<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width,initial-scale=1">
  <title>Agent Governance Evidence Pack - Roam</title>
  <meta name="description" content="Roam exports tamper-evident evidence for AI-agent changes: context read, accepted risks, authorizations, tests, and control mapping support.">
  <link rel="canonical" href="https://roam-code.com/governance">
  <link rel="icon" type="image/svg+xml" href="/favicon.svg">
  <meta name="theme-color" content="#0049b7">
  <meta name="apple-mobile-web-app-title" content="Roam">
  <link rel="apple-touch-icon" href="/favicon.svg">
  <link rel="manifest" href="/manifest.webmanifest">
  <link rel="preload" href="/fonts/space-grotesk-variable.woff2" as="font" type="font/woff2" crossorigin>
  <link rel="preconnect" href="//github.com" crossorigin>
  <link rel="preconnect" href="//pypi.org" crossorigin>
  <link rel="preload" href="./landing.css" as="style">
  <link rel="stylesheet" href="./landing.css">
  <meta name="robots" content="index,follow">

  <meta property="og:title" content="Agent Governance Evidence Pack — Roam">
  <meta property="og:description" content="Export tamper-evident evidence of every AI-agent code change: which agent, what context, what risks accepted, who authorized, which tests closed the loop. Evidence support — not certification.">
  <meta property="og:type" content="website">
  <meta property="og:url" content="https://roam-code.com/governance">
  <meta property="og:image" content="https://roam-code.com/og.png">
  <meta name="twitter:card" content="summary_large_image">
  <meta name="twitter:title" content="Agent Governance Evidence Pack — Roam">
  <meta name="twitter:description" content="Tamper-evident evidence for AI-agent change governance. Maps to SOC 2 CC8.1, ISO 42001, NIST AI RMF, EU AI Act Article 12 (evidence support, not certification).">
  <meta name="twitter:image" content="https://roam-code.com/og.png">

  <script type="application/ld+json">
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {"@type": "ListItem", "position": 1, "name": "Home", "item": "https://roam-code.com/"},
      {"@type": "ListItem", "position": 2, "name": "Governance", "item": "https://roam-code.com/governance"}
    ]
  }
  </script>
</head>
<body>

  <a class="skip-link" href="#main">Skip to content</a>

  <nav class="site-nav" aria-label="Main navigation">
    <div class="nav-inner">
      <a href="/" class="site-logo">roam<span class="logo-dot">.</span></a>
      <input type="checkbox" id="nav-toggle" class="nav-toggle-checkbox" aria-label="Toggle navigation menu">
      <label for="nav-toggle" class="nav-toggle-label">
        <span class="nav-burger" aria-hidden="true"></span>
        <span class="visually-hidden">Menu</span>
      </label>
      <ul class="nav-links">
        <li><a href="/">Home</a></li>
        <li><a href="/pricing">Pricing</a></li>
        <li><a href="/compare">Compare</a></li>
        <li><a href="/setup">Setup</a></li>
        <li><a href="/docs/">Docs</a></li>
        <li><a href="https://github.com/Cranot/roam-code">GitHub</a></li>
      </ul>
    </div>
  </nav>

  <main id="main">

  <!-- ──────────────────────────────────────────────────────────
       Hero
       ────────────────────────────────────────────────────────── -->
  <header class="hero">
    <div class="hero-inner">
      <p class="eyebrow">Agent Governance Evidence Pack</p>
      <h1 class="hero-headline">
        Tamper-evident proof<br>
        <strong>for every AI-agent change.</strong>
      </h1>
      <p class="hero-subhead">
        Roam exports a tamper-evident record of every agent code change:
        which agent touched what, what context it read, which risks it
        accepted vs mitigated, who authorized risky edits, and which tests
        closed the loop. The pack maps to SOC 2 CC8.1, ISO/IEC 42001,
        NIST AI RMF, and EU AI Act Article 12 controls — evidence support,
        not certification. The discipline the evidence proves is the
        <a href="/docs/agent-contract">Agent Contract</a>; this page is
        what an auditor sees.
      </p>
      <div class="hero-ctas">
        <a class="btn-primary" href="#sample">Read the sample report</a>
        <a class="btn-secondary" href="#eight-questions">See the eight questions</a>
      </div>
      <p class="hero-trust-strip">
        Built on the free Apache 2.0 CLI · Evidence stays on your machine and hash-verifies offline · Tamper-evident ledger (HMAC-chained) · Optional in-toto v1 attestation, verifiable offline with cosign
      </p>
    </div>
  </header>

