Reference58 documented claims
Claim Ledger.
Verified statements with approved wording, source links, and clear boundaries for how each claim should be used.
BL-CLM-10Verified
NARA is the executive agent for the government-wide CUI program and publishes CUI marking guidance and resources.NARAVerified September 30, 2026BL-CLM-7Verified
GSA's public API directory includes http://SAM.gov opportunity, contract-award, federal-hierarchy and related procurement APIs.GSA/SAMVerified September 30, 2026BL-CLM-4Verified
Auditors issued 2,485 notices of findings and recommendations to DoD/DoW management in 2025.DoD OIGVerified September 30, 2026BL-CLM-1Verified
15 federal agencies estimated about $186B in improper payments across 64 programs in FY2025.GAOVerified September 30, 2026BL-CLM-12Verified
NIST's AI RMF and Generative AI Profile are intended to help organizations manage AI risks across the AI lifecycle.NISTVerified September 30, 2026BL-CLM-2Verified
About $153B of FY2025 estimated improper payments were overpayments.GAOVerified September 30, 2026BL-CLM-8Verified
Treasury Fiscal Data provides machine-readable federal financial datasets with APIs, historical/current data and data dictionaries.Treasury Fiscal DataVerified September 30, 2026BL-CLM-9Verified
NIST SP 800-171 Rev. 3 applies security requirements to components of nonfederal systems that process, store or transmit CUI.NISTVerified September 30, 2026BL-CLM-6Verified
USAspending's public API exposes comprehensive federal award and account-level spending data and its listed endpoints do not currently require authorization.USAspendingVerified September 30, 2026BL-CLM-5Verified
DoD/DoW tracks funds through more than 426 financial systems.DoD OIGVerified September 30, 2026BL-CLM-3Verified
The FY2025 DoD/DoW financial statement audit identified 26 material weaknesses.DoD OIGVerified September 30, 2026BL-CLM-13Verified
NIST AI 600-1 is a cross-sectoral generative AI profile supporting risk management throughout the AI lifecycle.NISTVerified 2026-10-09BL-CLM-14Verified
τ-bench evaluates tool-using agents against goal database states and tests consistency across repeated trials under domain policies.arXivVerified 2026-10-09BL-CLM-15Verified
Anthropic distinguishes workflows with predefined code paths from agents that dynamically direct their processes and tool use.AnthropicVerified 2026-10-09BL-CLM-16Verified
GAO identified 11 critical federal legacy systems in need of modernization; plans for eight did not fully document key elements.GAOVerified 2026-10-09BL-CLM-17Verified
Microsoft documents capture, navigation and method definitions for mapping 3270 screens and fields into HIDX metadata used by its connector.MicrosoftVerified 2026-10-09BL-CLM-18Verified
Papyrus — What it does: Document automation, internal app creation and legacy system enablement with governed agent execution.Beag Labs (first party)Verified October 13, 2026BL-CLM-19Verified
Papyrus — Deployment model: Customer-hosted: a Papyrus VM in the customer's Azure subscription, or on-premises, restricted or disconnected environments.Beag Labs (first party)Verified October 13, 2026BL-CLM-20Verified
Papyrus — Azure Marketplace offer: Azure Marketplace private offer that deploys the Papyrus VM into the customer's subscription.Beag Labs (first party)Verified October 13, 2026BL-CLM-21Verified
Papyrus — Human approval: Governed execution: consequential actions are reviewed and work stays visible as it progresses.Beag Labs (first party)Verified October 13, 2026BL-CLM-22Verified
Papyrus — Licensing: Commercial: a signed organization license (offline) or a customer-specific Azure private offer.Beag Labs (first party)Verified October 13, 2026BL-CLM-24Verified
Papyrus — Intended buyer: Organizations that need back office automation on their own infrastructure, in business and government settings.Beag Labs (first party)Verified October 13, 2026BL-CLM-25Verified
Papyrus — Public pricing: No public price card; commercial terms are scoped to the deployment.Beag Labs (first party)Verified October 13, 2026BL-CLM-26Verified
