TL;DR
The study concludes that an AI-agent paired with Security-as-Code is a promising avenue for proactive NIS2 compliance, and future work on extending this approach to other standards and automated remediation is outlined.
ReATest is introduced, an automated approach to enhancing PaC workflows through systematic test case generation from Rego specifications, which achieves an average 35.43% reduction in test suite size and retains 64.57% of the generated test cases.
Verifying building compliance requires validating thousands of rules against large Building Information Modeling (BIM) designs, which is laborious, capital-intensive, and unscalable. Existing Automated Compliance Checkers (ACCs) are often difficult to generalize across different scenarios, as they are typically developed for highly specific rule sets and use cases. In addition, many ACCs are proprietary, meaning the underlying verification code is not released to end users, so users cannot verify whether their regulatory intent can be accurately captured. We introduce ARCHER (Agentic Rule and Compliance Harness for Executable Regulations), a test-driven, deterministically orchestrated multi-agent program-synthesis harness that generates auditable verification code from regulatory Codes of Practice, enabling transparent, adaptable, and scalable compliance checking. To characterize what makes agentic synthesis work, we evaluate a taxonomy of six harnesses of increasing agentic sophistication across four backbone models, spanning realistic data-governance tiers (from frontier third-party APIs to a fully on-premise open-weights model) on a novel dataset derived from real-world compliance scenarios. ARCHER's deterministic multi-agent orchestration achieves the highest accuracy for every backbone, improving mean union accuracy by 82% over a naive single-pass prompting baseline. Our cost-accuracy analysis further shows that using the ARCHER harness, a self-hosted open-weights model can reach 97.8% of frontier-API accuracy at a quarter of the cost, making data-sovereign compliance checking practical.
A multi-agent GenAI architecture is introduced to support the automation of ethical cloud security, solving the problem of scalability or adaptability, and compliance in dynamic cloud environments. This framework combines dedicated generative agents such as policy analysts, threat detectors, remediation organizers, and auditor agents which interact via common knowledge graph and can be explained by a decision log. The agents utilize context-based prompt generation, generation constraints, provenance management, and generation to generate security policies, anomaly detection, provide automated mitigation, and maintain human-in-the-loop control. Some of the ethical protections are bias audits, privacy-sensitive learning, least-privilege enforcement, and policy verifiability, to warrant the correctness of the decisions taken in compliance with regulatory or organizational limits. Testing with representative cloud work lines shows that there is shorter energy on discerning and correcting occurrences, elevated coverage of controls and signs when the automated actions are traced. The framework enables adjustable levels of trust and escalation measures to accommodate the autonomy versus governance. The method fosters usage of GenAI to deal with cloud security by offering modular agents, verifiable ethics controls, metrics-based assessment, hence fostering responsible automation that is also transparent, auditable, and considers changing threats.
Environmental, Social, and Governance (ESG) compliance has shifted from voluntary best practice to enforceable legal obligation across major global jurisdictions. Frameworks such as the European Union's Corporate Sustainability Reporting Directive (CSRD), the Sustainable Finance Disclosure Regulation (SFDR), the United Kingdom's Sustainability Disclosure Requirements (SDR), and disclosure rules from the U.S. Securities and Exchange Commission (SEC), adopted in 2024 and now under proposed rescission, impose structured reporting duties on a growing range of organizations. Yet dominant compliance methods remain manual, fragmented, and difficult to verify. Static documentation, subjective interpretation, and scoring systems that cannot be traced back to specific legal provisions continue to define current practice. This paper introduces ESG-as-Code, a deterministic rule-based framework designed to address these limitations by converting ESG regulatory obligations into structured rule logic formally specified for machine implementation. Drawing on established principles from Policy-as-Code, Infrastructure-as-Code, and computational law, the framework provides a structured methodology for encoding jurisdictional ESG rules as conditional logic that can be evaluated systematically against organizational data and disclosures. Central to the framework is a deliberate separation between probabilistic systems used for document interpretation and deterministic engines used for compliance decision-making. This separation preserves full auditability, allowing every compliance outcome to be traced directly to a specific regulatory provision rather than a statistical inference. Determinism in this sense guarantees reproducibility and rule-level traceability, properties that probabilistic scoring systems cannot offer by design. It does not by itself guarantee that a given outcome is legally correct; that additionally depends on the accuracy of the underlying rule encoding, the currency of the regulatory source, and the governance processes surrounding the rule library. The paper argues that reproducibility and traceability are necessary but not sufficient conditions for regulatory defensibility and proposes deterministic rule-based architecture as the foundation on which the remaining conditions can be built.
