_validation.v1` unverified citation engines: `internal` governedui_modules: `kye.governedui.module.entity_passport.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`haarf.C2.2.22`	Model deprecation lifecycle	enforced 1 unverified citation	audit_events: `kye.assurance.adoption_stage.v1`, `kye.assurance.model_validation.v1` unverified citation engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C2.2.23`	Model recall mechanism	enforced 1 unverified citation	audit_events: `kye.authority.grant.v1`, `kye.resilience.drift.detected.v1` unverified citation engines: `internal` workers: `kye-revocation-cascade` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C2.2.24`	Patch / re-training change-control	enforced 2 unverified citations	audit_events: `kye.assurance.model_validation.v1` unverified citation, `kye.assurance.management_review.v1` unverified citation engines: `internal`, `internal` governedui_modules: `kye.governedui.module.action_approval.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`haarf.C2.2.25`	Fine-tuning provenance disclosure	enforced 2 unverified citations	audit_events: `kye.assurance.model_validation.v1` unverified citation, `kye.audit.event.appended.v1` unverified citation engines: `internal` workers: `kye-audit-chain-worker` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C2.2.26`	Foundation-model parent declaration	enforced 1 unverified citation	audit_events: `kye.assurance.model_validation.v1` unverified citation engines: `internal` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`
`haarf.C2.2.27`	Model passport signing	enforced 1 unverified citation	audit_events: `kye.evidence.signature.v1` unverified citation engines: `internal`, `internal` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C2.2.28`	Model passport public verifier	enforced 1 unverified citation	audit_events: `kye.evidence.replay_proof.v1` unverified citation engines: `internal` workers: `kye-replay-proof-generator` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C2.2.29`	Cross-model lineage graph	enforced 1 unverified citation	audit_events: `kye.assurance.model_validation.v1` unverified citation engines: `internal`, `internal` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`
`haarf.C2.2.30`	Sector-specific model passport extensions	enforced	engines: `internal` sector_packs: `kye:sector-pack:healthcare` constitution_refs: `constitution/29-PROFILES-LITE.md`
`haarf.C2.2.31`	Approved-Body assessment evidence linkage	enforced	audit_events: `kye.assurance.audit_pilot.v1`, `kye.evidence.pack.v1` agents: `internal` workers: `kye-audit-pilot-agent` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`haarf.C2.2.32`	Substantial-change re-assessment trigger	enforced 2 unverified citations	audit_events: `kye.resilience.drift.detected.v1` unverified citation, `kye.assurance.model_validation.v1` unverified citation engines: `internal` workers: `kye-drift-detector` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C2.2.33`	Model passport history (append-only)	enforced 1 unverified citation	audit_events: `kye.audit.event.appended.v1` unverified citation engines: `internal` workers: `kye-audit-chain-worker` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C2.2.34`	Inference-time model passport reference	enforced 1 unverified citation	audit_events: `kye.evidence.decision_map.v1`, `kye.assurance.model_validation.v1` unverified citation engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C3.3.1`	TLS-everywhere on agent traffic	enforced	engines: `internal` workers: `kye-gateway` probes: `tls-valid` constitution_refs: `constitution/16-EDGE-RUNTIME.md`
`haarf.C3.3.2`	Authentication on every privileged action	enforced 1 unverified citation	audit_events: `kye.authority.grant.v1`, `kye.authority.decision.v1` unverified citation engines: `internal`, `internal` workers: `kye-pdp` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C3.3.3`	Step-up authentication for high-risk actions	enforced	engines: `internal` governedui_modules: `kye.governedui.module.action_approval.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`haarf.C3.3.4`	Secret rotation cadence	enforced	audit_events: `kye.compliance.attestation.v1` engines: `internal`, `internal` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C3.3.5`	Least-privilege scope per agent	enforced 1 unverified citation	audit_events: `kye.authority.grant.v1`, `kye.purpose.scope.v1` unverified citation engines: `internal`, `internal` workers: `kye-pdp` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C3.3.6`	Prompt-injection defence	enforced 1 unverified citation	audit_events: `kye.resilience.intent_drift.v1` unverified citation, `kye.agency_drift.event.v1` engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C3.3.7`	Output sanitisation / filtering	enforced 1 unverified citation	audit_events: `kye.evidence.synthetic_content_label.v1` unverified citation, `kye.decision.record.v1` engines: `internal`, `internal` constitution_refs: `constitution/37-EVENT-ENGINE.md`
`haarf.C3.3.8`	Adversarial-prompt logging	enforced 1 unverified citation	audit_events: `kye.audit.event.v1`, `kye.audit.event.appended.v1` unverified citation engines: `internal` workers: `kye-audit-chain-worker` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C3.3.9`	Rate-limiting per actor	enforced	engines: `internal` workers: `kye-rate-limiter` constitution_refs: `constitution/16-EDGE-RUNTIME.md`
`haarf.C3.3.10`	Anomaly detection on agent behaviour	enforced 1 unverified citation	audit_events: `kye.agency_drift.event.v1`, `kye.resilience.drift.detected.v1` unverified citation engines: `internal`, `internal` workers: `kye-incident-detector` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C3.3.11`	Incident response runbook	enforced	audit_events: `kye.audit.event.v1` engines: `internal` workers: `kye-incident-detector` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C3.3.12`	Audit logs encrypted at rest	enforced 1 unverified citation	audit_events: `kye.audit.event.appended.v1` unverified citation engines: `internal`, `internal` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C3.3.13`	Audit logs tamper-evident	enforced 2 unverified citations	schemas: `kye.audit.event.v1` audit_events: `kye.audit.event.appended.v1` unverified citation, `kye.audit.integrity_check.v1` unverified citation engines: `internal` workers: `kye-audit-chain-worker` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C3.3.14`	Tool-call sandboxing	enforced	audit_events: `kye.evidence.tool_call.v1` engines: `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C3.3.15`	Network egress controls	enforced	engines: `internal`, `internal` workers: `kye-edge-arbiter` constitution_refs: `constitution/25-EDGE-GOVERNANCE.md`
