Evidence / public and bounded
What can developers verify about NEES?
Product documentation and a synthetic demonstration are useful but not the same as an independent security review or a validated external side effect. This page separates what can be inspected from what still requires a complete integration test.
Governance Lab — synthetic and bounded
Visitors can submit bounded synthetic scenarios and inspect visible governance facts and, when the hosted service responds, the returned decision and available evidence. This does not send real email, transfer funds or execute arbitrary external tools.
The website's separate Safe Synthetic Execution Proof is not represented as a completed public execution test until its hosted acceptance is separately verified.
V3 SDK and public contracts
The Python SDK's published package metadata and public usage documentation can be inspected without an account. They provide client contracts, not source-level audit access to the private governance engine or a guarantee of hosted production behavior.
Internal integration learnings
NainaSOS desktop integration has illustrated a distinction between NEES authorization and real execution: a permitted typing operation did not proceed when the observed foreground application was not the expected target. This is an internally reported application-boundary case, not an independently reproduced certification.
Governance Lab experiments use supported synthetic action facts. Internal test counts or hosted smoke tests are scope-limited and should never be extrapolated into universal safety guarantees.
What remains to validate
- An unaided, freshly enrolled Free account completing the registered-action lifecycle end to end.
- Every Free plan quota boundary under hosted conditions.
- Specific deployment/version support for each REST, Gateway, MCP and framework integration.
- Independent adversarial evaluation, measured latency/throughput, service availability, and data-handling assurance.
Do not describe this list as missing features: some are missing independent evidence, some require deployment acceptance, and some are not publicly promised.
Help make the evidence stronger
Developers and researchers can challenge a bounded scenario, inspect the documented boundary, report any mismatch and share reproducible results. Do not include credentials, production policy commitments, personal data or sensitive traces.