Corral AI (identified as 'Corral Sovereign AI') — What it does: Deploy into your cloud, connect data, build agents via Agent Builder; per-user Hub assistant, embeddable widgets.Corral (vendor site)Verified October 13, 2026BL-CLM-27Verified
Corral AI (identified as 'Corral Sovereign AI') — Deployment model: Deploys into the customer's own Azure tenant and subscription; AWS and GCP listed as coming 2026.Corral (vendor site)Verified October 13, 2026BL-CLM-28Verified
Corral AI (identified as 'Corral Sovereign AI') — Azure Marketplace offer: Vendor site links a 'Corral AI managed app' Azure Marketplace listing (azure-application URL path).Corral (vendor site)Verified October 13, 2026BL-CLM-29Verified
Corral AI (identified as 'Corral Sovereign AI') — Human approval: Admin approval gates the agent publish flow, and high-risk actions need a human after untrusted content; other actions are not described.Corral (vendor site)Verified October 13, 2026BL-CLM-30Verified
Corral AI (identified as 'Corral Sovereign AI') — Security controls: Documented: on-tenant residency, private endpoints/VNet, immutable audit trail, content filtering/PII detection, identity-provider governance.Corral (vendor site)Verified October 13, 2026BL-CLM-31Verified
Corral AI (identified as 'Corral Sovereign AI') — Intended buyer: Lists Ops & Product Teams, IT & Security Teams, Developers, Service Providers/SIs, Product Companies.Corral (vendor site)Verified October 13, 2026BL-CLM-32Verified
Corral AI (identified as 'Corral Sovereign AI') — Public pricing: No prices listed; platform subscription plus Azure infra costs via Marketplace, counting toward MACC; Enterprise plan via 'Talk to us'.Corral (vendor site)Verified October 13, 2026BL-CLM-33Verified
HeartBeatAgents — What it does: Autonomous agents on standing orders with tools, integrations, three-layer local memory, and reusable skills.HeartBeatAgents (vendor site)Verified October 13, 2026BL-CLM-34Verified
HeartBeatAgents — Deployment model: Self-hosted: desktop download (macOS DMG) on vendor site; AWS listing ships an AMI run in buyer's AWS account.AWS Marketplace listing (vendor: Mosaic Singularity)Verified October 13, 2026BL-CLM-35Verified
HeartBeatAgents — Human approval: Only simple 'Ask User' and 'Present Choices' skills let an agent request approval or a choice; no broader approval policy is described.HeartBeatAgents (vendor site)Verified October 13, 2026BL-CLM-36Verified
HeartBeatAgents — Licensing: AWS listing: EULA applies; community edition with one worker, more workers via separately purchased license.AWS Marketplace listing (vendor: Mosaic Singularity)Verified October 13, 2026BL-CLM-37Verified
HeartBeatAgents — Security controls: Documented: AES-256 at rest, TLS 1.2+, per-organization container folder scoping, token-authenticated websockets, token scrubbing.HeartBeatAgents (vendor site)Verified October 13, 2026BL-CLM-38Verified
HeartBeatAgents — Intended buyer: AWS listing targets organizations wanting production-ready self-hosted agentic AI infrastructure.AWS Marketplace listing (vendor: Mosaic Singularity)Verified October 13, 2026BL-CLM-39Verified
HeartBeatAgents — Public pricing: No prices listed; AWS listing says community edition with one worker, billing external via vendor license.AWS Marketplace listing (vendor: Mosaic Singularity)Verified October 13, 2026BL-CLM-40Verified
OpenClaw — What it does: Single Gateway links chat channels to AI agents with tools, sessions, memory, skills, cron/webhooks, a web Control UI, and mobile nodes.OpenClaw (first-party docs)Verified October 13, 2026BL-CLM-41Verified
OpenClaw — Deployment model: Runs on your own laptop or server; install via script, npm, Docker, Nix or source; remote access via SSH/Tailscale. README says no hosted service.OpenClaw (first-party repo)Verified October 13, 2026BL-CLM-42Verified