`haarf.C3.3.16`	Supply-chain verification (SBOM, signature)	enforced 1 unverified citation	audit_events: `kye.evidence.signature.v1` unverified citation engines: `internal` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C3.3.17`	Vulnerability scanning	enforced	audit_events: `kye.audit.event.v1` engines: `internal` workers: `kye-self-audit-daemon` constitution_refs: `constitution/44-LIVENESS-ENGINE.md`
`haarf.C3.3.18`	Penetration test cadence	enforced 1 unverified citation	audit_events: `kye.assurance.threat_model.v1` unverified citation engines: `internal` agents: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C3.3.19`	Break-glass procedure	enforced 1 unverified citation	audit_events: `kye.break_glass.event.v1` unverified citation, `kye.authority.grant.v1` engines: `internal`, `internal` governedui_modules: `kye.governedui.module.action_approval.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`haarf.C3.3.20`	Kill-switch per agent	enforced 1 unverified citation	audit_events: `kye.agent.killed.v1` unverified citation, `kye.authority.grant.v1` engines: `internal` workers: `kye-revocation-cascade` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C3.3.21`	DDoS protection	enforced	engines: `internal` workers: `kye-gateway` constitution_refs: `constitution/16-EDGE-RUNTIME.md`
`haarf.C3.3.22`	Logging streamed to SIEM	enforced 1 unverified citation	audit_events: `kye.audit.event.appended.v1` unverified citation engines: `internal` workers: `kye-siem-export` constitution_refs: `constitution/35-STREAMING-LOGS.md`
`haarf.C3.3.23`	Crypto-agility (algorithm rotation)	designed	engines: `internal`, `internal` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C3.3.24`	BYOK / HYOK support	enforced	engines: `internal`, `internal` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C3.3.25`	Sensitive-data classification	enforced 1 unverified citation	audit_events: `kye.evidence.audit_event.v1` unverified citation engines: `internal` agents: `internal` dictionaries: `internal`, `internal` constitution_refs: `constitution/31-DATA-GOVERNANCE-PACK.md`
`haarf.C3.3.26`	Personal-data minimisation	enforced 2 unverified citations	audit_events: `kye.purpose.scope.v1` unverified citation, `kye.purpose.restrictions.v1` unverified citation engines: `internal` constitution_refs: `constitution/31-DATA-GOVERNANCE-PACK.md`
`haarf.C3.3.27`	Data-residency controls	enforced	engines: `internal` constitution_refs: `constitution/25-EDGE-GOVERNANCE.md`
`haarf.C3.3.28`	Offline-evidence handling	enforced 1 unverified citation	audit_events: `kye.evidence.audit_event.v1` unverified citation engines: `internal` workers: `kye-offline-evidence-log` constitution_refs: `constitution/25-EDGE-GOVERNANCE.md`
`haarf.C3.3.29`	Tenant isolation	enforced	engines: `internal`, `internal` workers: `kye-gateway` constitution_refs: `constitution/25-EDGE-GOVERNANCE.md`
`haarf.C3.3.30`	Continuous control monitoring	enforced	audit_events: `kye.compliance.attestation.v1`, `kye.signal.compliance_card.refreshed.v1` workers: `kye-compliance-card-refresh` reconcilers: `pages-bindings-alive`, `worker-deploy-alive` constitution_refs: `constitution/34-RECONCILIATION-ENGINE.md`
`haarf.C3.3.31`	Backup + restore drill	enforced	audit_events: `kye.audit.event.v1` engines: `internal` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C3.3.32`	Disaster-recovery RTO/RPO targets	designed	audit_events: `kye.audit.event.v1` constitution_refs: `constitution/16-EDGE-RUNTIME.md`
`haarf.C3.3.33`	Subprocessor inventory	enforced	schemas: `kye.subprocessor.v1` engines: `internal` constitution_refs: `constitution/31-DATA-GOVERNANCE-PACK.md`
`haarf.C3.3.34`	Security-headers verification	enforced	engines: `internal` workers: `kye-gateway` probes: `security-headers` constitution_refs: `constitution/44-LIVENESS-ENGINE.md`
`haarf.C3.3.35`	Insider-threat detection (silent compromise)	enforced 1 unverified citation	audit_events: `kye.agency_drift.event.v1`, `kye.resilience.drift.detected.v1` unverified citation engines: `internal` agents: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C4.4.1`	Human-in-the-loop for high-risk decisions	enforced 1 unverified citation	audit_events: `kye.decision.record.v1`, `kye.decision.commit_boundary.v1` unverified citation engines: `internal`, `internal` governedui_modules: `kye.governedui.module.action_approval.v1`, `kye.governedui.module.approval_queue.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`haarf.C4.4.2`	Two-person sign-off on irreversible action	enforced 1 unverified citation	audit_events: `kye.assurance.management_review.v1` unverified citation engines: `internal` governedui_modules: `kye.governedui.module.action_approval.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`haarf.C4.4.3`	Clinician override mechanism	enforced 1 unverified citation	audit_events: `kye.decision.record.v1`, `kye.break_glass.event.v1` unverified citation engines: `internal` governedui_modules: `kye.governedui.module.critical_point_review.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`haarf.C4.4.4`	Override audit + reason capture	enforced 1 unverified citation	audit_events: `kye.decision.record.v1`, `kye.audit.event.appended.v1` unverified citation engines: `internal` workers: `kye-audit-chain-worker` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C4.4.5`	Accountability chain (who-approved-what)	enforced 3 unverified citations	audit_events: `kye.audit.event.appended.v1` unverified citation, `kye.assurance.management_review.v1` unverified citation, `kye.authority.delegation.v1` unverified citation engines: `internal` workers: `kye-audit-chain-worker` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C4.4.6`	Role-based access control	enforced	audit_events: `kye.authority.grant.v1` engines: `internal`, `internal` workers: `kye-pdp` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C4.4.7`	Purpose-bounded data processing	enforced 1 unverified citation	audit_events: `kye.purpose.grant.v1`, `kye.purpose.admission.v1` unverified citation, `kye.purpose.request.v1` engines: `internal` workers: `kye-pdp` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C4.4.8`	Decision Map™ visible to authorised reviewer	enforced	audit_events: `kye.evidence.decision_map.v1` engines: `internal`, `internal` governedui_modules: `kye.governedui.module.evidence_timeline.