# Use Cases

Source: https://www.primust.com/use-cases
HTML title: A VPEC Is A New Kind Of Artifact — Primust
Meta description: Four concrete moments where a VPEC changes the outcome: audits, reinsurer review, OPA policy proof, and AI-liability underwriting.

← Primust · Use Cases
# A VPEC is a new kind of artifact. _Not a log. Not a report._

These are four moments where a portable, offline-verifiable credential matters more than a dashboard, a screenshot, or a self-reported log stream.

§ 01 — The primitive

## A VPEC is a new kind of artifact. _Not a log. Not a report._

A Verifiable Process Execution Credential is a cryptographic record proving that defined governance checks ran on specific data — verifiable offline, without asking your dashboard for permission. Ed25519-signed, RFC 3161 timestamped, content-blind by construction.

These are four real moments where having a VPEC instead of a log makes the difference. If one of them sounds familiar, that's where to start.

§ 02 — Moment 1 · Compliance · EU AI Act

## Your auditor asked for proof. _You showed them logs._

Under the current EU implementation timeline, high-risk AI obligations for Annex III systems and transparency rules apply from **August 2, 2026**. An auditor asks for evidence that your AI governance checks ran on a specific deployment. You show them dashboards, log files, screenshots. The auditor says: _how do I know these checks actually ran on this data, on this date, and produced this result?_ You don't have an answer.

The artifact gives them something to test: signature, timestamp, committed inputs and outputs, declared checks, proof floor, and gaps. They verify the artifact instead of relying on your dashboard narrative.

AI Governance industry page →

The log — not enough

2026-03-16 09:14:01 INFO pii_check passed

2026-03-16 09:14:01 INFO tool_auth passed

2026-03-16 09:14:02 INFO output_check passed

Self-reported. Anyone can write this.

The VPEC — proof

VERIFIED

floor execution

surface 0.73

checks 14 executed · 1 gap declared

commitment poseidon2:a1b2c3…

signed ✓ Ed25519

timestamp ✓ RFC 3161

issuer

kid_live

bundle

eu_ai_act

offline

yes

G-017 model monitor outside run

Cryptographically signed. Verifiable offline without dashboard access.

§ 03 — Moment 2 · Reinsurer · Insurance

## The reinsurer needs the file. _You can't send it._

Cedant

Adjudicates claim

Issues VPEC

Claim file stays here.

→

VPEC

Reinsurer

✓ VALID

adjudication ran

treaty terms verified

claim file never seen

Guidewire ClaimCenter connector — 38 tests shipped. Python REST. Attestation ceiling.

Your reinsurer needs to verify that claims adjudication ran per treaty terms. The standard request is the claim file. But the claim file contains policyholder PII. You can't send it. They can't verify without it. This is the structural proof problem that keeps reappearing in insurance workflows.

A VPEC from Guidewire ClaimCenter proves adjudication ran per treaty terms — without the claim file ever leaving your environment. The reinsurer verifies the credential. The chain is intact. The stalemate is over.

Insurance industry page →

§ 04 — Moment 3 · DevOps · Any Industry

## OPA already governs the request. _Make the next decision verifiable._

Your OPA policies may already guard every request. Today that gives you authorization and logs: useful, but not a portable proof artifact. Add Primust at the evaluation boundary and each new decision emits a VPEC bound to the policy version, input commitment, output, and timestamp.

OPA evaluations are deterministic: same input, same policy, same output. That determinism is why an instrumented `eval()` can reach _Mathematical_ proof. One Go package, no policy rewrite, no platform replacement.

Software / Technology industry page →

OPA → Mathematical proof

# go get github.com/primust-dev/primust-opa

result = client.Eval(ctx, query, input)

# New evals → Mathematical-level VPECs

✓ proof_level_floor: mathematical

OPA

Go

Cedar

Java

Drools

Java

IBM ODM

Java

Regex

Any

Threshold

Any

Once wrapped, same input + same policy produces a Mathematical-level credential for that decision.

§ 05 — Moment 4 · Underwriter · AI Liability

## The insurer asks for evidence. _Not configuration._

An insurer is writing an AI liability policy. They ask for evidence that your governance controls are effective — not that they're _configured_, but that they actually fired and blocked something. Self-reported dashboards aren't auditable. Log files can be manipulated. There's no CVSSv3 for AI governance quality. They can't price the risk.

VPECs can become that measurement layer. `blocked_count > 0` shows controls fired. `provable_surface` over 90 days gives underwriters cleaner runtime data than screenshots or self-reported dashboards.

Insurance industry page →

90-day governance record

total_vpecs 847,293

blocked_count 2,847

provable_surface_avg 0.73

mathematical_pct 0.62

gaps_critical 0

waivers_active 3

risk_treatment accept · mitigate · accept

For the underwriter

blocked_count > 0 shows controls fired. provable_surface over 90 days is machine-readable runtime data. Not self-reported. Not a dashboard. A cryptographic record.

§ 06 — Get started

## First VPEC in _five minutes._

`pip install primust && primust init`. Sandbox key, free and unlimited. No re-instrumentation when you go to production. The verifier is Apache-2.0 and runs without a live Primust API.

Get started free View industries →