-
Notifications
You must be signed in to change notification settings - Fork 0
oscal compliance
id: oscal-compliance title: OSCAL & Compliance tags: [oscal, nist, security, compliance, langgraph, langchain, zero-trust, digital-twin, rag, faiss, vllm, cuda] created: 2026-04-11 updated: 2026-07-29 freshness: fresh
Ten repositories covering NIST OSCAL-driven compliance automation and GenAI regulatory intelligence. Seven explore OSCAL through AI-powered agents — from foundational exploration (oscal-agent-lab) through guardrails, digital twin drift detection, Zero Trust posture analysis, compliance-as-code workflows, oscal-skills-guardrails (the OSCAL-as-policy pattern carried from tools to Agent Skills with CI-gated admission), and the newest, oscal-presence-gate, which gates WHERE the human behind a delegated agent is standing — presence-aware policy for EO 14117 / DOJ Data Security Program covered-data flows. genai-regulatory-intel shifts from OSCAL to autonomous GenAI regulatory tracking across 16 global financial jurisdictions via a 4-agent LangGraph state machine. All share a common LangGraph + LangChain foundation.
-
oscal-agent-guardrails implements a whitelist pattern where unknown tools are denied by default — the tool is never invoked unless explicitly allowed by the OSCAL policy. ^src:oscal-agent-guardrails
-
oscal-digital-twin-playground compares OSCAL SSP (intended state) against live YAML config (actual state) and generates OSCAL assessment-results and POA&M fragments automatically. ^src:oscal-digital-twin-playground
-
oscal-zero-trust-lens classifies all SP 800-53 Rev 5 controls into 7 Zero Trust dimensions and computes coverage percentage per dimension against an SSP. ^src:oscal-zero-trust-lens
-
oscal-agent-lab builds a FAISS vector index over 1,196 NIST 800-53 controls and exposes 4 agents for Q&A, diff, profile generation, and validation. ^src:oscal-agent-lab
-
oscal-cac-playgd provides PR-style diff review of OSCAL files with risk assessment (increase/decrease/neutral) and recommendations. ^src:oscal-cac-playgd
-
oscal-skills-guardrails extends the oscal-agent-guardrails pattern from tools to Agent Skills: a single OSCAL profile (SG-1…SG-9 control catalog, 800-53 mapped) drives dual-evidence admission (static Skillspector scan + local LLM rubric judge), digest-locked integrity, and OSCAL assessment-results as CI build evidence. A skill can score 100/A on static analysis and still be denied on meaning. ^src:oscal-skills-guardrails
-
genai-regulatory-intel uses a 4-agent Research → Validate → Reflect → Persist LangGraph state machine with OpenAI Responses API web search to autonomously track GenAI regulations across 16 global financial jurisdictions; stores structured data in SQLite + ChromaDB for semantic querying. ^src:genai-regulatory-intel
-
All five OSCAL repos use LangGraph for agent orchestration and target Python 3.10+. ^src:oscal-agent-guardrails ^src:oscal-digital-twin-playground ^src:oscal-zero-trust-lens ^src:oscal-agent-lab ^src:oscal-cac-playgd
-
oscal-presence-gate adds a presence verifier ahead of the policy enforcer: OAuth delegation propagates identity but not presence, so stale, absent, unsigned, or integrity-failed location assertions collapse to unknown — and unknown fails closed for covered data. Runtime policy (blocked countries, PT1H attestation window, PT8H delegation TTL) is loaded from OSCAL files, and every decision is emitted as an OSCAL assessment-results observation with the delegation-custody record embedded. ^src:oscal-presence-gate
-
oscal-presence-gate ships an unofficial OSCAL encoding of the CISA Security Requirements for Restricted Transactions (Sections I–II, 20 controls) plus a five-control PRES presence-propagation overlay, and validates all content and generated evidence against vendored official NIST OSCAL v1.1.3 schemas. ^src:oscal-presence-gate
-
DriftLab is the runtime counterpart to the design-time OSCAL tools: it observes a live agent's decision traces, diffs them against a certified OSCAL baseline, and runs sandboxed micro-experiments to prove behavioral drift with reproduced evidence — emitting a compliance score, a deterministic anomaly ledger, and OSCAL 1.1.2 assessment-results (CA-7). The LLM is advisory-only and never sets a severity or verdict. ^src:driftlab
-
DriftLab v2.1 certifies resource budgets as control DL-8 (SC-6/CA-7): ceilings for tokens, iterations, CPU and wall-clock are declared in the OSCAL baseline and compiled fail-closed; a stdlib sensor meters running agents onto a separate telemetry plane and the diff engine audits spend-vs-ceiling, while hard enforcement stays with the platform (cgroup v2, OMLX gateway quotas). ^src:driftlab
-
DriftLab is now dual-platform: the original repo was renamed
driftlab-mlx(Apple Silicon / OMLX) and driftlab-dgx ports the same driftlab 2.1.0 package to NVIDIA DGX Spark, retargeting only the optional advisory narrative layer at the host's shared local vLLM stack — the deterministic compliance path is unchanged. ^src:driftlab-dgx
- Could oscal-agent-guardrails be integrated as a runtime policy layer into the other OSCAL tools?
- How do oscal-digital-twin-playground and oscal-zero-trust-lens findings feed into oscal-cac-playgd remediation suggestions?
- ai-security-pentesting (OSCAL frameworks provide compliance context for pentesting; oscal-skills-guardrails pairs with Skillspector for skill vetting)
- agentic-frameworks (shared LangGraph / DeepAgents patterns)
- oauth-agent-identity-presence-gap — 2026-07-29. The presence gap in delegated agent traffic — companion article to oscal-presence-gate. [^src:articles-published §oauth-agent-identity-presence-gap]
- agent-skills-new-supply-chain — 2026-07-29 (primary: ai-security). Dual-evidence skill admission under OSCAL policy — the oscal-skills-guardrails build story. [^src:articles-published §agent-skills-new-supply-chain]
- timeline — 2026-01-11. ^src:ai-supply-chain-governance
- timeline — 2026-02-11. ^src:oscal-phantom-compliance