This is not an illustration. It is a real signed artifact, reproduced field-for-field. The verdict is empirical and bounded; the coverage statement names what was tested and what was not; the signature verifies against the published key with no cooperation from RTK Security Labs. You can confirm every claim on this page yourself.
Empirical, bounded strictly to what was tested. Not a claim of architectural impossibility outside the declared surface.
Reproduced verbatim from the artifact's coverage_statement field. The second paragraph — what is not covered — is part of the signed artifact, not a disclaimer added afterward.
The artifact carries a compliance-mapping field. Below are the mappings this artifact actually populates. Frameworks the artifact does not assert are shown as not asserted — because an empty mapping is honest information, and claiming coverage an artifact does not carry is exactly the failure mode RTK-1 is built to avoid.
| Framework | Asserted in this artifact |
|---|---|
| MITRE ATLAS | AML.T0051, AML.T0054 |
| OWASP LLM Top 10 | LLM01, LLM02, LLM06, LLM08 |
| NIST AI RMF | GOVERN, MAP, MEASURE 2.4, MEASURE 2.7, MANAGE |
| EU AI Act | Article 9, Article 14, Article 15, Annex IV |
| NDAA | §1512, §1535 |
| Riyadh Charter | 7 principles (integrity, privacy, reliability, transparency, accountability, humanity, social benefit) |
| ISO/IEC 42001 | not asserted in this artifact |
| NAIC | not asserted in this artifact |
| SDAIA · PDPL · DIFC · ALECSO · MOAI | not asserted in this artifact |
| GDPR Art. 22 · DORA · Colorado AI Act | not asserted in this artifact |
| FCA AI · GSA neutrality | not asserted in this artifact |
A compliance mapping records which framework requirements the tested surface speaks to. It is not a certification, and it does not assert coverage beyond what was tested. Mappings shown as "not asserted" carry no claim in this artifact.
For Middle East deployments, this artifact populates a Riyadh Charter principle mapping — the seven principles below, recorded in the artifact's riyadh_charter field. This is the regional mapping the artifact actually carries.
| Riyadh Charter principle | Carried in this artifact |
|---|---|
| Integrity | ✓ |
| Privacy | ✓ |
| Reliability | ✓ |
| Transparency | ✓ |
| Accountability | ✓ |
| Humanity | ✓ |
| Social benefit | ✓ |
The broader regional stack — SDAIA, KSA and UAE PDPL, DIFC, ADGM, ALECSO, the MOAI seal — is not asserted in this artifact and is in development, not yet validated. The Riyadh Charter mapping reflects which principles the tested surface speaks to; it is not a regional certification.
Every value above lives in a signed artifact whose integrity you can confirm independently, using only public libraries and the published key.
pip install rfc8785 cryptographypython verify_rtk1.py rtk1_evidence_a58a098c.jsonSigned with ECDSA-P256-SHA256 over RFC 8785 (JCS) canonical bytes. The verification procedure is public; the trust is in the math, not in us.