Know your obligations under
[ Colorado AI Act ]

No. Terraform governs what gets deployed — infrastructure, configs, resources standing up in an environment. IRIS governs what runs after deploy: which APIs an agent calls, which models it uses, whether each LLM request passes policy. Think of IRIS as what comes after Terraform — the runtime governance layer. iris scan discovers what's running, iris register inventories your fleet, and @agent.guard() enforces policy on every call.

No. IRIS runs fully local. Cedar policy evaluation happens in-process with zero network required. You can govern agents on your laptop, in CI, or in production without any IRIS-hosted service.

Cedar is a formally verified policy language from AWS, designed for authorization at scale. It evaluates in microseconds, is human-readable, and has mathematical proofs of correctness. IRIS compiles your plain English intent to Cedar so you never write policy syntax yourself.

Monitoring tools scan outputs after the fact. IRIS governs the full agent lifecycle — declaring what is allowed before execution, blocking violations at runtime, and maintaining an auditable policy history in Git. Detection tells you what happened. Governance determines what is allowed to happen.

Policy as Code means your AI governance is version-controlled, reviewable, and auditable in the same way your infrastructure code is. When a regulator asks what your agent is allowed to do, you show them the Cedar policy in Git — a document with a reviewer, a timestamp, and a commit hash. Not a screenshot. Not a PDF someone generated. The actual policy that is actually enforced at runtime on every call.

IRIS also generates the evidence package: the audit trail, impact assessments, compliance check results, and certification readiness score. The auditor reviews it and signs off. We are honest about what IRIS handles and what your team handles.

In June 2026, a US government export-control action briefly restricted Fable 5 and Mythos 5; access was later restored. Governments and providers can change model availability without notice. If your agent hardcodes a model string, that breaks your production system. IRIS governs models separately from APIs: define tiers and fallback chains in governance/models/registry.yaml, block models via directive kill switches in governance/directives/active.yaml, and IrisAnthropic auto-routes to your approved baseline on the next call — no redeploy. The event is logged to the Evidence Vault.

Yes. Governor Polis signed a replacement law on May 14, 2026. The effective date moved to January 1, 2027, and some requirements were scaled back — but notice, transparency, consumer appeal rights, and the reasonable-care safe harbor remain. Start by inventorying every AI system that touches employment, housing, credit, healthcare, or insurance decisions. IRIS gives you that inventory (AgentPassport), enforced policy (Cedar), and the evidence package auditors expect — locally, with no cloud required.

Yes. IRIS covers NYC Local Law 144 (the most actively enforced AI hiring law in the US), the Illinois AI Video Interview Act, and the employment-domain provisions of CCPA/CPRA ADMT and the EU AI Act. These are available in Enterprise. The free tier shows you the rules and your top gaps — Enterprise unlocks the full evidence package and certification report that an auditor or the NYC DCWP will ask for.

Yes. Install iris-security-mcp or pip install "iris-security-sdk[mcp]" and connect IRIS to Claude Desktop. Ask Claude in plain English: "scan my codebase for ungoverned agents" or "which regulations apply to my hiring AI?" Claude uses IRIS tools to answer with real data from your actual codebase.

Not yet — the IRIS Governance GitHub App (org-wide PR scanning with a one-click merge gate) is in active development and not yet published to GitHub Marketplace. Today, use the reusable iris-governance.yml GitHub Actions workflow for the same PR scanning: every PR is checked, critical findings block the merge, and the developer gets a comment with the exact one-line fix.

Yes. IRIS uses a dynamic environment model where your security team defines environments in iris-security.yaml and attaches compliance frameworks and enforcement levels to each one. dev might have no frameworks enforced. production-eu enforces GDPR and EU AI Act. production-fedramp enforces FedRAMP Moderate. Set IRIS_ENV in your deployment config and IRIS applies the right policy automatically.

The Evidence Vault is an append-only ledger — not a rotating log. The default local path writes unsigned JSONL for development; Evidence Vault v2 adds HMAC signing and hash chaining so tampering with any event breaks the chain. Events can be mapped to compliance controls (Colorado CO-004, AIUC-B006, HIPAA-001, …) so one collection satisfies many framework reports. CI/CD pipelines record evidence with iris evidence record-cicd — even when the governance gate fails. See the Evidence Vault guide.

IRIS generates AIUC-1 B006 readiness evidence (technical evidence only; certification requires an accredited auditor). AIUC-1 is a third-party certifiable AI agent standard — Schellman is the first accredited auditor. IRIS ships B006-format evidence export today as an Enterprise capability (iris certify --framework aiuc-1 --format aiuc1-export). IRIS generates technical evidence in AIUC-1's own evidence-ID format (B006.1, B006.2, etc.) for the controls IRIS's runtime enforcement directly produces evidence for — agent access restrictions, HITL review records, activity logs, PII leakage prevention. IRIS does not replace the accredited auditor or AIUC-1's required third-party adversarial and hallucination testing — those remain separate engagements.

Not yet, by design. Community is free, open source, and fully real today — Cedar policy engine, HITL, Evidence Vault, GitHub integration, all of it. We are building Enterprise capabilities in the open and will turn pricing on once they are real, tested, and something we'd stand behind in a customer conversation — not before. Want to help shape it? Reach out as a design partner.

14 compliance frameworks — Colorado AI Act (SB 26-189) is available in Community today via iris compliance scan, which maps your obligations across frameworks like GDPR, HIPAA, and ISO 42001 — no account required for local CLI use. SOC 2, GDPR, HIPAA, and EU AI Act are also free, fully offline assessments — iris compliance check --framework gdpr (or hipaa, eu-ai-act, soc2) runs the complete rule set with a local PASS/FAIL verdict; certify export, the deeper remediation report, and continuous monitoring stay Enterprise. EU AI Act's free check currently covers one rule (EU-AIA-14); GDPR and HIPAA cover 8 and 9 respectively — deeper EU AI Act coverage is on the roadmap. AIUC-1 B006 evidence export (aiuc-1) and ISO/IEC 42001 (iso-42001) ship today as Enterprise capabilities — not roadmap items. NIST AI RMF, FedRAMP, CCPA/CPRA ADMT (ccpa-admt), China PIPL (china-pipl), NYC LL 144 (nyc-ll144), and Illinois AI Video (illinois-ai-video) full eval, continuous monitoring, and auditor-grade export packages are Enterprise. Run iris compliance scan or iris framework suggest to see what applies.