GitHub - base76-research-lab/TrustPlane: AI trust control plane: logprob-based epistemic scoring, policy enforcement (PASS/REFINE/ESCALATE/BLOCK) and EU AI Act audit trails for production LLM systems.

An empirically grounded AI trust control plane for production systems.

"If you can't measure it, you can't manage it. If you can't audit it, you can't deploy it."

🚀 TrustPlane for Vibecoding

Stop hallucinated code before it reaches your editor. TrustPlane works as a lightweight OpenAI‑compatible proxy that scores every AI suggestion using the model’s own log‑probabilities, blocks high‑risk outputs, and gives you a clear warning.

Try the live demo in under a minute:

git clone https://github.com/base76-research-lab/TrustPlane.git
cd TrustPlane/vibecode-demo
./run_demo.sh   # or run_demo.bat on Windows

Figure: TrustPlane risk scoring – green = pass, red = block.

Overview

TrustPlane is a policy-driven gateway that scores every LLM response using a logprob-derived epistemic risk signal, enforces configurable trust thresholds, and maintains an immutable audit trail per tenant. It bridges the gap between model confidence and actual correctness — turning abstract "AI safety" into operational practice.

Status: Post-research, pre-market. The core falsifiable claim is empirically supported; the system is production-ready for pilot deployments.

The core measurement

On TruthfulQA (llama3.2:3b, n=294, deterministic grading, seed-reproducible):

AUROC 0.745 (95% CI: [0.710, 0.780]) — logprob-based risk signal predicts incorrect answers
Precision on BLOCK: 89% (if we reject response as too risky, it was wrong 89% of the time)
Precision on ESCALATE: 79% (borderline-risky responses are actually wrong 79% of the time)
Recall on BLOCK: 44% (we catch 44% of all wrong answers)
Accuracy baseline: 36% (model right by chance); Accuracy when PASSed: 65%

Reproduce in one command: python benchmark/run_benchmark.py --model llama3.2:3b

Why this matters

Every unverified LLM response in production is an undocumented decision. When something fails:

Legal liability: No record of what the model was asked, what it answered, or what you did with it
Compliance gap: Regulators (especially in healthcare, finance, public sector) want audit trails and human override chains
Operational risk: No signal to distinguish confident-and-correct from confident-and-wrong

TrustPlane solves this by:

Measuring uncertainty per response — from token log-probabilities, not static priors
Enforcing policy before response reaches users — PASS / REFINE / ESCALATE / BLOCK
Logging everything immutably — PostgreSQL audit schema per tenant
Triggering human review automatically — webhooks on ESCALATE and BLOCK

How it works

Every response is scored using the epistemic trust formula:

C = p × (1 − Ue − Ua)

where:
  p    = prior confidence (deployment-configured)
  Ue   = epistemic risk proxy (measured from token logprobs)
  Ua   = aleatoric uncertainty (domain noise, configured prior)
  risk = 1 - C

The outcome depends on risk:

Risk score	Decision	Outcome
≤ threshold	`PASS`	Response forwarded, logged
≤ threshold + 0.2	`REFINE`	Warning headers, logged, cached
≤ threshold + 0.4	`ESCALATE`	Webhook triggered, human notified
> threshold + 0.4	`BLOCK`	Response rejected, trace persisted

Every response carries epistemic metadata:

X-TrustPlane-Decision: PASS
X-TrustPlane-Risk-Score: 0.24
X-TrustPlane-Trace-Id: tr_a3f91c2d44b1
X-TrustPlane-Scoring-Method: logprob

Theoretical grounding

This work is grounded in published research on model uncertainty and decision epistemology:

Epistemic risk model:
Wikström, B. (2026). When Alignment Reduces Uncertainty: Toward an Epistemic Risk Calculus for Deployed AI Systems. Zenodo. https://doi.org/10.5281/zenodo.18731535

Scoring engine:
Wikström, B. (2026). Epistemic Circuit Dynamics in Neural Architectures: Decomposing Confidence, Calibration, and Correctness. Zenodo. https://doi.org/10.5281/zenodo.18756421

Proof engine (OSS):
cognos-proof-engine — MIT-licensed reference implementation of the scoring formula, used in both benchmarks and production.

