DDC Snapshot
One public target, bounded read-only/static preflight, concise result and next-step guidance.
Evidence-driven systems assurance
Evidence before confidence.
DDC Assurance Lab evaluates AI, agentic, and software systems through explicit scope, adversarial verification, evidence integrity, and reproducible technical assessment.
New pilot service
Independent assurance before agreement.
DDC Independent Assurance gives multiple evaluators one frozen evidence set, keeps their determinations separate until freeze, then compares the results without erasing disagreement.
Core services
Assurance across decision, incident and execution boundaries.
Independent review
Independent AI Assurance
Separate evaluator determinations over one frozen evidence set before controlled comparison.
After an incidentIncident Reconstruction
Reconstruct action lineage, evidence timing and unresolved consequence without rewriting history.
Before and during actionRuntime & Action Assurance
Challenge authority, policy, evidence, state and execution boundaries around consequential actions.
Focused capabilities
Technical assurance where AI meets execution.
Explore DDCAL capability areas for agentic systems, public repository preflight, and software transition/conformance assessment.
AI agents
AI & agentic systems assurance
Authority, tools, state, verification and recovery boundaries for systems that can act.
Pre-executionRepository security analysis
Bounded static preflight before submitted code receives any execution authority.
ConformanceSoftware transition assurance
Exact predecessor, execution, postcondition, evidence and acceptance boundaries.
Fixed-scope services
A small paid review before a large commitment.
Start with a bounded service, pay once in Canadian dollars, and expand scope only when the evidence justifies it.
Quick Assurance Review
One eligible target with focused boundary review, prioritized findings, remediation guidance, and a concise report.
Pre-Launch Assurance
Deeper review for one eligible system, including prioritized findings and one post-fix verification cycle.
What we assess
Technical claims that need to survive challenge.
DDCAL is being built for systems where a simple demonstration or implementation claim is not enough.
Authority boundaries
Whether a system can act beyond the authority, permissions, or delegation it was intended to receive.
Implementation conformance
Whether the implemented system conforms to identified requirements, controls, or declared behaviour.
Transition assurance
Whether proposed or executed state changes are authorized, valid, bounded, and recoverable.
Evidence integrity
Whether evidence actually substantiates the conclusion and preserves provenance, lineage, and context.
Failure behaviour
How the system behaves under malformed, hostile, ambiguous, incomplete, or contradictory conditions.
Verifier independence
Whether verification is sufficiently independent from the producer’s critical assumptions and failure paths.
Assessment lifecycle
From claim to controlled conclusion.
Every assessment is bounded by defined authority, requirements, evidence, and verification conditions.
DefineAuthority, scope, requirements, and exclusions.
ChallengeTest preconditions, boundaries, and adverse paths.
ObserveCollect traceable evidence of execution and state.
VerifyCheck conclusions against independent evidence and invariants.
ReportIssue a bounded result with evidence and limitations.
Public demonstration
See what DDC notices before code is allowed to run.
Submit a public GitHub repository for a bounded, read-only static security and DDC preflight. The demo resolves an exact commit, scans selected source and configuration files, redacts secret-like values, and returns a reduced result. Submitted code is never executed.
Run the DDC demoPublic GitHub repositories only · no credentials · no code execution
Public accountability
First public worked assessment
DDCAL-PA-001 assesses Microsoft Agent Framework FIDES at exact commit edfe115ea06b… and publishes adverse findings, unresolved items, limitations and disposition.
Assessment inquiries
Start with scope, not uploads.
Initial inquiries are intentionally low-risk. Do not send confidential evidence, credentials, executables, or sensitive datasets by ordinary email.
How to request an assessment →