  <!-- ──────────────────────────────────────────────────────────
       What you get — five evidence types
       ────────────────────────────────────────────────────────── -->
  <section class="whats-in" id="evidence">
    <div class="whats-in-inner">
      <h2>What's in the pack</h2>
      <p class="lede">
        Five evidence types, one bundle, all generated from the local
        ledger Roam already keeps when agents run against the CLI or MCP
        server under the
        <a href="/docs/agent-contract">Agent Contract</a> discipline.
        Nothing to instrument; the substrate is already in the free CLI.
      </p>
      <div class="verbs-grid verbs-grid--3">
        <div class="verb-cell">
          <code>1. Which agents changed what</code>
          <span>
            Per-run ledger: agent identity, model, session, repo SHA at
            start/end, every command executed, every file touched. Sourced
            from <code>roam runs</code> with HMAC chain verification.
          </span>
        </div>
        <div class="verb-cell">
          <code>2. What context each agent read</code>
          <span>
            Proof bundle records the symbols, files, and graph queries the
            agent consumed before editing — <code>roam preflight</code>,
            <code>roam impact</code>, <code>roam context</code> calls all
            logged with their results, timestamps, and bundle handles.
          </span>
        </div>
        <div class="verb-cell">
          <code>3. Risks accepted vs mitigated</code>
          <span>
            For each risky edit: the gate verdict (preflight blast radius,
            complexity, fitness), whether the agent acted on it or
            overrode it, and the test or critique result that supported
            the decision. <code>roam pr-bundle emit</code> closes the
            bundle with the explicit risk ledger.
          </span>
        </div>
        <div class="verb-cell">
          <code>4. Authorization trail for risky edits</code>
          <span>
            When the constitution requires human authorization
            (<code>autonomous_pr</code> mode disabled, or a policy clause
            triggered), the lease record names the human approver, the
            authorized scope, and the timestamp. Re-runs are blocked
            until a new lease is claimed.
          </span>
        </div>
        <div class="verb-cell">
          <code>5. Test closure per risk</code>
          <span>
            Each risk entry in the bundle links to the test run that
            closed it — either a pre-existing test the change preserved,
            or a new test the agent added. Bundles failing to close a
            high-severity risk are marked <code>partial_success: true</code>
            and surface in the report.
          </span>
        </div>
        <div class="verb-cell">
          <code>+ Replay narrative</code>
          <span>
            <code>roam replay &lt;run_id&gt;</code> renders the full
            transcript as a human-readable narrative — useful when a
            reviewer or auditor wants the story behind a specific PR
            without reading the raw JSON ledger.
          </span>
        </div>
      </div>
      <p class="how-it-works-foot" style="margin-top: 24px;">
        All five evidence types ship as JSON (machine-readable), Markdown
        (human-readable), and an optional in-toto v1 attestation
        (cryptographically verifiable offline with cosign).
      </p>
    </div>
  </section>