All scoring code is inspectable, falsifiable, and independently auditable. There are no hidden heuristics.

System architecture

Your Application
      │
      ├─ POST /v1/chat/completions
      │
      ▼
┌─────────────────────────────────────┐
│   TrustPlane Gateway (FastAPI)      │
│                                     │
│  1. Auth check (API key)            │
│  2. Rate limit (per tenant)         │
│  3. Request policy validation       │
│  4. Route to upstream provider      │
│  5. Score response (logprobs)       │
│  6. Enforce decision (PASS/BLOCK)   │
│  7. Log to audit DB                 │
│                                     │
└─────────────────────────────────────┘
      │
      ├─ Ollama (on-prem, air-gapped)
      ├─ OpenAI (GPT-4, o1, o3)
      ├─ Anthropic (Claude)
      ├─ Groq (high-throughput)
      └─ Cerebras (low-latency)

Multi-tenant isolation: PostgreSQL schema-per-tenant. No cross-tenant data leakage.

Audit trail: Every decision logged with request, response, risk score, decision, timestamp. Immutable schema for compliance.

Capabilities

Pluggable backends

Switch providers without application code changes. Fallback chains for zero-downtime failover.

Multi-tenant

Schema-isolated PostgreSQL. Tenant A cannot see Tenant B's traces or policies.

Policy-driven decisions

Configurable thresholds. Conservative defaults (favor escalation over silent pass).

Human oversight

ESCALATE and BLOCK trigger webhooks to your incident management system before user response.

EU AI Act aligned

Article 12 (record-keeping), Article 13 (transparency), Article 14 (human oversight) baked in.

Reproducible

Exact same scoring code in benchmark and production. Same random seed, same dataset, same grading = identical results across runs.

Production readiness

✅ Authentication & RBAC — API key + tenant isolation
✅ Rate limiting — Redis-backed token bucket
✅ Policy engine — Configurable thresholds, deterministic
✅ Audit logging — PostgreSQL per-tenant schema
✅ Compliance export — EU AI Act Article mapping
✅ Webhook dispatch — Incident escalation
✅ End-to-end tests — 43 passing tests
✅ Benchmark reproducibility — Fixed-seed dataset, deterministic grading

Not included in this release:

Multi-region failover (planned v1.3)
Fine-grained RBAC beyond tenant boundary (planned v1.2)
Custom prompt guardrails (planned v1.4)

Getting started

Local development (Ollama)

# Clone and install
git clone https://github.com/Applied-Ai-Philosophy/TrustPlane.git
cd TrustPlane
pip install -r requirements.txt

# Start Ollama locally (or use your endpoint)
ollama serve

# In another terminal, run the gateway
python -m gateway.main

# Test with a chat request
curl -X POST http://localhost:8788/v1/chat/completions \
  -H "X-API-Key: demo" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "llama3.2:3b",
    "messages": [{"role": "user", "content": "What is 2+2?"}],
    "cognos": {"mode": "enforce", "target_risk": 0.3}
  }'

Docker (production)

docker-compose up
# Gateway on :8788
# Dashboard on :3000
# PostgreSQL on :5432

Run the benchmark

cd benchmark
python run_benchmark.py --model llama3.2:3b --limit 200
# Outputs: results/llama3.2_3b_<timestamp>.json and .md report

Research & reproducibility

Dataset: TruthfulQA (Lin et al. 2022), seed 76, n=294 usable items
Scoring code: gateway/scoring.py (deterministic, no RNG)
Grading: Exact letter match (no LLM judge, no ambiguity)
Benchmark: Repeatable to bit-level with same seed

See REPRODUCIBILITY.md for full methodology.

