Medium Assurance

What was the AI asked to do?

Medium Assurance captures the full prompt text, prompt classification, and context files provided to the AI — linking every generated line of code back to the exact instruction that produced it.

Storage overhead: ~2–10 KB per annotation

Builds on everything in Low Assurance

What This Level Captures

Medium Assurance adds prompt context to Low Assurance's environment and command tracking. It answers "what instruction produced this code?" for every annotated line or function.

Prompt Context (new at Medium)

Prompt Type Classification

The prompt_type field uses one of seven enumerated values:

user_instruction edit_command chat_message inline_completion review_request refactor_request other

Annotation Enhancement

Decision Context (mandatory when evaluating multiple approaches)

Structured decision records are mandatory at all assurance levels when the AI evaluates multiple approaches. They capture the options considered, the selection made, and the rationale behind it.

Inherited from Low Assurance

Why This Data Matters

Knowing what the AI was asked is qualitatively different from knowing which AI was used. Prompt context transforms your audit trail from an inventory into an evidence record.

Reproducibility

Given the same model, prompt, and context files, output can be reproduced and compared. If a function behaves unexpectedly, you can re-run the exact instruction that created it to verify whether the model produces consistent results or if parameters drifted.

Audit Trail

Auditors can verify that the AI followed instructions correctly. Each code change links to the prompt that triggered it — a complete chain from developer intent to generated output. "Show me the instruction that produced validate_signup()" becomes a single query.

Compliance

Regulated industries (finance, healthcare, automotive) can demonstrate that AI-generated code was produced from specific, documented instructions. Medium Assurance provides the evidence trail that compliance frameworks increasingly require for AI-assisted development.

Code Review Enrichment

Reviewers see not just what changed, but what the developer asked the AI to do. A diff showing a new rate limiter gains context when accompanied by the prompt: "Add rate limiting to the signup endpoint. Max 5 attempts per IP per hour." Review becomes verification, not guesswork.

Incident Response

When a bug or vulnerability is found in AI-generated code, trace back to the exact prompt that produced it. Was the instruction ambiguous? Did the prompt lack important constraints? Medium Assurance turns "what went wrong?" into "what was asked that led to this?"

Example Data

Medium Assurance stores prompt context in the manifest and links it to annotations via SHA-256 hash — the same content-addressed pattern used for environment and command context.

Prompt Context Record

Stored in manifest.json — records the exact instruction sent to the AI.

"a1b2c3d4e5f6a7b8...": { "type": "prompt", "prompt_text": "Create a signup endpoint that validates email format and password strength.", "prompt_type": "user_instruction", "prompt_context_files": [ "src/models/user.py" ], "created_at": "2026-02-03T10:05:00Z" }
Example: Prompt with multiple context files
"b2c3d4e5f6a7b8c9...": { "type": "prompt", "prompt_text": "Add rate limiting to the signup endpoint. Max 5 attempts per IP per hour.", "prompt_type": "user_instruction", "prompt_context_files": [ "src/routes/auth.py", "src/middleware/rate_limit.py" ], "created_at": "2026-02-03T14:20:00Z" }

Line Annotation with Prompt Hash

Stored in annotations.jsonl — note the prompt_hash field linking code to the instruction that produced it.

{ "type": "line", "file_path": "src/routes/auth.py", "line_start": 1, "line_end": 45, "environment_hash": "e7a3f1b2c4d5e6f7...", "prompt_hash": "a1b2c3d4e5f6a7b8...", "action": "create", "timestamp": "2026-02-03T10:05:00Z", "commit_hash": "abc123def456", "session_id": "550e8400-e29b-41d4-a716-446655440000", "assurance_level": "medium", "anchor_context": "def validate_signup(email, password):\n ...", "anchor_hash": "a9b8c7d6...", "file_content_hash": "1a2b3c4d...", "risk_score": 0.42, "risk_factors": [ {"signal": "action_type", "value": 0.6, "weight": 0.15}, {"signal": "scope_lines", "value": 0.35, "weight": 0.15}, {"signal": "assurance_gap", "value": 0.5, "weight": 0.10} ] }
Example: Multiple annotations from different prompts
// First prompt creates the auth endpoint {"type":"line","file_path":"src/routes/auth.py","line_start":1,"line_end":45, "environment_hash":"e7a3f1b2c4d5...","prompt_hash":"a1b2c3d4e5f6...", "action":"create","timestamp":"2026-02-03T10:05:00Z", "assurance_level":"medium"} // Second prompt modifies lines 12-28 to add rate limiting {"type":"line","file_path":"src/routes/auth.py","line_start":12,"line_end":28, "environment_hash":"e7a3f1b2c4d5...","prompt_hash":"b2c3d4e5f6a7...", "action":"modify","timestamp":"2026-02-03T14:20:00Z", "assurance_level":"medium"} // Same prompt also creates a new rate limiter middleware file {"type":"line","file_path":"src/middleware/rl.py","line_start":1,"line_end":32, "environment_hash":"e7a3f1b2c4d5...","prompt_hash":"b2c3d4e5f6a7...", "action":"create","timestamp":"2026-02-03T14:22:00Z", "assurance_level":"medium"}

Decision Context Record

Stored in manifest.json — records structured decisions when the AI evaluates multiple approaches. Referenced from annotations via decision_hash.