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`haarf.C4.4.9`	Evidence Pack™ downloadable on demand	enforced	audit_events: `kye.evidence.pack.v1` engines: `internal` workers: `kye-evidence-pack-assembler` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`haarf.C4.4.10`	Replay-Proof verification (public-key only)	enforced 1 unverified citation	audit_events: `kye.evidence.replay_proof.v1` unverified citation, `kye.replay.context_seal.v1` engines: `internal` workers: `kye-replay-proof-generator` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C4.4.11`	User-facing AI disclosure	enforced 1 unverified citation	audit_events: `kye.consent.receipt.v1` unverified citation engines: `internal` comms_templates: `expert-review.brief.v1` constitution_refs: `constitution/38-COMMS-RAIL.md`
`haarf.C4.4.12`	Patient consent capture	designed 1 unverified citation	audit_events: `kye.consent.acceptance.v1`, `kye.consent.receipt.v1` unverified citation sector_packs: `kye:sector-pack:healthcare` constitution_refs: `constitution/31-DATA-GOVERNANCE-PACK.md`
`haarf.C4.4.13`	Clinician training attestation	enforced	audit_events: `kye.compliance.attestation.v1` agents: `internal` workers: `kye-training-agent` constitution_refs: `constitution/10-PARTNER.md`
`haarf.C4.4.14`	Continuous-clinician feedback loop	enforced	audit_events: `kye.resilience.improvement_record.v1`, `kye.resilience.loop_iteration.v1` engines: `internal` governedui_modules: `kye.governedui.module.evidence_timeline.v1` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C4.4.15`	Escalation path for disputed decisions	enforced 1 unverified citation	audit_events: `kye.decision.record.v1`, `kye.assurance.management_review.v1` unverified citation engines: `internal` governedui_modules: `kye.governedui.module.critical_point_review.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`haarf.C4.4.16`	Patient-rights notice	designed 1 unverified citation	audit_events: `kye.consent.receipt.v1` unverified citation comms_templates: `audit-pilot.applicant-confirmation.v1` constitution_refs: `constitution/38-COMMS-RAIL.md`
`haarf.C4.4.17`	DSAR (data-subject-access) handling	enforced	agents: `internal`, `internal` workers: `kye-dsar-agent`, `kye-dsar-evidence-agent` constitution_refs: `constitution/31-DATA-GOVERNANCE-PACK.md`
`haarf.C4.4.18`	Right to human review	enforced 1 unverified citation	audit_events: `kye.decision.record.v1`, `kye.assurance.management_review.v1` unverified citation engines: `internal` governedui_modules: `kye.governedui.module.critical_point_review.v1`, `kye.governedui.module.action_approval.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`haarf.C4.4.19`	Right to explanation	enforced	audit_events: `kye.evidence.decision_map.v1`, `kye.evidence.pack.v1` engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C4.4.20`	Right to redress	designed	audit_events: `kye.resilience.improvement_record.v1` governedui_modules: `kye.governedui.module.critical_point_review.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`haarf.C4.4.21`	Approval queue dashboard	enforced	engines: `internal` governedui_modules: `kye.governedui.module.approval_queue.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`haarf.C4.4.22`	Action-approval modes per risk-tier	enforced	audit_events: `kye.decision.record.v1` engines: `internal` governedui_modules: `kye.governedui.module.action_approval.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`haarf.C4.4.23`	Delegated authority chain	enforced 1 unverified citation	audit_events: `kye.authority.delegation.v1` unverified citation, `kye.authority.grant.v1` engines: `internal` workers: `kye-pdp` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C4.4.24`	Authority Gap detection	enforced	audit_events: `kye.authority.gap.v1` engines: `internal` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`haarf.C4.4.25`	Authority Proof Bundle™	enforced	engines: `internal` workers: `kye-authority-proof-bundle-worker` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`haarf.C4.4.26`	Authority Revocation Cascade	enforced	audit_events: `kye.authority.grant.v1` engines: `internal`, `internal` workers: `kye-revocation-cascade`, `kye-authority-revocation-orchestrator` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C4.4.27`	Audit-pilot delegated review	enforced	audit_events: `kye.assurance.audit_pilot.v1` agents: `internal` workers: `kye-audit-pilot-agent` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`haarf.C4.4.28`	Per-decision liability assignment	enforced 1 unverified citation	audit_events: `kye.decision.record.v1`, `kye.authority.delegation.v1` unverified citation engines: `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C4.4.29`	Conflict-of-interest disclosure	designed 1 unverified citation	audit_events: `kye.assurance.management_review.v1` unverified citation constitution_refs: `constitution/36-GOVERNEDUI.md`
`haarf.C4.4.30`	Continuous accountability monitoring	enforced	audit_events: `kye.compliance.attestation.v1`, `kye.signal.compliance_card.refreshed.v1` workers: `kye-compliance-card-refresh` constitution_refs: `constitution/34-RECONCILIATION-ENGINE.md`
`haarf.C4.4.31`	Documented chain-of-command	enforced 1 unverified citation	audit_events: `kye.authority.delegation.v1` unverified citation engines: `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C4.4.32`	Liability insurance evidence	deferred	engines: `internal` constitution_refs: `constitution/31-DATA-GOVERNANCE-PACK.md`
