Compliance and auditing

QWED Finance can attach a receipt to a verification: a record of what was checked, how, and with what result. Signed with your key, it becomes tamper-evident, so a later change to it shows.

Verification receipts

CrossGuard, UCPIntegration, and the built-in OpenResponsesIntegration tools create receipts automatically. Custom Open Responses tools get a receipt only if their verification_fn creates one. Direct calls to the other guards (for example ComplianceGuard.verify_aml_flag) return a result object without a receipt; create one yourself with ReceiptGenerator when you need an audit record:

from qwed_finance import ReceiptGenerator, VerificationEngine

receipt = ReceiptGenerator.create_receipt(
    guard_name="ComplianceGuard.verify_aml_flag",
    engine=VerificationEngine.Z3,
    llm_output="Transaction approved",
    verified=False,
    violations=["AML_CTR_THRESHOLD"]
)

print(receipt.to_json())

Receipt fields

Every field below is part of the signed payload.

Field	Description	Example
`receipt_id`	Unique identifier	`"a1b2c3d4-..."`
`timestamp`	ISO 8601 UTC with microseconds	`"2026-01-18T14:30:00.123456+00:00"`
`input_hash`	SHA-256 of LLM output	`"7f83b1657..."`
`input_preview`	First 100 chars of the input	`"Transaction approved"`
`guard_name`	Guard that ran	`"ComplianceGuard.verify_aml_flag"`
`engine_used`	Verification engine	`"Z3"`
`status`	Outcome: `verified`, `rejected`, `insufficient_data`, `error`	`"verified"`
`verified`	Pass/fail	`true/false`
`computed_value`	Deterministically computed value	`"flag_required=True"`
`llm_value`	LLM output when ≤ 50 chars, else `null`	`"Transaction approved"`
`difference`	`computed_value` vs expected	`null`
`proof_steps`	Symbolic derivation	`["amount=15000", "threshold=10000", "15000>=10000"]`
`formula_used`	Formula applied	`"llm_flagged == flag_required"`
`violations`	Rule violations	`[]`
`metadata`	Extra context	`{"rule": "AML_CTR"}`

Cryptographic signature

Since v3.0.0, signatures are keyed HMAC-SHA256 over the full canonical receipt: every field in the table above, as sorted compact JSON. The verifier holds the key; there is no default key. The earlier unkeyed get_signature() (no argument) was removed in v3.0.0.

import hmac
import secrets

# Generate a key once per verifier and keep it outside the receipt
signing_key = secrets.token_bytes(32)

signature = receipt.get_signature(signing_key)
# "b4d30b8e..."

# Verify the receipt has not been modified (constant-time comparison)
same = hmac.compare_digest(receipt.get_signature(signing_key), signature)

Changing any field after signing (computed_value, violations, status, proof_steps, anything in the table) produces a different signature. This is tamper evidence for holders of the key: it does not establish issuer identity, third-party verifiability, or non-repudiation. Public-key attestation (ES256) is planned separately; see qwed-finance#37.

Audit log

Collect receipts in one place. AuditLog keeps them in memory; export them to store them with your other audit records:

from qwed_finance import AuditLog

log = AuditLog()

# Log verifications
log.log(receipt1)
log.log(receipt2)

# Get summary
summary = log.summary()
# {
#     "total_verifications": 100,
#     "passed": 95,
#     "failed": 5,
#     "pass_rate": "95.0%",
#     "by_guard": {"ComplianceGuard": 40, "QueryGuard": 60}
# }

# Export to store with your audit records
json_export = log.export_json()

Query failed verifications

# Get all failures for investigation
failures = log.get_failures()

for receipt in failures:
    print(f"Failed: {receipt.guard_name}")
    print(f"  Input: {receipt.input_preview}")
    print(f"  Violations: {receipt.violations}")

Rules and records

These are the rules the checks implement and the records QWED Finance can give you. Using QWED Finance does not make a system compliant with any of them: that is for your own compliance review.

Rule or framework	What QWED Finance provides
BSA/FinCEN	`verify_aml_flag` requires a flag when the amount is at or above the 10,000 threshold for the `jurisdiction` you pass, or when `country_code` is high-risk, whatever the amount; amounts are compared as given, with no currency conversion
OFAC and other sanctions lists	Name screening against a list you supply
RBI FREE-AI (India)	Receipts and an audit log recording how each AI output was checked
Your own audit (SOC 2, ISO 27001 and others)	Receipts and signatures as evidence of what was checked; QWED Finance holds no certification

Adversarial defense

The test suite includes adversarial inputs written to get past the guards:

# tests/adversarial/test_sql_jailbreaks.py

def test_delete_in_subquery():
    """DELETE hidden in subquery should be caught"""
    sql = "SELECT * FROM (DELETE FROM users WHERE id=1 RETURNING *) AS deleted"
    result = guard.verify_readonly_safety(sql)
    assert result.safe == False  # caught

def test_mixed_case_drop():
    """DrOp TaBlE should be caught"""
    result = guard.verify_readonly_safety("DrOp TaBlE users")
    assert result.safe == False  # caught

