For a CISO
— when an agent does something it should not have, you replay the sealed decision and read the exact failed control, instead of escalating a support ticket into a closed vendor’s queue.
Don’t trust our governance. Verify it.
Most AI-governance vendors ask you to trust a closed scoring black box: opaque logic, a number you cannot reproduce, an audit trail that lives only on their dashboard. KYE Protocol™ takes the opposite stance — its schemas, ID format and examples are public, its OSS surface is Apache-2.0, and every governance decision is Replay-Proof™: you verify it offline from a published JWKS alone, with no KYE™ service in the loop. Open where it counts for trust; commercial in the engine.
Open vs Proprietary, point by point
Demo dataYou learn: The page's points, one at a time. You can: Step through them.
-
Step 1 of 4
KYE Protocol™
For a CISO
— when an agent does something it should not have, you replay the sealed decision and read the exact failed control, instead of escalating a support ticket into a closed vendor’s queue.
-
Step 2 of 4
KYE Protocol™
For a DPO
— open schemas mean you can show a supervisory authority precisely what data shaped a decision under the EU AI Act™ Article 12 logging duty and GDPR accountability — not a vendor’s paraphrase.
-
Step 3 of 4
KYE Protocol™
For counsel
— a Replay-Proof™ is admissible on its own signatures; it does not depend on a vendor staying solvent or cooperative to stand up in a dispute. Evidence Pack™
-
Step 4 of 4
KYE Protocol™
For a CFO
— an Apache-2.0 surface plus portable evidence is the opposite of lock-in: your audit trail and the contract behind it survive a vendor switch, mapped across ISO/IEC 42001™ and NIST AI RMF.
How this widget is built
- Demonstrates
- KYE Protocol™
- Components
- The points this page makes
- Flow
- Each point in order, as the page sets it out. Architecture diagram
- Used on
- /open-vs-proprietary/: On this page, after its opening.
Two answers to one question: “why should I believe your governance?”
Every governance buyer — a CISO, a DPO, counsel, a CFO — eventually asks the vendor to prove the verdict. There are only two honest answers, and they are not the same. This is a fair contrast, not a strawman: closed governance can be competent; it simply asks you to trust rather than letting you check.
Trust-me vs verify-me, in one picture
The whole argument reduces to where proof lives. In a closed system, proof is locked inside the vendor and you take the verdict on faith. In KYE Protocol™, the proof is a signature you and any third party can check against keys the vendor has already published.
What “open” honestly means here
KYE Protocol™ is not fully open-source, and we will not let this page read as if it were. Being precise about the boundary is itself part of being verifiable — overclaiming is the opposite of trustworthiness.
The honesty boundary. What is open is the vocabulary, the schemas, the URN ID format, the worked examples, and the Apache-2.0 software/constitution Kit™ — plus the public-key verifiability of every output. The runtime that actually makes admissibility decisions — the engine, the mechanisms, the patent-track internals — is commercial. So the claim is narrow and true: open where it counts for trust (the schemas you read and the proofs you check), commercial in the engine that earns its keep. KYE Protocol™ is not a fully open-source product, and a page about transparency should say so plainly.
Why this split is the trustworthy one: you do not need the engine’s source to trust a decision — you need to read the contract it was shaped by and re-check the proof it emitted. KYE™ opens exactly those two surfaces and keeps the engine commercial, rather than open-washing the parts that do not affect whether you can verify the result.
Why a CISO, a DPO, counsel and a CFO each prefer verifiable
Verifiability is not a developer nicety — it changes what each buyer can defend. One open, replay-proof contract serves four very different questions.
For a DPO
— open schemas mean you can show a supervisory authority precisely what data shaped a decision under the EU AI Act™ Article 12 logging duty and GDPR accountability — not a vendor’s paraphrase.
For counsel
— a Replay-Proof™ is admissible on its own signatures; it does not depend on a vendor staying solvent or cooperative to stand up in a dispute. Evidence Pack™
For a CFO
— an Apache-2.0 surface plus portable evidence is the opposite of lock-in: your audit trail and the contract behind it survive a vendor switch, mapped across ISO/IEC 42001™ and NIST AI RMF.