`haarf.C4.4.33`	Patient-safety officer sign-off	enforced 1 unverified citation	audit_events: `kye.assurance.management_review.v1` unverified citation engines: `internal` governedui_modules: `kye.governedui.module.action_approval.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`haarf.C4.4.34`	Regulator notification on serious incident	enforced	audit_events: `kye.audit.event.v1` engines: `internal` workers: `kye-webhook-dispatcher` comms_templates: `audit-pilot.admin-alert.v1` constitution_refs: `constitution/38-COMMS-RAIL.md`
`haarf.C4.4.35`	Investigator support evidence pack	enforced	audit_events: `kye.evidence.pack.v1` engines: `internal` workers: `kye-evidence-pack-assembler` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`haarf.C4.4.36`	Healthcare-org accountable executive register	enforced 1 unverified citation	audit_events: `kye.assurance.management_review.v1` unverified citation engines: `internal` governedui_modules: `kye.governedui.module.entity_passport.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`haarf.C4.4.37`	Third-party verifier read-access	enforced	agents: `internal` workers: `kye-audit-pilot-agent` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`haarf.C4.4.38`	Public attestation page	enforced 1 unverified citation	audit_events: `kye.compliance.attestation.v1`, `kye.report.annual_conformance_attestation.v1` unverified citation workers: `kye-compliance-card-refresh` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C5.5.1`	Agent unique identity (kye:agent:<...>)	enforced	engines: `internal`, `internal` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md` registries: `internal`
`haarf.C5.5.2`	Agent passport published	enforced	engines: `internal` governedui_modules: `kye.governedui.module.entity_passport.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`haarf.C5.5.3`	Agent class declaration (advisory / autonomous)	enforced	audit_events: `kye.assurance.adoption_stage.v1`, `kye.authority.grant.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C5.5.4`	Agent scope binding to authority	enforced 1 unverified citation	audit_events: `kye.authority.grant.v1`, `kye.purpose.scope.v1` unverified citation engines: `internal`, `internal` workers: `kye-pdp` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C5.5.5`	Agent registration in central directory	enforced	engines: `internal` reconcilers: `agent-manifest-alive` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md` registries: `internal`
`haarf.C5.5.6`	Agent passport WORM persistence	enforced 1 unverified citation	schemas: `kye.audit.event.v1` audit_events: `kye.audit.event.appended.v1` unverified citation engines: `internal` workers: `kye-audit-chain-worker` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C5.5.7`	Agent metadata: capability + risk + autonomy	enforced	audit_events: `kye.assurance.adoption_stage.v1`, `kye.risk_assessment.v1` engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C5.5.8`	Agent owner / responsible party declared	enforced 2 unverified citations	audit_events: `kye.assurance.management_review.v1` unverified citation, `kye.authority.delegation.v1` unverified citation engines: `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C5.5.9`	Agent lifecycle stage tracking	enforced	audit_events: `kye.assurance.adoption_stage.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C5.5.10`	Agent retirement marker	enforced 1 unverified citation	audit_events: `kye.agent.killed.v1` unverified citation, `kye.authority.grant.v1` engines: `internal` workers: `kye-revocation-cascade` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C5.5.11`	Agent re-registration on substantial change	enforced 1 unverified citation	audit_events: `kye.assurance.adoption_stage.v1`, `kye.resilience.drift.detected.v1` unverified citation engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C5.5.12`	Agent inventory machine-readable	enforced	engines: `internal` reconcilers: `agent-manifest-alive` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md` registries: `internal`
`haarf.C5.5.13`	Agent inventory regulator export	designed	engines: `internal` workers: `kye-oscal-exporter` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`haarf.C5.5.14`	Authority Grant per agent	enforced	audit_events: `kye.authority.grant.v1` engines: `internal` workers: `kye-pdp` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C5.5.15`	Authority Grant revocation cascade	enforced	audit_events: `kye.authority.grant.v1` engines: `internal`, `internal` workers: `kye-revocation-cascade`, `kye-authority-revocation-orchestrator` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C5.5.16`	Agent purpose binding	enforced 1 unverified citation	audit_events: `kye.purpose.grant.v1`, `kye.purpose.binding.v1` unverified citation engines: `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C5.5.17`	Tenant-scoped agent registration	enforced	engines: `internal`, `internal` workers: `kye-gateway` constitution_refs: `constitution/25-EDGE-GOVERNANCE.md`
`haarf.C5.5.18`	Agent runtime attestation	enforced 1 unverified citation	audit_events: `kye.compliance.attestation.v1`, `kye.agent.run.v1` unverified citation workers: `kye-compliance-card-refresh` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C5.5.19`	Agent identity signing	enforced 1 unverified citation	audit_events: `kye.evidence.signature.v1` unverified citation engines: `internal`, `internal` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C5.5.20`	Agent capability manifest	enforced	audit_events: `kye.authority.grant.v1` engines: `internal` dictionaries: `internal` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`
`haarf.C5.5.21`	Cross-agent dependency graph	designed	engines: `internal`, `internal` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`
`haarf.C5.5.22`	Agent versioning	enforced	audit_events: `kye.assurance.adoption_stage.v1` engines: `internal` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`
`haarf.C5.5.23`	Agent deployment audit	enforced 1 unverified citation	audit_events: `kye.audit.event.appended.v1` unverified citation, `kye.assurance.adoption_stage.v1` engines: `internal` workers: `kye-audit-chain-worker` reconcilers: `worker-deploy-alive` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C5.5.24`	Agent retirement audit	enforced 2 unverified citations	audit_events: `kye.agent.killed.v1` unverified citation, `kye.audit.event.appended.v1` unverified citation engines: `internal`, `internal` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C5.5.25`	Agent reputation score	enforced	audit_events: `kye.compliance.attestation.v1` engines: `internal` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`