Example: Decision context entry (authentication strategy)
{ "type": "decision", "decision_point": "Which authentication strategy to use", "options": [ { "id": "A", "description": "JWT tokens", "pros": ["Stateless", "Horizontal scaling"], "cons": ["Token revocation complexity"] }, { "id": "B", "description": "Server sessions", "pros": ["Simple revocation"], "cons": ["Requires session store"] } ], "selected": "A", "rationale": "JWT chosen for horizontal scalability requirements", "confidence": "high", "created_at": "2026-02-18T14:00:00Z" }
Example: Complete Medium config.json
{ "standard": "VIBES", "standard_version": "1.0", "assurance_level": "medium", "project_name": "signup-service", "tracked_extensions": [".py"], "exclude_patterns": ["**/test/**"], "risk_scoring": { "enabled": false } }
Example: DuckDB query — all code from a specific prompt
-- Find all code changes triggered by a specific prompt SELECT file_path, line_start, line_end, action, timestamp FROM read_json_auto('.ai-audit/annotations.jsonl') WHERE type = 'line' AND prompt_hash LIKE 'b2c3d4e5f6a7b8c9%' ORDER BY file_path, line_start;

Who Should Use This Level

Medium Assurance is designed for teams that need to trace AI-generated code back to the instructions that produced it. If "what tool was used?" isn't enough and you need "what was it asked?", this is your level.

If you only need to know which tool and model were used, Low Assurance is simpler and has lower overhead. If you also need to know how the AI reasoned (chain-of-thought traces), upgrade to High Assurance.

Beyond source code: Medium Assurance prompt records are equally applicable to non-code workflows. Agents executing financial transactions, infrastructure changes, or content moderation decisions can use the same prompt capture model for audit compliance.

Security Considerations

Medium Assurance captures prompt text, which may contain sensitive information. Review your audit data before committing to public repositories.

Prompt Text May Contain Sensitive Data

Prompts can inadvertently include API keys, internal documentation references, proprietary business logic, or personal information. Projects operating at Medium Assurance should:

• Review manifest.json before committing to public repositories
• Use .gitignore to exclude manifest.json if prompts contain confidential instructions
• Consider encrypting sensitive manifest entries at rest
• Establish prompt hygiene practices — avoid pasting credentials into AI chat sessions

Implementation

Medium Assurance builds on Low with moderate additional effort. Tools must capture the prompt text before each generation event and compute its content-addressed hash.

On session start (same as Low)

Compute the environment context hash from tool name, version, model name, and version. If the hash doesn't exist in manifest.json, add it. Append a "session" / "start" record to annotations.jsonl.

On pre-generation new

Before sending the request to the AI model, capture the full prompt text, classify the prompt_type, and record which files were provided as context. Compute the prompt hash using canonical JSON (sorted keys, no whitespace) → SHA-256. Write the prompt context entry to manifest.json if the hash is new.

On post-generation enhanced

Append line annotation records to annotations.jsonl as in Low Assurance, but include the prompt_hash field. This links every generated line or function to the specific instruction that produced it.

PRISM computation (optional)

If risk_scoring.enabled is true in config.json, compute a PRISM score from available signals. At Medium, you have access to prompt_token_count in addition to Low-level signals. Include risk_score and risk_factors in the annotation record. PRISM is a standalone extension on top of VIBES.

On architectural decision new

When the AI evaluates multiple approaches, create a decision context manifest entry recording the options, selection, and rationale. Compute its content-addressed hash using canonical JSON → SHA-256. Reference via decision_hash in subsequent annotations produced by that decision.

On tool invocation (same as Low)

When the AI executes a shell command, file operation, or API call, compute a command context hash and add it to manifest.json if new. Include the command_hash in associated annotation records.

On commit (required, same as Low)

Backfill the commit_hash field on all annotation records created since the last commit. This field is required — every annotation must be linked to its git commit.

On session end (same as Low)

Append a "session" / "end" record to annotations.jsonl with the session ID and timestamp.

The key addition is step 2: capturing prompt text before generation. The hash computation follows the same content-addressed pattern as environment and command hashes. For detailed implementation guidance, see the Implementors Guide or the full RFC specification.

Explore All Assurance Levels

Low Assurance Medium Assurance High Assurance

Back to the VIBES Standard overview →

Medium assurance data is the foundation for VERIFY attestation (prompt-level traceability) and PRISM risk scoring (prompt complexity as a PRISM signal).

Back to The Standard