  <!-- ──────────────────────────────────────────────────────────
       The eight evidence questions
       ────────────────────────────────────────────────────────── -->
  <section class="compare" id="eight-questions">
    <div class="compare-inner">
      <h2 class="compare-h2--tight">The eight evidence questions</h2>
      <p class="lede compare-lede--tight">
        Every Roam audit answers eight axes about an AI-assisted code
        change. The pack covers all eight; the
        <a href="https://github.com/Cranot/roam-code/blob/main/templates/audit-report/sample-audit-report.md">sample report</a>
        shows worked coverage with per-axis evidence rows, and
        <a href="https://github.com/Cranot/roam-code/blob/main/templates/audit-report/evidence-checklist.md">evidence-checklist.md</a>
        names the exact command for each axis.
      </p>
      <div class="verbs-grid verbs-grid--3">
        <div class="verb-cell">
          <code>Q1. Who acted?</code>
          <span>Per-run agent identity, model, MCP client id, and git author from <code>roam runs show</code>.</span>
        </div>
        <div class="verb-cell">
          <code>Q2. What authority existed?</code>
          <span>Mode, permits, leases, and policy decisions from <code>roam mode</code>, <code>roam permit</code>, <code>roam lease</code>.</span>
        </div>
        <div class="verb-cell">
          <code>Q3. What context was read?</code>
          <span>Pre-edit commands, symbols, and files from the bundle's <code>context_read</code> block.</span>
        </div>
        <div class="verb-cell">
          <code>Q4. What changed?</code>
          <span>Diff hash, commit SHA, and affected symbols from <code>roam diff</code> + <code>roam pr-risk</code>.</span>
        </div>
        <div class="verb-cell">
          <code>Q5. What could break?</code>
          <span>Blast radius and findings from <code>roam preflight</code>, <code>roam impact</code>, <code>roam critique</code>.</span>
        </div>
        <div class="verb-cell">
          <code>Q6. What policy applied?</code>
          <span>Rules config hash, constitution hash, and policy-decision events from <code>roam runs show</code>.</span>
        </div>
        <div class="verb-cell">
          <code>Q7. What verified it?</code>
          <span>Required vs run tests from the bundle's <code>tests_required[]</code> / <code>tests_run[]</code> reconciliation.</span>
        </div>
        <div class="verb-cell">
          <code>Q8. Who accepted risk?</code>
          <span>Authorizer and accepted-risk records from the bundle's <code>approvals[]</code> / <code>accepted_risks[]</code> arrays. Approvals recorded outside the substrate surface as <code>redactions[].reason = "producer_not_available"</code>.</span>
        </div>
      </div>
    </div>
  </section>

  <!-- ──────────────────────────────────────────────────────────
       Sample report
       ────────────────────────────────────────────────────────── -->
  <section class="how-it-works" id="sample">
    <div class="how-it-works-inner">
      <h2>Sample report</h2>
      <p class="lede">
        Read the full
        <a href="https://github.com/Cranot/roam-code/blob/main/templates/audit-report/sample-audit-report.md">Governance Pack sample report</a>
        (schema <code>governance-pack/1.0</code>) for a complete deliverable
        example, with the eight-question coverage table, worked
        control-mapping, recommended next steps, and disclaimer block.
        Reproduce the same artifact extraction on your own repo with
        <a href="https://github.com/Cranot/roam-code/blob/main/templates/audit-report/evidence-checklist.md">evidence-checklist.md</a>;
        for the control map and wording-discipline rules, see
        <a href="https://github.com/Cranot/roam-code/blob/main/templates/audit-report/control-mapping-README.md">control-mapping-README.md</a>.
        The companion
        <a href="https://github.com/Cranot/roam-code/blob/main/templates/audit-report/sample-pr-replay-team.md">PR Replay sample</a>
        covers merged-history detector replay (no run ledger required).
        For a redacted draft on your repository, email
        <a href="mailto:hello@roam-code.com?subject=Governance%20Evidence%20Pack%20sample">hello@roam-code.com</a>.
      </p>
      <ol class="flow">
        <li>
          <span class="flow-num">1</span>
          <strong>Generate locally.</strong>
          Run <code>roam runs verify</code>,
          <code>roam pr-bundle emit --strict</code>, and
          <code>roam agent-score</code> against an indexed repo, then feed
          the JSON envelopes through the render template. The substrate
          lives in <code>src/roam/runs/</code>,
          <code>src/roam/pr_bundle/</code>, and
          <code>src/roam/evidence/</code>.
        </li>
        <li>
          <span class="flow-num">2</span>
          <strong>Optional founder review.</strong>
          Commission a written report against your last 30 or 90 agent
          runs the same way the
          <a href="/audit">PR Replay engagement</a> is structured.
          Same engine, same temporary-clone handling, same DPA, same
          no-training commitment.
        </li>
        <li>
          <span class="flow-num">3</span>
          <strong>Hand to your auditor.</strong>
          The pack lands as Markdown + PDF + signed JSON. The reviewer
          can verify the HMAC chain on the ledger and the cosign
          signature on each bundle without contacting us. The IP is
          yours; share it inside the audit scope without restriction.
        </li>
      </ol>
    </div>
  </section>

