VDI Circuit Coverage & Bypass Audit (v1.0)

This document provides auditor-facing evidence for A. Circuit Correctness & Completeness in the VDI Audit Framework.

Scope

In scope:

• Enforced policy circuits:
  • fairLending
  • hipaaAccess
  • euAiAct
  • soc2Access
• Policy compiler and witness mapping:
  • protocol/lib/policyCompiler.js
• Differential bypass tests:
  • protocol/test/policy-bypass.test.js

Out of scope:

• Legal interpretation of regulation semantics
• Business rules not encoded in circuit/policy constraints

Rule-to-Constraint Traceability

fair-lending-v1 → fairLending

Policy source: protocol/lib/policyCompiler.js
Circuit source: protocol/circuits/fairLending.circom

• no_protected_class:
  • policy field: protected_class_used
  • circuit: protected_class_used === 0
• min_credit_score:
  • policy field: credit_score >= min_credit_score
  • circuit: GreaterEqThan(16) on credit_score vs min_credit_score
• max_dti_x100:
  • policy field: debt_to_income <= max_dti_x100 / 100
  • circuit: LessEqThan(16) on debt_to_income_x100 vs max_dti_x100
• approval gating:
  • policy: approval requires all checks; denial is safe
  • circuit: invalid_approval = loan_approved * (1 - both_pass); invalid_approval === 0

hipaa-access-v1 → hipaaAccess

Policy source: protocol/lib/policyCompiler.js
Circuit source: protocol/circuits/hipaaAccess.circom

• bulk_export_attempted == 0:
  • circuit: binary flag + bulk_export_attempted === 0
• authorization_level >= min_auth_level:
  • circuit: GreaterEqThan(8)
• data_fields_accessed <= max_fields:
  • circuit: LessEqThan(8)
• purpose_code >= min_purpose_code:
  • circuit: GreaterEqThan(8)
• access gating:
  • circuit: invalid_grant = access_granted * (1 - all_pass); invalid_grant === 0

eu-ai-act-v1 → euAiAct

Policy source: protocol/lib/policyCompiler.js
Circuit source: protocol/circuits/euAiAct.circom

• unassessed_deployment == 0
• risk_level >= min_risk_level
• human_oversight_score >= min_oversight_score
• transparency_score >= min_transparency_score
• compliance output gating via conditional approval constraints

soc2-access-v1 → soc2Access

Policy source: protocol/lib/policyCompiler.js
Circuit source: protocol/circuits/soc2Access.circom

• review_bypass == 0
• auth_factor_count >= min_auth_factors
• permission_level <= max_permission_level
• session_timeout_minutes <= max_session_timeout
• authorization output gating via conditional approval constraints

Differential Bypass Campaign

Test suite: protocol/test/policy-bypass.test.js

Method

For each policy:

1. Start from a known-valid approval decision.
2. Apply one mutation intended to bypass a specific rule.
3. Assert validateDecision(policyId, decision).valid === false.
4. Assert failure details identify the expected rule family.

Mutation Matrix

• fair-lending-v1:
  • protected_class_used = true
  • credit_score below threshold
  • debt_to_income above threshold
• hipaa-access-v1:
  • bulk_export_attempted = true
  • authorization_level below threshold
  • data_fields_accessed above threshold
• eu-ai-act-v1:
  • unassessed_deployment = true
  • human_oversight_score below threshold
  • transparency_score below threshold
• soc2-access-v1:
  • review_bypass = true
  • auth_factor_count below threshold
  • session_timeout_minutes above threshold

Safe-Denial Checks

The suite also verifies denial-path behavior remains valid where intended by policy design:

• fair-lending-v1: denial allowed even when applicant metrics fail thresholds.
• hipaa-access-v1: denial allowed even when access metrics fail thresholds.

Reproducibility

Run the full audit suite:

bash protocol/scripts/run-vdi-audit-suite.sh

Run only bypass/traceability checks:

cd protocol
node --test test/policy-bypass.test.js

Current Verdict

• Rule-to-constraint mapping is explicit and test-backed for all enforced policy circuits listed above.
• Differential bypass attempts in the mutation matrix are rejected.
• Deterministic policy parameter compilation and policy-hash variance on override changes are covered in tests.
• This evidence supports A1-A3 in the VDI Audit Framework.