Cloud-native software-delivery pipelines increasingly rely on Policy-as-Code (PaC) to automate security, compliance, and governance enforcement. Although Policy-as-Code is widely adopted within Continuous Integration (CI) pipelines and Kubernetes admission-control frameworks, governance requirements are often implemented independently, potentially increasing maintenance effort and creating opportunities for policy drift. Despite the growing adoption of Policy-as-Code, comparatively little empirical evidence exists regarding the reuse of a shared policy-definition layer across complementary enforcement stages within the software-delivery lifecycle. This paper presents and empirically evaluates a reusable multi-stage Policy-as-Code enforcement model based on a shared policy-definition layer implemented using the Open Policy Agent (OPA) framework and its Rego policy language. Rather than proposing a new Policy-as-Code technology, the study investigates whether a shared policy-definition layer can support consistent policy enforcement across Continuous Integration validation and Kubernetes admission control. The model was evaluated using Conftest and OPA Gatekeeper through a structured experimental study comprising 29 Kubernetes manifests, 37 experimental scenarios, eight Kubernetes resource types, and 261 policy assertions covering representative cloud-native workload-governance requirements. Within the evaluated dataset, all intentionally introduced insecure configurations were correctly identified without observed false positives or false negatives. The shared policy-definition layer was successfully reused across both validation stages, while Kubernetes admission control mitigated all evaluated CI bypass scenarios by providing an independent deployment-time enforcement boundary. The results demonstrate that a shared policy-definition layer can support consistent policy enforcement across complementary enforcement stages while enabling policy reuse without requiring duplicate policy implementations within the evaluated environment. More broadly, the study contributes empirical evidence supporting policy reuse as a governance strategy for cloud-native software delivery and provides a reproducible foundation for future investigations involving larger datasets, broader governance-policy portfolios, alternative Policy-as-Code ecosystems, and production-scale deployments.
In the intricate world of laws and regulations we have today, companies require more than just non-flexible guidelines to be on the right side of the law. They require systems that are not only adaptable but that also change with them in real time. This document investigates a futuristic programmatic governance way of handling compliance issues by combining Policy-as-Code (PaC) and Machine Learning (ML). The core of the idea is in the impairments of manual policy enforcement and rigid compliance checks that are always behind in changes of business operations or regulations. Organizations turn policies into executable code so as they can automate enforcement in distributed environments, thus achieving both uniformity and accountability as a result. Moreover, when combined with ML, these machines become capable of learning from previous compliance behavior, anticipating future violations, and even suggesting the necessary preventive measures. The approach proposed in this study consists of the following steps: writing the policy with a declarative language such as Open Policy Agent (OPA), linking the policy to an event-driven architecture, and allowing ML models to receive and analyze the data in real-time, be they anomaly or risk cases. The main feature of this work is the presentation of an architecture where cloud-native is integrated with dynamic policy engines and ML classifiers, enabling organizations to respond to compliance drifts as they happennot after. The architecture demonstrated in a multi-cloud case shows how it identified access control violations and went ahead to change settings automatically without requiring the involvement of a human. The findings, thus, indicate faster response time, shrinkage of compliance gaps, and notable cost savings as compared to the traditional governance models. This is, in fact, a very strong argument for using a live, learning compliance infrastructure that can not only adjust itself to changes but can actually benefit from them instead of perishing, as in the case of checklists.
We use cookies to run the site and, with your consent, for analytics and to show ads. See our Cookie Policy.