  <!-- ──────────────────────────────────────────────────────────
       Control mapping
       ────────────────────────────────────────────────────────── -->
  <section class="compare" id="controls">
    <div class="compare-inner">
      <h2 class="compare-h2--tight">Control mapping</h2>
      <p class="lede compare-lede--tight">
        Roam evidence to the controls auditors look for. The mapping
        documents what the pack <em>supports</em>; it does not claim
        formal conformity with any framework. Your auditor judges fit
        for your scope.
      </p>
      <div class="compare-table-wrap">
        <table class="compare-table">
          <caption class="visually-hidden">Roam evidence types mapped to SOC 2 CC8.1, ISO/IEC 42001, NIST AI RMF, and EU AI Act Article 12.</caption>
          <thead>
            <tr>
              <th scope="col">Roam evidence</th>
              <th scope="col">SOC 2 CC8.1</th>
              <th scope="col">ISO/IEC 42001</th>
              <th scope="col">NIST AI RMF</th>
              <th scope="col">EU AI Act Art. 12</th>
            </tr>
          </thead>
          <tbody>
            <tr>
              <th scope="row">Per-run ledger (HMAC-chained agent timeline)</th>
              <td>CC8.1 change tracking</td>
              <td>A.8.3 operational records</td>
              <td>Govern 1.4, Map 4.1</td>
              <td>Automatic record-keeping</td>
            </tr>
            <tr>
              <th scope="row">Proof bundle (context the agent read)</th>
              <td>CC8.1 change rationale</td>
              <td>A.6.2.2 design rationale</td>
              <td>Measure 2.8 traceability</td>
              <td>Traceability of decisions</td>
            </tr>
            <tr>
              <th scope="row">Risk ledger (accepted vs mitigated)</th>
              <td>CC3.2 risk identification</td>
              <td>A.5.4 risk treatment</td>
              <td>Manage 1.3 risk response</td>
              <td>Risk-management evidence</td>
            </tr>
            <tr>
              <th scope="row">Authorization trail (leases + mode gates)</th>
              <td>CC6.3 access authorization</td>
              <td>A.6.1.2 authorization</td>
              <td>Govern 2.1 roles</td>
              <td>Human-oversight evidence</td>
            </tr>
            <tr>
              <th scope="row">Test closure per risk</th>
              <td>CC8.1 change verification</td>
              <td>A.8.4 verification</td>
              <td>Measure 2.5 validation</td>
              <td>Post-change verification</td>
            </tr>
            <tr>
              <th scope="row">in-toto v1 attestation + cosign signature</th>
              <td>CC7.2 evidence integrity</td>
              <td>A.8.5 evidence integrity</td>
              <td>Measure 2.7 integrity</td>
              <td>Tamper-evident logs</td>
            </tr>
          </tbody>
        </table>
      </div>
      <p class="compare-foot">
        Framework references: SOC 2 Trust Services Criteria (AICPA, 2017
        with 2022 revisions); ISO/IEC 42001:2023 AI management system;
        NIST AI Risk Management Framework 1.0 (Jan 2023); EU Regulation
        2024/1689 (AI Act), Article 12 "Record-keeping". Mapping is for
        evidence support; your conformity assessment is a separate
        engagement with qualified counsel and auditors.
      </p>
    </div>
  </section>

