# Framework Mapping -- Evidence Fabric Sample Receipt

**Purpose:** Provide an illustrative crosswalk from selected receipt fields to NIST AI RMF and EU AI Act topics that an operator or auditor may choose to examine. This sample does not establish that any control is designed, implemented, operating, or effective.

**Sample receipt:** `receipt.json` in this package (synthetic healthcare workflow).

---

## Receipt-field-to-framework mapping

| Receipt field | NIST AI RMF 1.0 function | EU AI Act topic |
|---|---|---|
| `request.user_role` | Govern | Record context |
| `request.input_hash_sha256` | Measure | Record-keeping |
| `request.data_classes_detected` | Map | Record context |
| `policy.policy_version` | Govern | Record-keeping |
| `policy.rules_fired` | Manage | Record-keeping |
| `policy.policy_hash_sha256` | Measure | -- |
| `provider_routing.provider` | Measure | -- |
| `provider_routing.baa_covered` | Measure | -- |
| `provider_routing.zdr_asserted` | Manage | Record context |
| `provider_routing.region` | Manage | Transparency context |
| `response.response_hash_sha256` | Measure | -- |
| `post_processing.detokenization_applied` | Manage | -- |
| `verification.chain_prev_event_hash` † | Measure | Record-keeping |
| `verification.transparency_log_inclusion_proof` †† | Measure | Record-keeping |
| `verification.signature` | Measure | -- |
| `verification.signer_key_id` | Govern | -- |

---

### Two rows carry less weight than the rest

**† `verification.chain_prev_event_hash`.** On this receipt the field holds the 64-zero chain-start sentinel, so the receipt itself demonstrates nothing about hash linkage. The linkage it points at is exercised elsewhere in the package: `session_export.json` carries a three-event chain, and `verifier_cli.py --chain` walks it. Read the row against the export, not against the receipt.

**†† `verification.transparency_log_inclusion_proof`.** No transparency log stands behind this sample. The field is schema-present and roadmap-backed; its value here is a synthetic placeholder, and the receipt says so in the sibling field `transparency_log_inclusion_proof_status: "roadmap"`. An auditor should treat this row as a description of intended structure, not as evidence of anything.

---

## How to read this table

A "--" entry means the receipt field does not directly satisfy a control in that framework. It does not mean the framework is silent on the underlying concept; only that this specific receipt field is not the artifact the framework points at.

A populated entry identifies a possible discussion topic. It does not establish control design, implementation, operation, effectiveness, framework conformity, or legal compliance.

The substantive audit opinion is the auditor's, not Vertical Edge AI's. This mapping is a navigational aid, not an attestation.

---

## What this mapping does NOT cover

- **Substantive AI evaluation controls** (bias testing, red-teaming, output filtering, model card disclosures). These are separate disciplines; the Evidence Fabric is the audit trail underneath, not a substitute.
- **Framework-specific governance documentation** (AI policies, risk registers, training records). These live outside the receipt; the Evidence Fabric records what the policy decided at request time.
- **Provider-side attestations** (whether the AI provider actually honored zero-data-retention). The receipt records the operator's assertion; vendor-side evidence requires the provider's own attestation.
- **Regulated-framework control mappings.** HIPAA and Reg S-P control mappings are intentionally excluded because this synthetic package does not establish those controls.
- **Customer-specific framework variations.** Different auditors interpret framework requirements differently; the table is a navigation aid, not a conclusion.

---

## Synthetic-data notice

The sample receipt (`receipt.json`) is entirely synthetic. The mapping above is illustrative; in a production engagement, the mapping is generated against the operator's actual receipt schema and reviewed with the operator's auditor.

---

*Vertical Edge AI LLC, Austin TX. Last reviewed 2026-05-19. Maintained at verticaledgeai.ai/sample-package/framework_mapping.md.*