Test suites

Suite	Tests	Coverage
`test_sql_jailbreaks.py`	20+	SQL injection, UNION, comments
`test_math_compliance_jailbreaks.py`	15+	Float precision, AML boundaries

For compliance officers

When a regulator asks: “How do you verify AI decisions?” Show them:

Input hash: the SHA-256 of the model output that was checked
Timestamp: when the check ran
Engine: which engine checked it (for example Z3 or SymPy)
Proof steps: the steps the guard computed to reach its result
Receipt signature: HMAC tamper evidence, for holders of the key

Receipts carry no embedded signature field; get_signature(signing_key) computes it on demand from the full receipt. Export both artifacts under unique paths, one pair per receipt, so no export overwrites an earlier audit record:

from pathlib import Path

signature = receipt.get_signature(signing_key)
base = f"receipt-{receipt.receipt_id}"

try:
    Path(f"{base}.json").write_text(receipt.to_json(), encoding="utf-8")
    Path(f"{base}.sig").write_text(signature, encoding="utf-8")
except OSError as exc:
    raise RuntimeError(f"receipt export failed, pair incomplete: {exc}") from exc

The exported receipt-abc-123.json contains the full receipt:

{
  "receipt_id": "abc-123",
  "timestamp": "2026-01-18T14:30:00.123456+00:00",
  "input_hash": "7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069",
  "input_preview": "Transaction approved",
  "guard_name": "ComplianceGuard.verify_aml_flag",
  "engine_used": "Z3",
  "status": "verified",
  "verified": true,
  "computed_value": "flag_required=True",
  "llm_value": "Transaction approved",
  "difference": null,
  "proof_steps": [
    "amount = 15000",
    "threshold = 10000",
    "15000 >= 10000 → flag_required = True",
    "llm_flagged = True",
    "llm_flagged == flag_required → COMPLIANT"
  ],
  "formula_used": "llm_flagged == flag_required",
  "violations": [],
  "metadata": {}
}

To verify an export later, re-canonicalize each parsed JSON exactly as get_signature(signing_key) does and compare it with the stored signature. Every receipt name found in the directory is checked, a .json or .sig file without its partner counts as a failure, and one failure never stops the rest. The auditor needs the verifier’s HMAC key. It is never stored with the receipts, so provision it to the auditor through a secret store or an environment variable:

import hashlib
import hmac
import json
import os
from pathlib import Path

# The verifier's HMAC key, provisioned to the auditor out of band
signing_key = bytes.fromhex(os.environ["QWED_RECEIPT_KEY_HEX"])

# Collect receipt names from both file types, so an orphaned file is caught
directory = Path(".")
names = sorted(
    {p.stem for p in directory.glob("receipt-*.json")}
    | {p.stem for p in directory.glob("receipt-*.sig")}
)
if not names:
    raise SystemExit("no exported receipts to audit")

results = {}
failures = []
for base in names:  # "receipt-<receipt_id>"
    try:
        receipt_json = (directory / f"{base}.json").read_text(encoding="utf-8")
        stored = (directory / f"{base}.sig").read_text(encoding="utf-8")
        canonical = json.dumps(
            json.loads(receipt_json),
            sort_keys=True,
            separators=(",", ":"),
            allow_nan=False,
        )
        results[base] = hmac.compare_digest(
            hmac.new(signing_key, canonical.encode("utf-8"), hashlib.sha256).hexdigest(),
            stored,
        )
    except (OSError, ValueError, TypeError) as exc:
        # unreadable/invalid UTF-8, malformed or NaN JSON, non-ASCII signature
        results[base] = False
        failures.append(f"{base}: {exc}")
    else:
        if not results[base]:
            failures.append(f"{base}: signature mismatch")

for failure in failures:
    print(f"verification failed: {failure}")

audited_ok = all(results.values())
if not audited_ok:
    raise SystemExit(1)  # fail the audit job on any missing, unreadable, or tampered receipt

Previous: The 11 guards: each guard with examples
Next: QWED UCP: transaction verification for AI commerce: connect finance checks to commerce flows
See also: QWED Open Responses: verified tool calls for AI agents: check agent tool calls before they run

Source code and adversarial tests: github.com/QWED-AI/qwed-finance

Get Started

Core Verification

Integrations

Compliance and auditing

Verification receipts

Receipt fields

Cryptographic signature

Audit log

Query failed verifications

Rules and records

Adversarial defense

Test suites

For compliance officers

​Verification receipts

​Receipt fields

​Cryptographic signature

​Audit log

​Query failed verifications

​Rules and records

​Adversarial defense

​Test suites

​For compliance officers

​Related pages

Verification receipts

Receipt fields

Cryptographic signature

Audit log

Query failed verifications

Rules and records

Adversarial defense

Test suites

For compliance officers

Related pages