`haarf.C5.5.26`	Agent compliance card per agent	enforced 1 unverified citation	audit_events: `kye.assurance.compliance_card.v1` unverified citation, `kye.signal.compliance_card.refreshed.v1` workers: `kye-compliance-card-refresh` constitution_refs: `constitution/34-RECONCILIATION-ENGINE.md`
`haarf.C5.5.27`	Public discoverability (where required)	designed	engines: `internal` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`
`haarf.C5.5.28`	Cross-jurisdiction registration support	designed	engines: `internal`, `internal` constitution_refs: `constitution/25-EDGE-GOVERNANCE.md`
`haarf.C5.5.29`	Agent passport API	enforced	engines: `internal` workers: `kye-gateway` constitution_refs: `constitution/16-EDGE-RUNTIME.md`
`haarf.C5.5.30`	Onboarding agent	enforced	agents: `internal` workers: `kye-onboarding-agent` comms_templates: `onboarding-agent.pilot-approved.v1`, `onboarding-agent.commercial-menu.v1` constitution_refs: `constitution/38-COMMS-RAIL.md`
`haarf.C6.6.1`	Autonomy ladder (advisory / supervised / autonomous / fully autonomous)	enforced	audit_events: `kye.assurance.adoption_stage.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C6.6.2`	Commit-boundary control	enforced 1 unverified citation	audit_events: `kye.decision.commit_boundary.v1` unverified citation engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C6.6.3`	Shadow Mode (observe-without-effect)	enforced	audit_events: `kye.decision.shadow_evaluation.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C6.6.4`	Graduated autonomy progression	enforced	audit_events: `kye.assurance.adoption_stage.v1` engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C6.6.5`	Autonomy rollback mechanism	enforced	audit_events: `kye.assurance.adoption_stage.v1`, `kye.authority.grant.v1` engines: `internal`, `internal` workers: `kye-revocation-cascade` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C6.6.6`	Automated drift detection	enforced 2 unverified citations	audit_events: `kye.resilience.drift.detected.v1` unverified citation, `kye.resilience.intent_drift.v1` unverified citation engines: `internal` workers: `kye-drift-detector` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C6.6.7`	Agency-drift event	enforced	schemas: `kye.agency_drift.event.v1` audit_events: `kye.agency_drift.event.v1` engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C6.6.8`	Authority gap detection	enforced	audit_events: `kye.authority.gap.v1` engines: `internal` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`haarf.C6.6.9`	Guard recommendation engine	enforced	audit_events: `kye.operating_model.guard_recommendation.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C6.6.10`	Resilience Loop (detect → revoke → re-grant → replay → improve)	enforced 1 unverified citation	audit_events: `kye.resilience.loop.v1` unverified citation, `kye.resilience.loop_iteration.v1`, `kye.resilience.improvement_record.v1` engines: `internal`, `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C6.6.11`	Authority scope minimisation	enforced 1 unverified citation	audit_events: `kye.authority.grant.v1`, `kye.purpose.scope.v1` unverified citation engines: `internal`, `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C6.6.12`	Time-bounded authority	enforced	audit_events: `kye.authority.grant.v1`, `kye.compliance.attestation.v1` engines: `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C6.6.13`	Action-budget envelope	enforced 1 unverified citation	audit_events: `kye.authority.grant.v1`, `kye.meter.decision.v1` unverified citation engines: `internal` workers: `kye-rate-limiter` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C6.6.14`	Cost-budget envelope	enforced 1 unverified citation	audit_events: `kye.meter.decision.v1` unverified citation engines: `internal` workers: `kye-stripe-meter` constitution_refs: `constitution/16-EDGE-RUNTIME.md`
`haarf.C6.6.15`	Decision-budget envelope	enforced 1 unverified citation	audit_events: `kye.meter.decision.v1` unverified citation engines: `internal`, `internal` constitution_refs: `constitution/16-EDGE-RUNTIME.md`
`haarf.C6.6.16`	Anomaly-triggered authority freeze	enforced	audit_events: `kye.agency_drift.event.v1`, `kye.authority.grant.v1` engines: `internal`, `internal` workers: `kye-revocation-cascade` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C6.6.17`	Periodic authority re-confirmation	enforced 1 unverified citation	audit_events: `kye.purpose.reconfirmation.v1` unverified citation, `kye.compliance.attestation.v1` engines: `internal`, `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C6.6.18`	Multi-agent coordination governance	enforced	audit_events: `kye.agent.workflow.v1` engines: `internal` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`
`haarf.C6.6.19`	Autonomy-aware authority decision	enforced 1 unverified citation	audit_events: `kye.authority.decision.v1` unverified citation, `kye.assurance.adoption_stage.v1` engines: `internal`, `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C6.6.20`	Resilience loop iteration metrics	enforced 1 unverified citation	audit_events: `kye.resilience.loop_iteration.v1`, `kye.resilience.measurement_record.v1` unverified citation engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C6.6.21`	Improvement record per loop	enforced 1 unverified citation	audit_events: `kye.resilience.improvement.v1` unverified citation, `kye.resilience.improvement_record.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C6.6.22`	Suppression-reason capture	enforced 1 unverified citation	audit_events: `kye.resilience.suppression_reason.v1` unverified citation engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C6.6.23`	Adoption-stage gating	enforced	audit_events: `kye.assurance.adoption_stage.