Use cases
Five situations. One record behind each.
For each: the situation, what Attesta provides, and the artifact it produces.
Customer security questionnaires
Situation
A customer's security review asks whether AI coding tools are used, which ones, and how output is reviewed. The answer today is assembled from memory and chat threads.
What Attesta provides
- A current inventory of tools and models, backed by recorded events
- Review-coverage figures you can quote and trace
- A drafting assistant whose answers cite ledger eventsPlanned
Output
- Question
- Do you use AI coding assistants?
- Answer (draft)
- Yes, in 3 of 4 repositories, from an approved list.
- Evidence
- 42 ledger events · 31 Attested · 11 Declared
- Sample data
- Illustrative excerpt, not real figures
Audits (SOC 2, ISO/IEC 27001, ISO/IEC 42001 evidence)
Situation
An auditor asks for evidence that change management applies to AI-assisted changes. Sampling means finding specific changes and proving what happened to them.
What Attesta provides
- Change-level provenance with review and check results
- Period-scoped evidence packs with ledger verification data
- Policy history showing what was enforced and when
Output
- Period
- Sample quarter
- Changes in scope
- 12 (sample)
- Policy failures
- 3, each linked to a change
- Ledger
- Verified · 60 events · 0 breaks
AI rollout governance
Situation
Leadership approved a set of AI tools and needs to know whether reality matches the approval, and where the gaps are.
What Attesta provides
- Allowlist checks against recorded tool use
- Policies run in warn mode first, then enforced
- Coverage trends by team, repository, and tool
Output
- Approved tools
- 3
- Unlisted tool seen
- 1 change (sample)
- Review on sensitive paths
- Human review required (policy on)
- Mode
- Warn
Client disclosure for IT services and GCCs
Situation
A client contract requires disclosing where AI assisted delivery. Delivery teams need to show it without exposing other clients' work or source code.
What Attesta provides
- Per-client scoping of records
- Disclosure reports built from recorded events
- Metadata and hashes only, not source code
Output
- Client scope
- Project Alpha (sample)
- AI-assisted changes
- 9 of 40 (sample)
- Reviewed by a human
- 8 of 9 (sample)
- Certainty
- Attested / Declared shown separately
M&A code diligence
Situation
A buyer asks how much of a codebase was produced with AI assistance and whether licence and review controls were applied.
What Attesta provides
- Historical provenance from the point of adoption
- Clear separation of proven, declared, and estimated
- A verifiable export a buyer's advisers can check
Output
- Coverage window
- From Attesta adoption
- Before adoption
- Not covered; stated explicitly
- Estimates
- Labelled Inferred, excluded from proof
- Verification
- Chain verifiable offline