-
Notifications
You must be signed in to change notification settings - Fork 0
oscal compliance
Nicolas Cravino edited this page Jul 5, 2026
·
9 revisions
id: oscal-compliance title: OSCAL & Compliance tags: [oscal, nist, security, compliance, langgraph, langchain, zero-trust, digital-twin, rag, faiss] created: 2026-04-11 updated: 2026-07-04 freshness: fresh
Seven repositories covering NIST OSCAL-driven compliance automation and GenAI regulatory intelligence. Six explore OSCAL through AI-powered agents — from foundational exploration (oscal-agent-lab) through guardrails, digital twin drift detection, Zero Trust posture analysis, compliance-as-code workflows, and the newest, oscal-skills-guardrails, which carries the OSCAL-as-policy pattern from tools to Agent Skills with CI-gated admission and assessment-results audit trails. genai-regulatory-intel shifts from OSCAL to autonomous GenAI regulatory tracking across 16 global financial jurisdictions via a 4-agent LangGraph state machine. All share a common LangGraph + LangChain foundation.
- oscal-agent-guardrails implements a whitelist pattern where unknown tools are denied by default — the tool is never invoked unless explicitly allowed by the OSCAL policy. ^src:oscal-agent-guardrails
- oscal-digital-twin-playground compares OSCAL SSP (intended state) against live YAML config (actual state) and generates OSCAL assessment-results and POA&M fragments automatically. ^src:oscal-digital-twin-playground
- oscal-zero-trust-lens classifies all SP 800-53 Rev 5 controls into 7 Zero Trust dimensions and computes coverage percentage per dimension against an SSP. ^src:oscal-zero-trust-lens
- oscal-agent-lab builds a FAISS vector index over 1,196 NIST 800-53 controls and exposes 4 agents for Q&A, diff, profile generation, and validation. ^src:oscal-agent-lab
- oscal-cac-playgd provides PR-style diff review of OSCAL files with risk assessment (increase/decrease/neutral) and recommendations. ^src:oscal-cac-playgd
- oscal-skills-guardrails extends the oscal-agent-guardrails pattern from tools to Agent Skills: a single OSCAL profile (SG-1…SG-9 control catalog, 800-53 mapped) drives dual-evidence admission (static Skillspector scan + local LLM rubric judge), digest-locked integrity, and OSCAL assessment-results as CI build evidence. A skill can score 100/A on static analysis and still be denied on meaning. ^src:oscal-skills-guardrails
- genai-regulatory-intel uses a 4-agent Research → Validate → Reflect → Persist LangGraph state machine with OpenAI Responses API web search to autonomously track GenAI regulations across 16 global financial jurisdictions; stores structured data in SQLite + ChromaDB for semantic querying. ^src:genai-regulatory-intel
- All five OSCAL repos use LangGraph for agent orchestration and target Python 3.10+. ^src:oscal-agent-guardrails ^src:oscal-digital-twin-playground ^src:oscal-zero-trust-lens ^src:oscal-agent-lab ^src:oscal-cac-playgd
- Could oscal-agent-guardrails be integrated as a runtime policy layer into the other OSCAL tools?
- How do oscal-digital-twin-playground and oscal-zero-trust-lens findings feed into oscal-cac-playgd remediation suggestions?
- ai-security-pentesting (OSCAL frameworks provide compliance context for pentesting; oscal-skills-guardrails pairs with Skillspector for skill vetting)
- agentic-frameworks (shared LangGraph / DeepAgents patterns)
- timeline — 2026-01-11. ^src:ai-supply-chain-governance
- timeline — 2026-02-11. ^src:oscal-phantom-compliance