-
Notifications
You must be signed in to change notification settings - Fork 0
oscal compliance
Nicolas Cravino edited this page Apr 11, 2026
·
9 revisions
id: oscal-compliance title: OSCAL & Compliance tags: [oscal, nist, security, compliance, langgraph, langchain, zero-trust, digital-twin, rag, faiss] created: 2026-04-11 updated: 2026-04-11 freshness: fresh
Five repositories exploring NIST OSCAL (Open Security Controls Assessment Language) through AI-powered agents. The suite progresses from foundational exploration (oscal-agent-lab) through specialized applications: runtime agent guardrails, digital twin drift detection, Zero Trust posture analysis, and compliance-as-code workflows. All share a common LangGraph + LangChain foundation and use the official usnistgov/oscal-content as their data source.
- oscal-agent-guardrails implements a whitelist pattern where unknown tools are denied by default — the tool is never invoked unless explicitly allowed by the OSCAL policy. ^src:oscal-agent-guardrails
- oscal-digital-twin-playground compares OSCAL SSP (intended state) against live YAML config (actual state) and generates OSCAL assessment-results and POA&M fragments automatically. ^src:oscal-digital-twin-playground
- oscal-zero-trust-lens classifies all SP 800-53 Rev 5 controls into 7 Zero Trust dimensions and computes coverage percentage per dimension against an SSP. ^src:oscal-zero-trust-lens
- oscal-agent-lab builds a FAISS vector index over 1,196 NIST 800-53 controls and exposes 4 agents for Q&A, diff, profile generation, and validation. ^src:oscal-agent-lab
- oscal-cac-playgd provides PR-style diff review of OSCAL files with risk assessment (increase/decrease/neutral) and recommendations. ^src:oscal-cac-playgd
- All five repos use LangGraph for agent orchestration and target Python 3.10+. ^src:oscal-agent-guardrails ^src:oscal-digital-twin-playground ^src:oscal-zero-trust-lens ^src:oscal-agent-lab ^src:oscal-cac-playgd
- Could oscal-agent-guardrails be integrated as a runtime policy layer into the other OSCAL tools?
- How do oscal-digital-twin-playground and oscal-zero-trust-lens findings feed into oscal-cac-playgd remediation suggestions?
- ai-security-pentesting (OSCAL frameworks provide compliance context for pentesting)
- agentic-frameworks (shared LangGraph patterns)