---
title: "KYE™ Audit Pilot™ — 28-day buyer playbook"
description: "A 28-day, shadow-mode-only KYE™ Audit Pilot™ from kickoff to signed pilot report. Concrete steps, named artefacts, regulatory-citation table, owner…"
url: https://kyeprotocol.com/playbooks/audit-pilot/
lang: en
source: "KYE Protocol"
---

> A 28-day, shadow-mode-only KYE™ Audit Pilot™ from kickoff to signed pilot report. Concrete steps, named artefacts, regulatory-citation table, owner…

Playbook 1 · KYE™ Audit Pilot™

# 28 days. One workflow. Signed evidence for every decision.

A KYE™ Audit Pilot™ is the lowest-risk way to evaluate KYE Protocol™. Shadow mode only — KYE™ never blocks a production action during the pilot. We instrument one named AI-agent workflow, capture an Evidence Pack™ for every decision the workflow makes for 28 days, then hand over a signed pilot report. No code change in your production paths beyond a one-line shadow probe.

## What you need to start

- One named AI-agent workflow with a measurable owner (e.g. _kyc.verify_, _payment.initiate_, _customer.discharge_, _shipment.release_).
- Read access to the workflow's inputs and outputs for the 28-day window. KYE™ never modifies the workflow's behaviour during a pilot.
- A single nominated engineering owner on your side (1–2 hours/week) and a single nominated audit / risk / compliance owner (1 hour/week).
- Signed pilot agreement (SKU `KYE-AUDIT-PILOT-001`; £35–125k depending on scope; 100% credit against first-year annual licence when converted within 60 days).

**What you do NOT need:** a production change-management ticket; legal review of authority-bearing decisions (KYE™ is shadow-mode-only during the pilot); regulator pre-approval (the protocol is open; you're capturing evidence, not changing operating posture).

## The 4-phase, 28-day flow

### Phase 1 · Days 1–3 · Kickoff & scope lock

- **Day 1.** Kickoff call. Identify the AI-agent workflow + its actor URN (`kye:agent:<tenant>:<name>`), principal URN (`kye:org:<tenant>`), and one sample of every input / output payload it handles. Cross-reference against the appropriate sector pack (banking, healthcare, payments, logistics, energy, etc.) so we know which obligations + rule packs to load.
- **Day 2.** Lock the scope artefact (`kye.audit_pilot_scope.v1`) — signed by your delivery owner + the KYE™ engagement lead. The scope names: the workflow, the rule packs to evaluate (e.g. `financial-services` + `eu-ai-act`), the sector pack to load (e.g. `banking`), the success criteria (decisions captured / day, evidence-pack pass rate, signed report by Day 28). No work begins outside this scope.
- **Day 3.** Shadow probe deployed. Your workflow calls `POST /v1/decisions/evaluate` in shadow mode (sPDP profile) on every action. The shadow call returns the verdict KYE™ _would_ have produced + the Decision Map™; your workflow ignores the response. KYE™ persists every decision to the per-tenant audit chain. _One-line code change._

### Phase 2 · Days 4–21 · Run-mode & weekly read-outs

- **Continuous.** The shadow PDP captures one row per workflow action into the per-tenant append-only WORM audit chain (D1 + object-store immutability (COMPLIANCE retention) per constitution §30). Every row carries the canonical §0.3 event family.
- **Weekly read-out (Days 7, 14, 21).** A 30-min call. We share the Authority Gap™ report — every decision the workflow took where the actor lacked a fresh, scope-aligned authority grant. These are not customer findings; they're observed gaps that would have required different handling under SR 11-7, DORA, EU AI Act, ISO 42001, or the relevant sector framework.
- **Mid-pilot review (Day 14).** Joint review of the Authority Graph™ we've reconstructed for the workflow. You see who or what is acting on behalf of whom, with what capability, under which scope, in which state — for every action the workflow took in the first 14 days.