OpenClaw — Human approval: Exec approvals (deny, allowlist, ask, auto, full) gate host command execution only and can be switched off; not a general approval layer.OpenClaw (first-party docs)Verified October 13, 2026BL-CLM-43Verified
OpenClaw — Licensing: MIT License, copyright OpenClaw Foundation (2026).OpenClaw (first-party repo)Verified October 13, 2026BL-CLM-44Verified
OpenClaw — Security controls: Gateway auth, DM pairing and allowlists, optional sandboxing (off by default) and an audit CLI; documented as a single-trusted-operator model, not a multi-tenant boundary.OpenClaw (first-party repo and docs)Verified October 13, 2026BL-CLM-45Verified
OpenClaw — Intended buyer: Individuals wanting a personal assistant, teams sharing a gateway, and enterprise/security teams hardening via configuration, not a separate edition.OpenClaw (first-party docs)Verified October 13, 2026BL-CLM-46Verified
OpenClaw — Public pricing: README says no paid tier, hosted service, or token. Model API and hosting costs are borne by the user.OpenClaw (first-party repo)Verified October 13, 2026BL-CLM-47Verified
OpenHands — What it does: Coding agents via Agent Canvas (browser client), Software Agent SDK/Agent Server, CLI, plus scheduled/webhook automations.OpenHands (first-party docs and repo)Verified October 13, 2026BL-CLM-48Verified
OpenHands — Deployment model: Local/self-hosted (npm, Docker), plus OpenHands Cloud (managed) and OpenHands Enterprise (licensed self-host in your VPC or managed).OpenHands (first-party site and docs)Verified October 13, 2026BL-CLM-49Verified
OpenHands — Human approval: SDK confirmation policies (always, never, risky) can require approval of actions; documented for the SDK, and one call path bypasses them.OpenHands (first-party docs)Verified October 13, 2026BL-CLM-50Verified
OpenHands — Licensing: Root LICENSE of OpenHands/OpenHands is MIT (OpenHands contributors, 2025). Docs say each repository has its own license.OpenHands (first-party repo)Verified October 13, 2026BL-CLM-51Verified
OpenHands — Security controls: Docs name: Docker sandbox isolation for the agent server, security analyzers with risk levels, Enterprise SAML/SSO, RBAC and access controls (Cloud).OpenHands (first-party docs and site)Verified October 13, 2026BL-CLM-52Verified
OpenHands — Intended buyer: Developers and engineering teams, including enterprises wanting control over models, data, access and auditability.OpenHands (first-party site)Verified October 13, 2026BL-CLM-53Verified
OpenHands — Public pricing: Local open source: free. SaaS Individual: free, 10 daily conversations. Enterprise: custom pricing, contact sales.OpenHands (first-party site)Verified October 13, 2026BL-CLM-54Verified
Websoft9 — What it does: App store with one-click install of 300+ apps, plus app lifecycle, file manager, terminal, proxy/SSL, backups, monitoring.Websoft9 (vendor, GitHub)Verified October 13, 2026BL-CLM-55Verified
Websoft9 — Deployment model: Self-hosted on your own server, running as Docker containers.Websoft9 (vendor, GitHub)Verified October 13, 2026BL-CLM-56Verified
Websoft9 — Azure Marketplace offer: Docs say Websoft9 is an Azure Marketplace partner; products are VM images deployed to an Azure VM.Websoft9 (vendor docs)Verified October 13, 2026BL-CLM-57Verified
Websoft9 — Licensing: Repository states LGPL-3.0 and homepage says 100% open source; republishing images to cloud marketplaces without authorization is prohibited.Websoft9 (vendor, GitHub)Verified October 13, 2026BL-CLM-58Verified
Websoft9 — Security controls: Multi-user accounts with role-based access; SSL certificates via Let's Encrypt; apps isolated through Docker.Websoft9 (vendor, GitHub)Verified October 13, 2026BL-CLM-59Verified
Websoft9 — Intended buyer: Cloud architects, IT teams and SMBs without dedicated IT, plus software vendors, integrators and cloud providers.Websoft9 (vendor)Verified October 13, 2026BL-CLM-60Verified
Websoft9 — Public pricing: Software plans: Free 0, Starter CNY 20/mo, Standard CNY 99/mo (per vendor pricing page); Azure image billing not described.Websoft9 (vendor)Verified October 13, 2026