Skip to content

Exports OSCAL and SARIF

Jump to bottom
Allen Byrd edited this page Jun 2, 2026 · 1 revision

Exports — OSCAL and SARIF

RegRails exports the encoded ruleset and every gate outcome as open interchange formats, so it plugs into the GRC and CI tooling a compliance team already runs:

  • OSCAL — the encoded rules as a control catalog, for GRC tooling.
  • SARIF — each guardrail decision as a static-analysis finding, for CI / code-scanning gates.

Both are surfaced on the web console's Exports route, each behind an honest capability note so a GRC reader is not misled about the standards posture.

Pages: CLI Reference · Web Platform · MCP Server · GitHub Action

OSCAL (export oscal)

OSCAL (Open Security Controls Assessment Language) is the NIST standard the federal government uses for 800-53 and FedRAMP. RegRails emits the 37 encoded rules as an OSCAL catalog:

  • one group per framework (FERPA, Title IV),
  • one control per rule — with the verbatim-CFR reference link, the rule type / severity / framework as props, the risk tier when present, and the operator-readable rationale as a statement part,
  • a back-matter that binds each section's SHA-256 (so the regulations-as-code is traceable to the bundled text).
regrails export oscal           # print to stdout
regrails export oscal --out catalog.oscal.json
{
  "catalog": {
    "uuid": "03a8f7ae-fa56-5895-a356-ac88dae620ce",
    "metadata": {
      "title": "RegRails encoded rules (FERPA + Title IV subset)",
      "version": "0.4.0",
      "oscal-version": "1.1.2"
    },
    "groups": [
      { "id": "ferpa", "title": "FERPA", "controls": [
        { "id": "ferpa-99.30-1", "title": "An educational agency or institution must obtain prior signed-and-dated written consent …",
          "props": [ {"name": "rule-type", "value": "prohibition"}, {"name": "severity", "value": "block"} ],
          "links": [ {"href": "…eCFR/LII URL…", "rel": "reference"} ],
          "parts": [ {"id": "ferpa-99.30-1-stmt", "name": "statement", "prose": "…"} ] }
      ] }
    ],
    "back-matter": { "resources": [
      { "title": "34-CFR-99.30", "rlinks": [ {"href": "…", "hashes": [ {"algorithm": "SHA-256", "value": "…"} ]} ] }
    ] }
  }
}

Honest scope cap

This produces an OSCAL 1.1.2-SHAPED catalog — structurally aligned to the OSCAL catalog model (groups → controls → parts/props, with SHA-256 back-matter), and asserted in tests. It is NOT run through the official NIST OSCAL validator, so the claim is capped at "1.1.2-shaped," not "validated OSCAL" and not a conformance attestation.

Treat it as a faithful structural export a GRC platform (or an OSCAL-aware tool) can ingest to map RegRails coverage into an existing compliance program — not as a certification.

SARIF (decide --format sarif)

SARIF (Static Analysis Results Interchange Format) is what GitHub code-scanning renders natively. Emitting decisions as SARIF means a CI run can fail a pull request when an AI workflow would have made a prohibited disclosure or a high-stakes aid determination.

The outcome → SARIF level mapping:

Outcome SARIF level
block, escalate_human_review error (hard failures)
escalate_consent, escalate_directory_check warning
insufficient_facts note
allow, out_of_scope none

The controlling CFR citation becomes the result's ruleId, and the outcome / risk tier / human-gate flag / framework / citations ride along as properties.

regrails decide -q "What's Jane's GPA?" --data gpa --format sarif
{
  "version": "2.1.0",
  "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
  "runs": [
    {
      "tool": { "driver": { "name": "RegRails", "informationUri": "https://github.com/Polycentric-Labs/regrails", "version": "0.4.0", "rules": [] } },
      "results": [
        {
          "ruleId": "34-CFR-99.30",
          "level": "error",
          "message": { "text": "Blocked under 34 CFR § 99.30(a) (default consent rule). …" },
          "properties": { "outcome": "block", "risk_tier": "medium", "human_gate_required": false, "framework": "FERPA", "citations": ["34-CFR-99.30"] }
        }
      ]
    }
  ]
}

Honest scope cap

This is structurally-valid SARIF 2.1.0 (the OASIS SARIF v2.1.0 schema; shape asserted in tests). The claim is "emits SARIF 2.1.0," not "SARIF-certified."

How these feed the GitHub Action

The two exports are exactly what the reusable GitHub Action chains together to gate a pipeline. In one job step, the action:

  1. runs regrails decide … > rg_decision.json (the JSON decision, to read the outcome / risk_tier),
  2. runs regrails decide … --format sarif > regrails.sarif (the SARIF report), and
  3. fails the job when the outcome is in its fail-on list (default block,escalate_human_review).

You then upload regrails.sarif with github/codeql-action/upload-sarif so each blocked or escalated decision renders in code-scanning — gating a regulated AI decision the same way you would gate a code vulnerability.

The OSCAL catalog is the GRC-side artifact (ingest the control catalog into a compliance program); SARIF is the CI-side artifact (gate the pipeline). See GitHub Action for the full workflow.

RegRails is a proof-of-concept, not a compliance product and not legal advice. Synthetic data only.

Clone this wiki locally