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C6.6.24`	Goal-coherence verification	enforced 1 unverified citation	audit_events: `kye.resilience.intent_drift.v1` unverified citation engines: `internal` workers: `kye-meaning-continuity-evaluator` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C6.6.25`	Out-of-scope action blocking	enforced 1 unverified citation	audit_events: `kye.authority.gate.v1` unverified citation, `kye.signal.decision.denied.v1` engines: `internal` workers: `kye-pdp` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C6.6.26`	Decision-map for every autonomous action	enforced	audit_events: `kye.evidence.decision_map.v1` engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C6.6.27`	Autonomy-class compliance attestation	enforced	audit_events: `kye.compliance.attestation.v1`, `kye.assurance.adoption_stage.v1` workers: `kye-compliance-card-refresh` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C6.6.28`	Reality-coupling check	enforced 1 unverified citation	audit_events: `kye.resilience.intent_drift.v1` unverified citation engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C6.6.29`	Authority delegation transparency	enforced 1 unverified citation	audit_events: `kye.authority.delegation.v1` unverified citation engines: `internal` workers: `kye-pdp` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C6.6.30`	Self-governance attestation (governance-of-governance)	enforced 1 unverified citation	audit_events: `kye.compliance.attestation.v1`, `kye.constitution.compliance.v1` unverified citation engines: `internal` constitution_refs: `constitution/45-SELF-DESCRIPTION-GATE.md`
`haarf.C6.6.31`	Authority audit replay	enforced	audit_events: `kye.assurance.audit_replay_report.v1`, `kye.replay.proof.v1` engines: `internal`, `internal` workers: `kye-audit-replay-orchestrator` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C6.6.32`	Authority compliance attestation seat (per-seat)	enforced	audit_events: `kye.compliance.attestation.v1` workers: `kye-compliance-card-refresh` constitution_refs: `constitution/23-BILLING-METERING.md`
`haarf.C6.6.33`	Per-decision risk score	enforced	audit_events: `kye.risk_assessment.v1`, `kye.decision.record.v1` engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C6.6.34`	Off-ladder action blocking	enforced 1 unverified citation	audit_events: `kye.authority.gate.v1` unverified citation, `kye.assurance.adoption_stage.v1` engines: `internal` workers: `kye-pdp` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C6.6.35`	Sector-specific autonomy policy	enforced	engines: `internal` workers: `kye-rules-gateway-worker` sector_packs: `kye:sector-pack:healthcare` constitution_refs: `constitution/29-PROFILES-LITE.md`
`haarf.C7.7.1`	Pre-deployment bias audit	enforced 1 unverified citation	audit_events: `kye.risk_assessment.v1`, `kye.assurance.model_validation.v1` unverified citation engines: `internal`, `internal` constitution_refs: `constitution/20-ANALYTICS-PLANE.md`
`haarf.C7.7.2`	Sub-population performance metrics	enforced 1 unverified citation	audit_events: `kye.assurance.model_validation.v1` unverified citation engines: `internal`, `internal` sector_packs: `kye:sector-pack:healthcare` constitution_refs: `constitution/20-ANALYTICS-PLANE.md`
`haarf.C7.7.3`	Demographic-disparity monitoring	enforced 2 unverified citations	audit_events: `kye.resilience.drift.detected.v1` unverified citation, `kye.resilience.measurement_record.v1` unverified citation engines: `internal` constitution_refs: `constitution/20-ANALYTICS-PLANE.md`
`haarf.C7.7.4`	Fairness threshold per use-case	enforced	audit_events: `kye.risk_assessment.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C7.7.5`	Fairness re-assessment cadence	enforced	audit_events: `kye.compliance.attestation.v1`, `kye.risk_assessment.v1` workers: `kye-compliance-card-refresh` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C7.7.6`	Bias-incident reporting	enforced 1 unverified citation	audit_events: `kye.audit.event.v1`, `kye.resilience.drift.detected.v1` unverified citation engines: `internal` workers: `kye-incident-detector` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C7.7.7`	Equitable access (no demographic gating)	enforced 1 unverified citation	audit_events: `kye.purpose.admissibility.v1`, `kye.authority.decision.v1` unverified citation engines: `internal`, `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C7.7.8`	Protected-class detection	enforced 1 unverified citation	audit_events: `kye.evidence.audit_event.v1` unverified citation engines: `internal` agents: `internal` dictionaries: `internal` constitution_refs: `constitution/31-DATA-GOVERNANCE-PACK.md`
`haarf.C7.7.9`	Counterfactual analysis	enforced	audit_events: `kye.replay.proof.v1` engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C7.7.10`	Bias-mitigation strategy declared	designed 1 unverified citation	audit_events: `kye.assurance.model_validation.v1` unverified citation constitution_refs: `constitution/20-ANALYTICS-PLANE.md`
`haarf.C7.7.11`	Demographic-representative test set	enforced 1 unverified citation	audit_events: `kye.assurance.model_validation.v1` unverified citation engines: `internal` workers: `kye-conformance-runner` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C7.7.12`	Outcome-equity dashboard	enforced 2 unverified citations	audit_events: `kye.report.quarterly_drift.v1` unverified citation, `kye.report.monthly_decision_summary.v1` unverified citation engines: `internal` constitution_refs: `constitution/20-ANALYTICS-PLANE.md`
`haarf.C7.7.13`	Bias-incident response runbook	enforced	audit_events: `kye.audit.event.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C7.7.14`	Public bias-transparency report	enforced 1 unverified citation	audit_events: `kye.report.annual_conformance_attestation.v1` unverified citation engines: `internal` workers: `kye-reporting-worker` constitution_refs: `constitution/20-ANALYTICS-PLANE.md`
`haarf.C7.7.15`	Patient-cohort impact assessment	enforced	audit_events: `kye.risk_assessment.v1` engines: `internal` sector_packs: `kye:sector-pack:healthcare` constitution_refs: `constitution/20-ANALYTICS-PLANE.md`
`haarf.C7.7.16`	Reason-code accountability	enforced	audit_events: `kye.decision.record.v1`, `kye.signal.decision.denied.v1` engines: `internal` dictionaries: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C7.7.17`	Equitable language in outputs	enforced 1 unverified citation	audit_events: `kye.evidence.synthetic_content_label.v1` unverified citation engines: `internal` constitution_refs: `constitution/20-ANALYTICS-PLANE.md`
