Compliance Manager
Compliance modeled as continuously evaluated state instead of a periodic scramble: every obligation has an owner and a deadline, evidence accrues as work happens, and drift is flagged early.
Specification.
What it reads, what it may write, what it must pass, and how a change to it is judged.
| Domain | Regulatory compliance |
|---|---|
| Status | Production |
| Trigger | Daily evaluation plus change events on people and documents |
| Reads | Credentials, trainings, audit calendars and policy library |
| Writes | Staged evidence and drafted notices, gated before commit |
| Gate | Role-scoped approval, bound to the exact payload |
| Models | Retrieval over the client's own policies, cited by section |
| Evals | Deadline, retrieval and citation suites, run in CI |
What it does.
Tracks every credential, training and audit date as state, assembles evidence continuously, and surfaces risk before it becomes a finding.
Obligation graph
Licenses, credentials, trainings, audits and filings as dated obligations with owners, evaluated daily against the record.
Continuous evidence
Artifacts an auditor will request are collected and indexed when the underlying work happens, not reconstructed later.
Drift detection
Patterns that historically precede findings are flagged with the policy they touch and a proposed remediation.
Cited policy answers
Questions answered by retrieval over the client's own policy library, with section-level citations and no uncited claims.
The rules it holds.
The same six invariants hold for every AgencyAI system.
- INV-01
Least privilege
Every connector is scoped to the fields one job needs. No agent holds a credential broader than its task.
- INV-02
Typed boundaries
Tool inputs and model outputs are validated against schemas at every boundary. Invalid output is a failed step, never a guess.
- INV-03
Idempotent effects
Every side-effecting call carries an idempotency key. Runs are resumable state machines; a retry cannot double-send.
- INV-04
Gated consequences
Actions are classed by consequence. Anything that leaves the system needs a role-scoped approval bound to the exact payload.
- INV-05
Append-only record
Inputs, tool calls, model calls, outputs and approvals are written to an append-only audit log, reviewable per run.
- INV-06
Evals gate merges
Prompt, model and tool changes run the eval suites in CI. A regression blocks the merge like a failing unit test.
The books are closed.
We work with a few enterprise companies at a time. If you have a project and want to know whether an opening comes up, write to us. You will get a straight answer either way.