Author & attributions

Project lead: Björn Wikström
Affiliation: Applied AI Philosophy research group
Lab: Base76 Research Lab, Sjöbo, Sweden
Contact: bjorn@applied-ai-philosophy.org

Key collaborators:

TruthfulQA dataset: Lin et al. (2022)
OpenAI logprobs API design & documentation
EU AI Act regulatory analysis: BMVI AI governance research unit

License: Functional Source License 1.1 (FSL-1.1-ALv2) — commercial use allowed with conversion to Apache 2.0 after 2-year non-compete period.

Next steps

July 2026: v1.2.0 — Fine-grained RBAC, per-role audit filters
August 2026: Benchmark on GPT-4o and Claude 3.5 Sonnet
September 2026: Dashboard v2 (real-time decision distribution, anomaly detection)
Q4 2026: Pilot deployments in healthcare and public sector

Support

Issues: GitHub Issues
Discussions: GitHub Discussions
Documentation: docs/
Reproducibility: REPRODUCIBILITY.md
Scoring algorithm: docs/ARCHITECTURE.md

Built with rigor. Deployed with confidence. { "trace_id": "tr_a3f91c2d44b1", "decision": "ESCALATE", "trust_score": 0.31, "tenant_id": "acme", "timestamp": "2026-03-02T14:22:11Z" }


