PoC objectives

Each exercise proves a specific objective with an evidence artifact, so by day 14 you have an evidence-backed go/no-go decision — not just impressions. The plan is matched to the 14-day sandbox lifetime. Audience: MLOps / platform engineers, compliance officers, and risk leaders, with a focus on EU-regulated financial services.

#	Question you can answer by day 14	Proven in
O1	Can it classify our models against the EU AI Act correctly — including the fintech nuances?	Exercise 3
O2	Can it produce regulator-ready technical documentation without manual writing?	Exercise 4
O3	Does it enforce compliance at deploy time, not just report it?	Exercise 5
O4	Is the audit trail tamper-evident and independently verifiable?	Exercise 6
O5	Can it govern LLM usage (routing, safety, cost) alongside classic ML?	Exercises 7–8
O6	Does it detect fairness and robustness problems before production?	Exercise 9
O7	Can we run it entirely on our own infrastructure?	Phase 5

Phase 1 — Setup & orientation (Day 1, ~1 hour)

Sign up at app.aegissovereign.io/sandbox/signup with your work email, role, and EU AI Act as your primary framework. Your isolated workspace is provisioned in ~30 seconds, pre-seeded with 5 demo models (fraud-detector-v3, credit-risk-scorecard, clinical-nlp-v2, customer-churn-v4, aml-transaction-screen), completed compliance/bias/robustness evaluations, 200+ tamper-evident audit events, and a configured LLM gateway. Save the temporary password shown on screen. Then walk the left navigation top-to-bottom once — the Platform Walkthrough doc mirrors this tour with screenshots. Note: the sandbox is an isolated workspace on the shared evaluation instance; physical isolation comes from the self-hosted deployment in Phase 5.

Exercise 2 — Model registry & lifecycle (30 min)

Confirm the registry can be your single source of record. Open Model Registry → credit-risk-scorecard → review metrics, version, framework, lineage. Generate and download its Model Card. Then register a model of your own via the API — it appears alongside the seeded ones with an auto-generated card.

bash

1TOKEN=<from Settings → API Keys → Generate New Key>
2curl -X POST https://api.aegissovereign.io/api/v1/registry/models \
3  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
4  -d '{"name":"poc-credit-model","version":"0.1.0","framework":"xgboost",
5       "task_type":"classification","workspace_id":"<your workspace id>"}'

Exercise 3 — EU AI Act classification (20 min) → O1

Verify classification correctness, including the two fintech nuances most tools get wrong. In Model Registry, open the ⚖ EU AI Act action on credit-risk-scorecard — expect HIGH RISK — Creditworthiness evaluation / credit scoring (Annex III 5(b)) with the legal basis and rationale spelled out. Open the same panel on aml-transaction-screen — expect MINIMAL risk with the Annex III 5(b) carve-out note: financial-fraud detection is expressly excluded from the high-risk class. Finally, register a test model tagged both credit_scoring and fraud — expect HIGH, with the rationale that the carve-out only covers systems used solely for fraud detection. Value: legally-grounded classification your compliance team can defend, not a generic risk label.

Exercise 4 — Annex IV technical documentation (30 min) → O2

Produce the Article 11 document a market-surveillance authority would ask for. In the EU AI Act panel on credit-risk-scorecard, review the nine-section Annex IV checklist — which items are satisfied from existing evidence, which are required gaps. Fix one gap yourself: add intended_use to the model's metadata and reopen the panel; the checklist updates. Then click Download Annex IV Technical Documentation — every satisfied item carries its evidence value (training data refs, performance metrics, disparate-impact results, robustness scores, audit references); every gap is flagged. Value: documentation as a byproduct of governance, not a quarter-long writing project.