`haarf.C7.7.18`	Translation / multilingual support attested	designed 1 unverified citation	audit_events: `kye.assurance.model_validation.v1` unverified citation constitution_refs: `constitution/20-ANALYTICS-PLANE.md`
`haarf.C7.7.19`	Accessibility (WCAG) attestation	enforced	audit_events: `kye.compliance.attestation.v1` workers: `kye-compliance-card-refresh` constitution_refs: `constitution/03-DESIGN-MIGRATION.md`
`haarf.C7.7.20`	Patient-language disclosure	enforced 1 unverified citation	audit_events: `kye.consent.receipt.v1` unverified citation engines: `internal` comms_templates: `audit-pilot.applicant-confirmation.v1` constitution_refs: `constitution/38-COMMS-RAIL.md`
`haarf.C7.7.21`	Healthcare equity sector overlay	enforced	engines: `internal` sector_packs: `kye:sector-pack:healthcare` constitution_refs: `constitution/29-PROFILES-LITE.md`
`haarf.C7.7.22`	Fairness compliance attestation	enforced	audit_events: `kye.compliance.attestation.v1` workers: `kye-compliance-card-refresh` constitution_refs: `constitution/20-ANALYTICS-PLANE.md`
`haarf.C7.7.23`	Bias-mitigation evidence pack	enforced	audit_events: `kye.evidence.pack.v1` engines: `internal` workers: `kye-evidence-pack-assembler` constitution_refs: `constitution/20-ANALYTICS-PLANE.md`
`haarf.C7.7.24`	Demographic-data-residency	enforced	engines: `internal` constitution_refs: `constitution/25-EDGE-GOVERNANCE.md`
`haarf.C7.7.25`	Demographic-data minimisation	enforced 1 unverified citation	audit_events: `kye.purpose.scope.v1` unverified citation engines: `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C7.7.26`	Bias-drift detection	enforced 2 unverified citations	audit_events: `kye.resilience.drift.detected.v1` unverified citation, `kye.resilience.measurement_record.v1` unverified citation engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C7.7.27`	Bias-incident root-cause analysis	enforced 1 unverified citation	audit_events: `kye.assurance.audit_replay_report.v1`, `kye.resilience.improvement.v1` unverified citation engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C7.7.28`	Bias-mitigation update lifecycle	enforced 1 unverified citation	audit_events: `kye.assurance.adoption_stage.v1`, `kye.assurance.model_validation.v1` unverified citation engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C7.7.29`	Equity-board oversight	enforced 1 unverified citation	audit_events: `kye.assurance.management_review.v1` unverified citation engines: `internal` governedui_modules: `kye.governedui.module.action_approval.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`haarf.C7.7.30`	Patient-feedback bias channel	enforced	audit_events: `kye.resilience.improvement_record.v1` engines: `internal` comms_templates: `expert-review.brief.v1` constitution_refs: `constitution/38-COMMS-RAIL.md`
`haarf.C7.7.31`	Fairness conformance run	enforced 1 unverified citation	audit_events: `kye.assurance.audit_replay_report.v1`, `kye.assurance.model_validation.v1` unverified citation engines: `internal` workers: `kye-conformance-runner` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C7.7.32`	Bias-class dictionary	enforced	engines: `internal` dictionaries: `internal`, `internal` constitution_refs: `constitution/29-PROFILES-LITE.md`
`haarf.C7.7.33`	Cross-jurisdiction equity comparison	deferred	engines: `internal` constitution_refs: `constitution/20-ANALYTICS-PLANE.md`
`haarf.C7.7.34`	Clinical-effectiveness equity check	enforced 1 unverified citation	audit_events: `kye.evidence.healthcare.cdss.v1` unverified citation engines: `internal` sector_packs: `kye:sector-pack:healthcare` constitution_refs: `constitution/20-ANALYTICS-PLANE.md`
`haarf.C7.7.35`	Equity attestation to regulator	enforced 1 unverified citation	audit_events: `kye.report.annual_conformance_attestation.v1` unverified citation, `kye.compliance.attestation.v1` workers: `kye-compliance-card-refresh`, `kye-reporting-worker` constitution_refs: `constitution/20-ANALYTICS-PLANE.md`
`haarf.C8.8.1`	Tool registry (declared catalogue)	enforced	engines: `internal` dictionaries: `internal` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`
`haarf.C8.8.2`	Tool authority binding	enforced	audit_events: `kye.authority.grant.v1`, `kye.evidence.tool_call.v1` engines: `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C8.8.3`	Tool-call evidence emission	enforced	audit_events: `kye.evidence.tool_call.v1` engines: `internal` constitution_refs: `constitution/37-EVENT-ENGINE.md`
`haarf.C8.8.4`	Tool-call decision-map inclusion	enforced	audit_events: `kye.evidence.decision_map.v1`, `kye.evidence.tool_call.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C8.8.5`	MCP tool registration	enforced	engines: `internal` workers: `kye-mcp-server` reconcilers: `mcp-tool-bijection` constitution_refs: `constitution/15-MCP-AND-SDK.md`
`haarf.C8.8.6`	MCP gateway	enforced	engines: `internal` workers: `kye-mcp-server` constitution_refs: `constitution/15-MCP-AND-SDK.md`
`haarf.C8.8.7`	Tool-call authentication	enforced 1 unverified citation	audit_events: `kye.authority.decision.v1` unverified citation, `kye.evidence.tool_call.v1` engines: `internal`, `internal` workers: `kye-pdp` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C8.8.8`	Tool-call rate limiting	enforced	engines: `internal` workers: `kye-rate-limiter` constitution_refs: `constitution/16-EDGE-RUNTIME.md`
`haarf.C8.8.9`	Tool-call timeout / circuit-breaker	enforced	engines: `internal` workers: `kye-gateway` constitution_refs: `constitution/16-EDGE-RUNTIME.md`
`haarf.C8.8.10`	Tool error-handling	enforced	audit_events: `kye.evidence.tool_call.v1`, `kye.audit.event.v1` engines: `internal` constitution_refs: `constitution/46-FLOW-CONTRACTS.md`
`haarf.C8.8.11`	Tool input validation	enforced	engines: `internal`, `internal` constitution_refs: `constitution/16-EDGE-RUNTIME.md`
`haarf.C8.8.12`	Tool output validation / sanitisation	enforced 2 unverified citations	audit_events: `kye.evidence.synthetic_content_label.v1` unverified citation, `kye.evidence.audit_event.v1` unverified citation engines: `internal`, `internal` constitution_refs: `constitution/37-EVENT-ENGINE.md`
