-
Notifications
You must be signed in to change notification settings - Fork 0
oscal compliance
id: oscal-compliance title: OSCAL & Compliance tags: [oscal, nist, security, compliance, langgraph, langchain, zero-trust, digital-twin, rag, faiss, vllm, cuda] created: 2026-04-11 updated: 2026-07-22 freshness: fresh
Nine repositories covering NIST OSCAL-driven compliance automation and GenAI regulatory intelligence. Six explore OSCAL through AI-powered agents — from foundational exploration (oscal-agent-lab) through guardrails, digital twin drift detection, Zero Trust posture analysis, compliance-as-code workflows, and the newest, oscal-skills-guardrails, which carries the OSCAL-as-policy pattern from tools to Agent Skills with CI-gated admission and assessment-results audit trails. genai-regulatory-intel shifts from OSCAL to autonomous GenAI regulatory tracking across 16 global financial jurisdictions via a 4-agent LangGraph state machine. All share a common LangGraph + LangChain foundation.
-
oscal-agent-guardrails implements a whitelist pattern where unknown tools are denied by default — the tool is never invoked unless explicitly allowed by the OSCAL policy. ^src:oscal-agent-guardrails
-
oscal-digital-twin-playground compares OSCAL SSP (intended state) against live YAML config (actual state) and generates OSCAL assessment-results and POA&M fragments automatically. ^src:oscal-digital-twin-playground
-
oscal-zero-trust-lens classifies all SP 800-53 Rev 5 controls into 7 Zero Trust dimensions and computes coverage percentage per dimension against an SSP. ^src:oscal-zero-trust-lens
-
oscal-agent-lab builds a FAISS vector index over 1,196 NIST 800-53 controls and exposes 4 agents for Q&A, diff, profile generation, and validation. ^src:oscal-agent-lab
-
oscal-cac-playgd provides PR-style diff review of OSCAL files with risk assessment (increase/decrease/neutral) and recommendations. ^src:oscal-cac-playgd
-
oscal-skills-guardrails extends the oscal-agent-guardrails pattern from tools to Agent Skills: a single OSCAL profile (SG-1…SG-9 control catalog, 800-53 mapped) drives dual-evidence admission (static Skillspector scan + local LLM rubric judge), digest-locked integrity, and OSCAL assessment-results as CI build evidence. A skill can score 100/A on static analysis and still be denied on meaning. ^src:oscal-skills-guardrails
-
genai-regulatory-intel uses a 4-agent Research → Validate → Reflect → Persist LangGraph state machine with OpenAI Responses API web search to autonomously track GenAI regulations across 16 global financial jurisdictions; stores structured data in SQLite + ChromaDB for semantic querying. ^src:genai-regulatory-intel
-
All five OSCAL repos use LangGraph for agent orchestration and target Python 3.10+. ^src:oscal-agent-guardrails ^src:oscal-digital-twin-playground ^src:oscal-zero-trust-lens ^src:oscal-agent-lab ^src:oscal-cac-playgd
-
DriftLab is the runtime counterpart to the design-time OSCAL tools: it observes a live agent's decision traces, diffs them against a certified OSCAL baseline, and runs sandboxed micro-experiments to prove behavioral drift with reproduced evidence — emitting a compliance score, a deterministic anomaly ledger, and OSCAL 1.1.2 assessment-results (CA-7). The LLM is advisory-only and never sets a severity or verdict. ^src:driftlab
-
DriftLab v2.1 certifies resource budgets as control DL-8 (SC-6/CA-7): ceilings for tokens, iterations, CPU and wall-clock are declared in the OSCAL baseline and compiled fail-closed; a stdlib sensor meters running agents onto a separate telemetry plane and the diff engine audits spend-vs-ceiling, while hard enforcement stays with the platform (cgroup v2, OMLX gateway quotas). ^src:driftlab
-
DriftLab is now dual-platform: the original repo was renamed
driftlab-mlx(Apple Silicon / OMLX) and driftlab-dgx ports the same driftlab 2.1.0 package to NVIDIA DGX Spark, retargeting only the optional advisory narrative layer at the host's shared local vLLM stack — the deterministic compliance path is unchanged. ^src:driftlab-dgx
- Could oscal-agent-guardrails be integrated as a runtime policy layer into the other OSCAL tools?
- How do oscal-digital-twin-playground and oscal-zero-trust-lens findings feed into oscal-cac-playgd remediation suggestions?
- ai-security-pentesting (OSCAL frameworks provide compliance context for pentesting; oscal-skills-guardrails pairs with Skillspector for skill vetting)
- agentic-frameworks (shared LangGraph / DeepAgents patterns)
- timeline — 2026-01-11. ^src:ai-supply-chain-governance
- timeline — 2026-02-11. ^src:oscal-phantom-compliance