EVAL · SHA-256 · KEY-ANCHORED
Signed evaluation records
Every decision the agent makes — pass, escalate, deny — joins a SHA-256 hash chain as a signed record. Provenance is a query, not a forensic exercise five months later.
PLU-003 · Healthcare vertical
Beta cohort · Q3
§03 · The Tuesday-morning scenario
The AI agent flagged a prior-auth.
The auditor wants the record.
A coverage-decision model just escalated a request to manual review. By the time the care manager opens their inbox, the auditor wants to know what data the model saw, what score it produced, and whether the escalation was a one-off or the start of a drift pattern. Plumbline captures all three before the request lands in a queue.
The scenario · 08:14 AM, Tuesday
Patient-7421's prior-auth hits the queue.
Six questions. One ledger.
- 1.What did the model see? The SDK tags input PHI fields, the panel anchor identifiers, and the model version — captured at inference time, not reconstructed later.
- 2.What score did it produce? Three evaluators ran inline: a clinical-coverage rubric, a reviewer-overlap gauge, and a spend-against-MLR ceiling. Each signed its result to the same record.
- 3.Why was it escalated? A throw rate over 0.12 drove the escalation; the value, the threshold, and the rubric are all on the same row as the model output.
- 4.Has the model drifted since last quarter? Drift ledger pulls the same evaluation key against the last 90 days — calibration curve walks the auditor back in a single view.
- 5.Who has access to the record? Scope is set at write time and recorded with the row — `care-manager`, `medical-director`, `compliance-audit` are all distinct call paths.
- 6.Will the record hold up? SH-anchored signatures, replicated off the production write path. Tampering is detected at fetch time, not at audit time.
What Plumbline captures
Three artifacts.
The same ledger. No spreadsheet stitch.
The auditor's questions all reduce to three artifacts. A healthcare pilot ships with all three wired up — so the replay, the walk-back, and the compliance package come from the same source of truth, not three dashboards stitched together the morning of the review.
DRIFT · INCIDENT · RESOLUTION
Drift ledger
Score distribution, calibration, and reviewer overrides all flow into the same ledger. When Patient-7421 dramatizes a 6-point score drop, the walk-back to the prior record is a single replay — not a spreadsheet stitch.
HIPAA · HITRUST · NIST AI RMF
Compliance package
A pre-built HIPAA evidence package your compliance officer opens directly: retention window, access scopes, BAA boundaries, and the subset of NIST AI RMF / HTI-1 controls the ledger already satisfies.
The pilot
One coverage model.
One evaluator. Sixty days.
The healthcare pilot is shaped around the panel you already run — a coverage-decision or prior-auth model with one or two evaluators that don't need a full evaluation team to maintain. Sign in, register a model, and the first record lands in your ledger the same day.
We co-write the scope in week one: data surface, access scopes, BAA boundary, retention window. The replays are real-data, sixty days deep, before any contract is drawn up — so the auditor walk-through is, by definition, a replay of evidence you've already collected.
PLU-003 · Healthcare vertical
Vertical pilotReserve a healthcare pilot slot
Each healthcare pilot ships with a HIPAA evidence package, BAA scoping of the data surface, and a retention window we agree with you up front. Drop your email and we'll send the scoping checklist before a contract is drawn up.
We'll never share your email. No marketing blast — only the next-step note when a slot opens. If you already have a BAA template ready, mention it on the call.
Already running an evaluation surface? Email plumbline-ai-9@polsia.app with the panel size and we'll skip the waitlist.
§06 · Pricing
Ready to see this on your models?
Get started in minutes — pick a pilot tier, point the SDK at one model, and the first signed record lands in your ledger the same day. Cancel any time before the first sixty-day replay review.