### Audit trail
Complete trace history for every request. Exportable as CSV or EU AI Act Article 13 PDF report.

```bash
curl -H "X-API-Key: your-key" \
  "https://your-gateway/v1/audit/export?format=pdf&from=2026-01-01" \
  -o compliance_report.pdf

In air-gapped deployments, audit trail integrity is enforced through physical and network isolation — the same model used in defense, healthcare, and public sector infrastructure. No external process can reach the database. For deployments requiring additional guarantees, WAL archiving to write-once storage can be added above TrustPlane.

Deployment options

Self-hosted via Docker Compose (air-gap compatible). Your data never leaves your environment.

Claude Code & Anthropic API

TrustPlane integrates with Anthropic in two directions.

Claude as LLM backend — any Claude model behind the trust-scoring gateway:

provider: anthropic
model: claude-sonnet-4-6
api_key: ${ANTHROPIC_API_KEY}
target_risk: 0.3

TrustPlane as MCP server for Claude Code — expose trust verification as tools Claude Code can call during its own reasoning:

{
  "mcpServers": {
    "trustplane": {
      "command": "python",
      "args": ["/path/to/Cognos-enterprise/mcp/server.py"],
      "env": {
        "COGNOS_BASE_URL": "http://127.0.0.1:8788",
        "COGNOS_API_KEY": "your-key"
      }
    }
  }
}

Full setup guide: mcp/CLAUDE_CODE_SETUP.md

Quickstart

git clone https://github.com/base76-research-lab/TrustPlane.git
cd TrustPlane
cp .env.example .env        # Set COGNOS_PROVIDER + API key
docker-compose up

curl -X POST http://localhost:8788/v1/chat/completions \
  -H "X-API-Key: test-key" \
  -H "X-Cognos-Tenant: demo" \
  -H "Content-Type: application/json" \
  -d '{"model":"ollama/llama3.2:1b","messages":[{"role":"user","content":"Hello"}]}'

Architecture

┌─────────────────────────────────────────────────────┐
│                  Your Application                    │
└─────────────────────────┬───────────────────────────┘
                          │
                          ▼
┌─────────────────────────────────────────────────────┐
│                    TrustPlane                        │
│                                                     │
│   Auth & RBAC  →  Trust Scoring  →  Policy Engine   │
│                   C=p(1−Ue−Ua)     PASS/REFINE/     │
│                                    ESCALATE/BLOCK    │
│                                         │           │
│   Rate Limiting    Tenant Isolation     │           │
│   (Redis)          (per-schema PG)      │           │
│                                         ▼           │
│              ┌──────────────────────────────────┐   │
│              │         Provider Router           │   │
│              └───┬──────┬──────┬──────┬─────────┘   │
└──────────────────┼──────┼──────┼──────┼─────────────┘
                   │      │      │      │
                Ollama  OpenAI  Anthropic  Groq/Cerebras

Full diagram: docs/ARCHITECTURE.md

EU AI Act compliance

Designed for organizations operating high-risk AI systems under EU AI Act Annex III.

Following the Digital Omnibus (adopted June 2026), high-risk obligations apply from 2 December 2027 (stand-alone Annex III systems) and 2 August 2028 (AI in regulated products, Annex I). Building compliance infrastructure typically takes 6–12 months — organizations that start now do it under controlled conditions instead of deadline pressure.

Article	Requirement	How TrustPlane addresses it
Art. 9	Risk management system	Continuous epistemic scoring on every inference
Art. 12	Record-keeping	Immutable trace log with trace IDs and timestamps
Art. 13	Transparency	Automated PDF reports with full attestation summary
Art. 14	Human oversight	Webhook escalation before downstream consequences

Full compliance guide: docs/EU_AI_ACT.md

→ Technical whitepaper — theory, implementation, limitations, EU AI Act mapping

Licensing

TrustPlane is available for licensing to organisations and consultancies that need to deploy EU AI Act compliance infrastructure without building from scratch.

Three models available:

Single organisation — deploy internally, own the infrastructure
Reseller / consultancy — white-label for client deployments
Research / pilot partnership — co-develop for a specific domain (healthcare, finance, public sector)

→ licensing/LICENSE_OFFER.md — full terms and pricing

Contact: bjorn@base76.se

Use case scenarios

Detailed deployment scenarios with architecture diagrams:

Healthcare AI with automatic escalation — Clinical documentation, air-gapped Ollama, strict target_risk: 0.05
Legal AI with compliance audit trail — Contract analysis, Anthropic backend, 7-year retention
Public sector sovereign deployment — Air-gapped, national data sovereignty, full EU AI Act mapping

Pricing

License

TrustPlane is source-available under the Functional Source License (FSL-1.1-ALv2): free to use, modify and self-host for your own systems — only offering TrustPlane itself as a competing commercial service is restricted. Each release becomes Apache-2.0 after two years.

Fully MIT: the benchmark suite and the cognos-proof-engine scoring core.

Free

Self-hosted under FSL. 1 tenant. 100 requests/day. CSV export.

Self-hosted license — from €25,000/year

Your infrastructure. Air-gap compatible. Full source access.

Need a human-reviewed compliance report? Base76 Research Lab offers provider-facing EU AI Act Deep Audits - Article 11, 13, 14, 15 mapping, Annex III triage. From €20K. https://base76research.com/deep-audit

Enterprise consulting

Architecture review, policy calibration, compliance documentation, ongoing support. For healthcare, legal, finance, and public sector deployments.

Contact: bjorn@base76.se

Free vs Enterprise

Feature	Free	Enterprise
Trust scoring (PASS/REFINE/ESCALATE/BLOCK)	✓	✓
All LLM providers	✓	✓
Trace history + CSV export	✓	✓
Webhooks	1 endpoint / 100 events/day	Unlimited
Tenants	1	Unlimited
Rate limit	100 req/day	Configurable
PDF audit reports (EU AI Act)	✗	✓
Fallback providers	✗	✓
Custom RBAC roles	✗	✓
SLA + support	✗	✓

Built on open source

TrustPlane is the production layer on top of cognos-proof-engine (MIT). The scoring engine is open and auditable. TrustPlane adds multi-tenancy, auth, webhooks, audit exports, and commercial support.

cognos-session-memory — Verified context injection
token-compressor — Context compression for long sessions

Base76 Research Lab — Sjöbo, Sweden