  <!-- ──────────────────────────────────────────────────────────
       Disclaimer
       ────────────────────────────────────────────────────────── -->
  <section class="trust-strip" id="disclaimer">
    <div class="trust-strip-inner">
      <div class="trust-cell">
        <strong>Evidence support, not certification</strong>
        <span>
          Roam Code provides evidence-export and control-mapping support
          for AI-agent change governance. This is evidence support, not
          formal certification. Roam does not perform compliance
          attestation; consult qualified counsel and auditors for formal
          certification against any framework.
        </span>
      </div>
      <div class="trust-cell">
        <strong>Article 12 framing</strong>
        <span>
          EU AI Act Article 12 (record-keeping) attaches to providers of
          high-risk AI systems listed in Annex III. Code-generation
          tooling is not itself in Annex III. If your <em>own product</em>
          is a high-risk AI system, the pack's tamper-evident ledger is
          useful evidence for the Article 12 record-keeping expectation
          and the Article 14 human-oversight expectation. The
          classification call is for you and your DPO.
        </span>
      </div>
      <div class="trust-cell">
        <strong>Scope</strong>
        <span>
          The pack documents what an agent did against the local
          repository. It does not cover model-training evidence, dataset
          provenance, or production runtime behaviour. Those are outside
          Roam's measurement surface and require separate evidence.
        </span>
      </div>
      <div class="trust-cell">
        <strong>EU-based, GDPR-native</strong>
        <span>
          Built in Athens. Made in the EU. The CLI runs entirely on your
          machine; nothing leaves the local environment. See the
          <a href="/security">security policy</a>, the
          <a href="/trust">trust &amp; compliance posture page</a> for
          current certification status, DPA, and roadmap posture, the
          <a href="https://github.com/Cranot/roam-code/blob/main/templates/legal/security-procurement-packet.md">security &amp; procurement packet</a>
          for the DPA, no-training commitment, and supply-chain posture,
          and <a href="/docs/architecture">architecture docs</a> for
          what runs where. Tier pricing on <a href="/pricing">/pricing</a>.
        </span>
      </div>
    </div>
  </section>

  <!-- ──────────────────────────────────────────────────────────
       CTA
       ────────────────────────────────────────────────────────── -->
  <section class="page-cta-strip">
    <div class="page-cta-inner">
      <p>
        Commission a written Governance Evidence Pack against your last
        30 or 90 agent runs, or request a redacted sample on a real
        repository. Email
        <a href="mailto:hello@roam-code.com?subject=Governance%20Evidence%20Pack&amp;body=Hi%20%E2%80%94%20I%27d%20like%20to%20commission%20a%20Governance%20Evidence%20Pack.%0A%0ARepo%3A%20%0AAudit%20window%20%28default%3A%20last%2030%20or%2090%20agent%20runs%29%3A%20%0AFrameworks%20to%20cross-reference%20%28SOC%202%20%2F%20ISO%2042001%20%2F%20EU%20AI%20Act%20Art.%2012%20%2F%20NIST%20AI%20RMF%29%3A%20%0APreferred%20walk-through%20window%3A%20%0A%0A%E2%80%94%20">hello@roam-code.com</a>
        — same engagement shape as the
        <a href="/audit">PR Replay</a> service, same DPA, same
        no-training commitment.
      </p>
      <p class="footer-meta" style="margin-top: 12px;">
        Pricing today is per-engagement, quoted on intake; published tiers
        and a Stripe checkout path land alongside the PR Replay payment path.
      </p>
      <p class="footer-meta" style="margin-top: 12px;">
        New to Roam? Start with the
        <a href="/docs/agent-contract">Agent Contract</a> &mdash; the five
        commands that produce the evidence this pack delivers.
      </p>
    </div>
  </section>

  </main>

  <footer>
    <div class="footer-inner">
      <div class="footer-col">
        <strong>Roam</strong>
        <span>The local codebase intelligence layer for AI agents and the teams that run them.</span>
        <span class="footer-meta">Built in Athens. Made in the EU.</span>
      </div>
      <div class="footer-col">
        <a href="https://github.com/Cranot/roam-code">GitHub</a>
        <a href="https://pypi.org/project/roam-code/">PyPI</a>
        <a href="/docs/">Docs</a>
      </div>
      <div class="footer-col">
        <a href="/setup">Setup</a>
        <a href="/about">About</a>
        <a href="/press">Press</a>
        <a href="/changelog">Changelog</a>
        <a href="/status">Status</a>
        <a href="/security">Security</a>
        <a href="/accessibility">Accessibility</a>
      </div>
      <div class="footer-col">
        <a href="/privacy">Privacy</a>
        <a href="/terms">Terms</a>
        <a href="/refund">Refund</a>
        <a href="/no-cookies">No cookies</a>
      </div>
      <div class="footer-col">
        <a href="mailto:hello@roam-code.com">hello@roam-code.com</a>
        <a href="mailto:security@roam-code.com">security@roam-code.com</a>
        <span class="footer-meta">No cookies. No tracking. No analytics.</span>
        <span class="footer-meta"><a href="https://github.com/Cranot/roam-code/tree/main/templates/distribution/landing-page">This page is open source</a></span>
      </div>
    </div>
  </footer>

</body>
</html>
