AL3 — Certified
AL3 represents the highest assurance level — enterprise-grade certification with continuous monitoring and annual recertification.
Criteria
| Criterion | Requirement |
|---|---|
| All AL2 Criteria Met | All criteria from AL2 satisfied across all domains being certified (or a defined subset for partial certification) |
| Full Cryptographic Provenance | Complete provenance chain demonstrated across entity's entire content portfolio — not just sample content but representative coverage of all published material |
| Policy Enforcement Validation | Policy enforcement validated against all four core primitives: agent identity, provenance lineage, consent rules, and session/key models |
| Annual Recertification | Annual recertification completed by AAA with updated attestation certificate — includes HSM key rotation verification, cross-domain linkage review, and performance benchmark re-check |
Badge Issued
Per-domain badges: [DOMAIN]-AL3 (e.g., TRNS-AL3 — "Certified in Transactional Integrity")
Guarantee
The entity's identity is enterprise-verified with hardware-backed keys and continuous monitoring. Its provenance chain has real-time streaming verification at every link. All cross-domain safety boundaries are enforced in real-time via Domain Working Group feeds. Emergency revocation propagates within 15 minutes of critical threat detection.
Verification Method
AAA conducts on-site inspection (where applicable), verifies HSM key storage, executes full portfolio provenance audit, validates policy enforcement across all four primitives, performs annual recertification with updated certificate.