A trust packet a buyer can check
The AI Source of Truth packet check and the trust center are live. Three signed sections are still to build.
Use case
A trust packet a buyer can check: a workflow across PromptCompute, RepoOps, CommitOps, AI Source of Truth, PromptReports that starts from a person starts it for a named buyer.
Who would use it
Founders selling to larger companies, and the security reviewers on the other side.
What value it provides
One signed export of approvals, incidents and recoveries, promises kept and corrections. A reviewer can check each item without trusting the seller.
Why it matters to the user
The review is often the slowest step in a larger deal. Evidence a reviewer can verify on their own shortens it and stands up later in an audit.
The problem
Security reviews ask for proof that people control what AI agents do. Teams answer with screenshots and a policy PDF, and the reviewer has to take their word for it.
Expected outcomes
- Days from questionnaire to signed-off review
- Items in the packet a reviewer can verify: target 100%
- Follow-up questions per review
Each run records its outcome as met, not met or not measured.
How it runs
Products and connections
| Product | Role in this workflow | Docs |
|---|---|---|
| PromptCompute | Export approvals, signed; A person approves sharing it outside the company | Reference · PromptCompute docs |
| RepoOps | Export incidents, causes, recoveries and lessons, signed | Reference · RepoOps docs |
| CommitOps | Export promises made and kept, signed | Reference · CommitOps docs |
| AI Source of Truth | Check every item against the public record | Reference · AI Source of Truth docs |
| PromptReports | Publish a verify page for the whole packet | Reference · PromptReports docs |
Outside the family: None beyond the family.
What a person approves
| Action | Default risk |
|---|---|
file.share.external | high |
data.export.bulk | high |
Action keys are from the PromptCompute catalog.
How to access it from an agent
An agent will run this workflow through the PromptReports MCP server or API, with an ID agent token. The runner will then call each product for it. Proposed
// MCP: https://mcp.promptreports.ai/mcp (Proposed)
start_run({
workflow: "trust-packet",
inputs: { "buyer": "Contoso Health", "period": "Last 90 days", "sections": "Approvals, incidents, promises, corrections" },
dry_run: false
})
// returns { run_id, status: "running", approvals_url }
get_run({ run_id }) // poll, or subscribe to run eventscurl -X POST https://api.promptreports.ai/v1/runs \
-H "Authorization: Bearer $PROMPTREPORTS_AGENT_TOKEN" \
-d '{"workflow":"trust-packet"}'Or call the products yourself, step by step:
| Product | Endpoint | Tools |
|---|---|---|
| PromptCompute | https://mcp.promptcompute.ai/mcp | request_approval get_approval cancel_approval answer_approver |
| RepoOps | https://mcp.repoops.ai/mcp | search_brain get_pre_edit_context propose_brain_entry get_incident_attribution |
| CommitOps | https://commitops.ai/api/mcp | whoami list_assertions get_assertion promised_not_started |
| AI Source of Truth | https://aisourceoftruth.com/v1/family/facts | to confirm |
| PromptReports | Proposed | through the runner |
Set it up
- Sign in at app.promptreports.ai with PromptReports ID, and pick your org.
- Connect PromptCompute, RepoOps, CommitOps, AI Source of Truth on the Connections page.
- Register the agent that will run it on the Agents page, and give it a version manifest.
- Set the approval policy for file.share.external, data.export.bulk. Start with Require approval; critical actions are never auto.
- Fill in the inputs (Buyer, Period, Sections) and choose the trigger: a person starts it for a named buyer.
- Start a dry run. It will count no workflow request, and it shows which steps would record missing evidence.
- Start the run. Approve each gate in the approvals inbox, then read the signed record when it ends.