Exercise 5 — Enforcement: the promotion gate (20 min) → O3

Prove compliance is enforced, not reported. Attempt to promote a high-risk model with incomplete documentation and receive a structured 422 listing the exact blocking Annex IV items. Retry with an override_reason — promotion proceeds, and an eu_ai_act.gate.override event with your reason appears in the Audit Log. Also try promoting a model whose OPA policy checks fail (Policy Center) — same enforced pattern, different rulebook. Value: the deploy path is the control point; every bypass is attributable and auditable.

bash

The gate in action

1curl -X POST "https://api.aegissovereign.io/api/v1/models/<model-id>/promote" \
2  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
3  -d '{"target_stage":"production"}'
4# → 422 EU_AI_ACT_NOT_READY
5# {
6#   "risk_level": "high",
7#   "category": "Creditworthiness evaluation / credit scoring (Annex III 5(b))",
8#   "blocking": ["Intended purpose (Annex IV 1(a))", "..."],
9#   "documentation": "/api/v1/models/<model-id>/eu-ai-act/annex-iv"
10# }

Exercise 6 — Tamper-evident audit chain (20 min) → O4

Every claim in exercises 2–5 is backed by a hash-chained record. Filter the Audit Log to the events your PoC generated, verify the cryptographic chain via the API, and export the CSV — that export plus the chain head is what an auditor receives. In production you can anchor the chain head to an external ledger (immudb / Azure Confidential Ledger) so even the platform operator cannot rewrite history.

bash

Verify the chain

curl "https://api.aegissovereign.io/api/v1/audit/entries/verify?workspace_id=<ws>" \
  -H "Authorization: Bearer $TOKEN"
# → { "valid": true, "total": ..., "head_hash": "..." }

Exercises 7–8 — LLM gateway & prompt safety (50 min) → O5

In LLM Gateway, review the seeded providers (on-prem vs cloud) and routing rules, then use the route simulator with a PII-classified prompt — expect it routed to the on-prem provider so confidential data never leaves the boundary. Add a routing rule of your own, then open LLM Analytics for token/cost KPIs, budget utilization, and the per-team chargeback CSV. In Prompt Registry, run a Safety Eval on a draft prompt (jailbreak resistance, PII leakage, injection, hallucination, toxicity) and note that Promote to Production stays disabled until the gate passes — the same enforced-promotion pattern as models.

Exercise 9 — Bias & robustness (40 min) → O6

Run a Bias Evaluation against credit-risk-scorecard with a protected attribute (e.g., age bands) — review the disparate-impact ratio and statistical parity against the 0.80 EEOC threshold. Run a simulation-mode AI Robustness evaluation on the same model and review the degradation curve. Then reopen the EU AI Act panel: the fairness evidence you just generated now satisfies the Art. 10(2) checklist item in Annex IV — one workflow, two outcomes. Finish with the executive Dashboard and the Executive Summary PDF for your steering committee.

Phase 5 — Optional: self-hosted validation (Days 12–14) → O7

Validate the sovereignty claim by standing up your own instance on AKS, EKS, GKE, or on-prem Kubernetes, then repeat exercises 3–6 against it — identical behavior, your keys, your boundary.

bash

Helm install

1# From the Aegis Sovereign release bundle
2cd aegis-sovereign/helm
3helm upgrade --install aegis ./sovereign-gateway \
4  --namespace aegis --create-namespace \
5  --set global.domain=aegis.yourcompany.com \
6  --set postgresql.auth.password="$(openssl rand -base64 32)" \
7  --set secrets.encryptionKey="$(openssl rand -hex 32)" \
8  --wait --timeout 10m

Evaluation scorecard

Score each objective 1–5 at the end and attach the evidence artifact. Suggested go/no-go bar: O1–O4 all ≥ 4, nothing below 3. Sandbox notes: 14-day lifetime (then read-only), shared evaluation instance with LLM spend caps; production isolation comes from your own deployment. Support: sandbox@aegissovereign.io — ask for a guided working session covering exercises 3–5 with your own model metadata.

Objective	Evidence artifact
O1 Classification correctness (incl. carve-out)	Screenshots of both classifications
O2 Annex IV generation	Downloaded Annex IV document
O3 Deploy-time enforcement	422 response + override audit event
O4 Tamper-evident audit	verify response + CSV export
O5 LLM governance	Route-simulator result + chargeback CSV
O6 Bias/robustness detection	DIR result + robustness report
O7 Self-hosted parity	Helm deploy + repeated exercise 5
Fit: usability for your personas	Notes from each role
Fit: integration surface (API/SDK/MCP)	One scripted workflow via SDK