### Phase 3 · Days 22–26 · Pilot report assembly

- **Day 22.** Capture closes. No new decisions are added to the pilot dataset after this point. The audit chain seal for the pilot window is computed.
- **Days 23–26.** The KYE™ delivery team assembles the signed pilot report — a `kye.audit_pilot_report.v1` document plus a single Evidence Pack™ bundling: the scope artefact; the full per-tenant audit chain for the window; one Authority Gap™ summary; one Decision Map™ per decision class observed; one regulatory-control cross-walk (mapped against the relevant rows in the 289 control mappings); and the conformance hash linking it all.
- Every artefact is signed Ed25519 by the engagement lead's key (KID published at `/.well-known/kye::kye_published_keys`) and timestamped against the publisher's transparency log.

### Phase 4 · Days 27–28 · Hand-over & commercial path

- **Day 27.** Pilot report delivered to your nominated owners + their executive sponsor. A 60-minute walk-through covers: the Authority Gap™ findings; how to verify each Evidence Pack™ offline using only the publisher's JWKS; the suggested next-step pilot or annual SKU; the conversion-credit math (your pilot fee credits 100% against the annual licence within 60 days).
- **Day 28.** Decision point. You commit to converting (annual licence), to a follow-on regulated-sector pilot (`KYE-REG-PILOT-001` at £125k for 56 days), or to walking with the signed pilot report and no further commitment. The Evidence Pack™ you received is yours regardless — offline-verifiable, framework-cross-walked, evidence-grade.

## What the signed report looks like

Every Audit Pilot ships the same artefact catalogue, signed end-to-end. Sample sizes scale with workflow volume but the schema is identical across pilots.

- **Cover seal** — signed `kye.audit_pilot_report.v1` with pilot URN, window, scope, signer KID, hash of bundle contents.
- **Authority Graph™ projection** — `GET /v1/graph/authority-path` output for every actor × principal pair the workflow exercised.
- **Decision Map™ per decision class** — `GET /v1/decisions/{id}/map` showing actor → principal → delegation → capability → authority → scope → state → policy → decision → audit → evidence.
- **Evidence Pack™ index** — one signed pack per decision captured in the 28-day window. Each pack is a `kye.evidence.pack.v1` bundle, R2-stored with Object Lock COMPLIANCE.
- **Authority Gap™ findings** — `kye.authority_gap.v1` rows, each with framework cross-walk (which control row in the 289 control mappings the gap would have failed against).
- **Conformance hash** — the conformance pack version (currently 1.0.0) the pilot ran against, plus the fixture pass-rate (129 / 135 conformance fixtures).
- **Replay receipt** — a `kye.replay.proof.v1` covering the pilot window so any third party can reconstruct the report deterministically from the underlying audit-chain entries.

## Honest pilot non-goals

A pilot is not a deployment. We name what an Audit Pilot does _not_ do, so you can plan downstream work honestly:

- **Does not enforce.** KYE™ returns a verdict in shadow mode and never blocks. Promotion to enforce mode is a separate engagement after the pilot.
- **Does not certify.** The pilot report is signed evidence of a captured period; KYE™ Certified™ is a separate ladder (L0 Declared → L4 Certified) involving an approved audit firm.
- **Does not regulate.** KYE™ doesn't say "you are compliant." It produces evidence; the regulator's interpretation of that evidence remains the regulator's.
- **Does not modify your workflow.** One-line shadow-probe call, in / out. No fork, no shim, no proxy.

## Next steps

- [Apply for an Audit Pilot →](https://kyeprotocol.com/pilot-apply/) — we reply within 2 business days with the commercial menu.
- [Read the Audit Pilot product page →](https://kyeprotocol.com/ai-agent-auditability/)
- [Or: how a vendor runs a conformance run →](https://kyeprotocol.com/playbooks/conformance-run/)
- [Or: how a regulator verifies a KYE-anchored decision →](https://kyeprotocol.com/playbooks/regulator-probe/)

Canonical KYE™ surfaces referenced on this page: [Audit Pilot](https://kyeprotocol.com/auditors/) · [Authority Graph™](https://kyeprotocol.com/authority-lifecycle/) · [Evidence Pack™](https://kyeprotocol.com/evidence-pack/) · [KYE™ Conformance Pack™](https://kyeprotocol.com/compliance/) · [KYE Protocol™](https://kyeprotocol.com/).