---
title: "What QWED does not verify"
description: "The boundary of QWED: what it does not check, what it depends on, what a signature does and does not prove, and the limits each package states for itself."
url: https://qwedai.com/limits
---

# What QWED does not verify

A check is only useful if you know where it stops. This page sets out what QWED does not verify, what its results depend on, and the limits each package states for itself. A claim outside these lines comes back UNVERIFIABLE, and is denied by default.

## Intent

QWED verifies the formal statement it is given or extracts, not whether that statement is what someone meant. A correct sum of the wrong numbers is still a correct sum. Deciding that the right question was asked stays with the people and systems around QWED.

## The translation step

Some checks start from natural language. For those (`/verify/natural_language` and `/verify/logic`), QWED asks the model you configure to turn the text into a formal statement. That translation is not itself verified.

-   The formal statement is part of every result, so a person or a policy can check that it says what was meant.
-   The prompt goes to the provider you configure. With a model you run yourself, for example through Ollama, nothing leaves your infrastructure.
-   Optional PII masking (`qwed[pii]`) redacts card numbers, social security numbers and email addresses before the model call.

## Coverage

QWED does not cover every kind of claim. A claim that no engine supports comes back `UNVERIFIABLE`, never `VERIFIED`. Within the engines, three limits matter most:

-   **Advisory engines do not decide.** Fact, Graph, Image, Reasoning and Consensus produce signals for review. Heuristic and model-based results are never reported as `VERIFIED`; Graph, Image and Consensus can return it only on a deterministic sub-path that carries a proof.
-   **Symbolic searches, it does not prove.** It looks for counterexamples with CrossHair and returns `UNVERIFIABLE` or `BLOCKED`.
-   **Running code is not verifying it.** The Stats engine executes statistical code in a sandbox and returns `UNVERIFIABLE`.

[What each engine may claim](https://qwedai.com/engines)

## Soundness

A result is only as sound as the tools behind it: SymPy, Z3, SQLGlot, CrossHair and QWED’s own rule sets. When one of them gets it wrong, so can QWED. Every such case found so far is published as a security advisory with the version that fixes it.

**6** advisories where a check returned `VERIFIED` for a false claim **5** advisories where a guard let through something it should have stopped

The proof engines are also tested at every release on claims with a known answer. [The latest results](https://qwedai.com/evidence) · [The full track record](https://qwedai.com/security#record)

## Enforcement

QWED returns a result and an admission decision. It does not stop anything by itself. Your integration acts on `DENY`, or a QWED product does it for you: QWED Security, for example, fails the pull request check. If an integration ignores the decision, QWED cannot prevent the action.

## What a signature proves

QWED products that sign their results sign them with their own key. The [Verification Context specification](https://github.com/QWED-AI/qwed-verification/blob/main/spec/v1.0/verification-context.md) is explicit about what that does and does not establish:

-   It shows that the signed bytes came from the holder of that key, and were not changed afterwards.
-   It does not establish independent trust, validate the formal statement, make a proof stronger or imply admission.
-   An independent witness for signatures, the root of trust, is an open question for a future version of the specification.

## Package by package

Each package states its own limits in its README. They are repeated here, with the development status the package declares on PyPI.

-   ### [QWED Finance](https://qwedai.com/platform/finance)

    Beta

    -   QWED Finance checks figures and messages. It is not a trading platform, a market data feed or a replacement for your risk models.
    -   Checks for MiFID II and Basel III are still in progress.
-   ### [QWED Legal](https://qwedai.com/platform/legal)

    Beta

    -   QWED Legal is not a legal reasoning engine and not a replacement for lawyers. Interpretive legal reasoning is never trusted automatically.
    -   Clause, citation and fairness checks are signals for review, not proofs. The fairness check uses a model you supply.
-   ### [QWED Tax](https://qwedai.com/platform/tax)

    Status not declared

    -   QWED Tax is not a calculator, a filing platform or a payroll system. It checks decisions that an AI or another system has made.
    -   It covers specific rules for the United States and India, not every tax regime. It does not file returns.
-   ### [QWED Infra](https://qwedai.com/platform/infra)

    Status not declared

    -   QWED Infra currently focuses on AWS and Terraform. Kubernetes and Azure are on the roadmap.
    -   NetworkGuard does not model NAT gateways, VPC peering, network ACLs or Transit Gateway. When they are present it returns UNVERIFIABLE instead of guessing.
-   ### [Open Responses](https://qwedai.com/platform/open-responses)

    Beta

    -   Tool blocking is a configurable blocklist, not a sandbox, and pattern scanning is a heuristic.
    -   Personal data produces warnings, not blocks.
    -   Results are not cryptographically attested.
    -   Warn-only streaming mode turns the trust boundary off.
-   ### [MCP server](https://qwedai.com/platform/mcp)

    Beta

    -   The tool runs with the server’s privileges. Connect only clients and inputs you trust.
    -   Running code does not by itself detect injection.
    -   The earlier verify\_\* tools were removed in v0.2.1.
-   ### [QWED A2A](https://qwedai.com/platform/a2a)

    Alpha

    -   Only finance checks can return verified. Logic and code checks return heuristic\_pass, which is not admissible on its own; never execute such a payload without your own sandbox.
    -   General and data-query messages are unverifiable.
    -   It needs a signing key in QWED\_A2A\_SIGNING\_KEY\_PEM.
-   ### [QWED UCP](https://qwedai.com/platform/ucp)

    Alpha

    -   It is not a cart, a payment processor or a fraud system.
    -   verify\_totals\_only() checks totals alone and should not be treated as a final verdict.
    -   Replay protection is kept in memory only.

## Versions and support

-   Only the latest release receives security fixes. [Supported versions](https://qwedai.com/security#supported)
-   No QWED package declares itself stable on PyPI yet. [Every package and its status](https://qwedai.com/ecosystem)
-   QWED has a single maintainer, and no backup maintainer has been appointed yet. [What exists for continuity](https://qwedai.com/about#continuity)

Sources: [What QWED does not do](https://github.com/QWED-AI/qwed-verification#what-qwed-does-not-do) in the qwed-verification README, the [Verification Context specification](https://github.com/QWED-AI/qwed-verification/blob/main/spec/v1.0/verification-context.md), and each package’s README.