`haarf.C8.8.13`	Tool replay-proof	enforced 1 unverified citation	audit_events: `kye.evidence.replay_proof.v1` unverified citation, `kye.evidence.tool_call.v1` engines: `internal` workers: `kye-replay-proof-generator` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C8.8.14`	External-API integration audit	enforced 1 unverified citation	audit_events: `kye.evidence.tool_call.v1`, `kye.audit.event.appended.v1` unverified citation engines: `internal` workers: `kye-audit-chain-worker` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C8.8.15`	API-key rotation enforced	enforced	schemas: `kye.admin.workflow.approved.v1` audit_events: `kye.admin.api_key.issued.v1`, `kye.admin.api_key.revoked.v1` engines: `internal` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C8.8.16`	Webhook subscriber active	enforced	engines: `internal` workers: `kye-webhook-dispatcher` reconcilers: `webhook-subscriber-active` constitution_refs: `constitution/38-COMMS-RAIL.md`
`haarf.C8.8.17`	OAuth scope enforcement	enforced	audit_events: `kye.authority.grant.v1` engines: `internal`, `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C8.8.18`	Tool-call sandboxing	enforced	audit_events: `kye.evidence.tool_call.v1` engines: `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C8.8.19`	Tool-result caching governance	designed	engines: `internal` workers: `kye-gateway` constitution_refs: `constitution/16-EDGE-RUNTIME.md`
`haarf.C8.8.20`	Tool secrets never logged	enforced 1 unverified citation	audit_events: `kye.audit.event.appended.v1` unverified citation engines: `internal`, `internal` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C8.8.21`	Tool-call audit chain	enforced 1 unverified citation	audit_events: `kye.evidence.tool_call.v1`, `kye.audit.event.appended.v1` unverified citation engines: `internal` workers: `kye-audit-chain-worker` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C8.8.22`	Tool integration risk-class	enforced	audit_events: `kye.risk_assessment.v1` engines: `internal` dictionaries: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C8.8.23`	External-system access via gateway only	enforced	engines: `internal`, `internal` workers: `kye-gateway`, `kye-edge-arbiter` constitution_refs: `constitution/25-EDGE-GOVERNANCE.md`
`haarf.C8.8.24`	Connector certification	enforced	engines: `internal` agents: `internal` workers: `kye-connector-certifier`, `kye-conformance-runner` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`haarf.C8.8.25`	Subprocessor inventory	enforced	schemas: `kye.subprocessor.v1` engines: `internal` constitution_refs: `constitution/31-DATA-GOVERNANCE-PACK.md`
`haarf.C8.8.26`	Tool-call evidence pack	enforced	audit_events: `kye.evidence.pack.v1`, `kye.evidence.tool_call.v1` engines: `internal` workers: `kye-evidence-pack-assembler` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`haarf.C8.8.27`	Streaming logs (tool calls)	enforced 1 unverified citation	audit_events: `kye.audit.event.appended.v1` unverified citation engines: `internal` workers: `kye-siem-export` constitution_refs: `constitution/35-STREAMING-LOGS.md`
`haarf.C8.8.28`	Tool-call deterministic replay	enforced	audit_events: `kye.replay.proof.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C8.8.29`	Tool catalogue publish to MCP server	enforced	engines: `internal` workers: `kye-mcp-server` reconcilers: `mcp-tool-bijection` constitution_refs: `constitution/15-MCP-AND-SDK.md`
`haarf.C8.8.30`	Tool deprecation lifecycle	enforced	audit_events: `kye.assurance.adoption_stage.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C8.8.31`	Cross-tool dependency map	designed	engines: `internal` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`
`haarf.C8.8.32`	Tool-error compensating action	enforced	schemas: `kye.lifecycle.compensating.v1` audit_events: `kye.lifecycle.compensating.v1` engines: `internal` constitution_refs: `constitution/46-FLOW-CONTRACTS.md`
`haarf.C8.8.33`	Synthetic-content labelling	enforced 1 unverified citation	audit_events: `kye.evidence.synthetic_content_label.v1` unverified citation engines: `internal` constitution_refs: `constitution/37-EVENT-ENGINE.md`
`haarf.C8.8.34`	AI Call Ledger	enforced 1 unverified citation	audit_events: `kye.audit.event.appended.v1` unverified citation, `kye.evidence.tool_call.v1` engines: `internal`, `internal` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`haarf.C8.8.35`	MCP-server liveness	enforced	engines: `internal` workers: `kye-mcp-server` probes: `worker-fleet-health` constitution_refs: `constitution/44-LIVENESS-ENGINE.md`
`haarf.C8.8.36`	Tool-API contract testing	enforced	engines: `internal` workers: `kye-conformance-runner` reconcilers: `openapi-worker-routes` constitution_refs: `constitution/34-RECONCILIATION-ENGINE.md`
`haarf.C8.8.37`	Tool-action commit-boundary check	enforced 1 unverified citation	audit_events: `kye.decision.commit_boundary.v1` unverified citation, `kye.evidence.tool_call.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C8.8.38`	Webhook delivery audit	enforced	engines: `internal` workers: `kye-webhook-dispatcher` constitution_refs: `constitution/38-COMMS-RAIL.md`
`haarf.C8.8.39`	Tool-call denial reason	enforced	audit_events: `kye.signal.decision.denied.v1` engines: `internal` dictionaries: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`haarf.C8.8.40`	Tool risk-class differential policy	enforced	engines: `internal` workers: `kye-rules-gateway-worker` constitution_refs: `constitution/29-PROFILES-LITE.md`
`haarf.C8.8.41`	Cross-tool action authority check	enforced 1 unverified citation	audit_events: `kye.authority.gate.v1` unverified citation, `kye.evidence.tool_call.v1` engines: `internal` workers: `kye-pdp` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`haarf.C8.8.42`	Sector-specific tool catalogue	enforced	engines: `internal` sector_packs: `kye:sector-pack:healthcare` dictionaries: `internal` constitution_refs: `constitution/29-PROFILES-LITE.md`

Canonical KYE™ surfaces referenced on this page: Evidence Pack™ · KYE™ MCP Server · KYE™ Onboarding Agent · KYE Protocol™ · Purpose Permission · Resilience Loop · Self-Governance.