A team building a healthcare API asks an AI coding assistant to implement a patient records endpoint. The assistant produces working code — clean, well-structured, passes review. Six months later, a HIPAA audit finds the endpoint returns more PHI fields than the request actually needed. Nobody wrote a test for "is this response over-broad." Nobody thought to.
That's not a hypothetical. It's the specific, named failure mode in GAUNTLEX's own HIPAA policy playbook: "PHI Disclosure — Over-Broad API Response." I want to walk through how GAUNTLEX turns regulatory requirements like this into something that actually runs in CI, instead of something a compliance team discovers during an audit that's already too late.
GAUNTLEX ships five compliance domain playbooks out of the box: OWASP Top 10, HIPAA, FINRA, PCI DSS, and SOC 2 (NIST SSDF and OWASP API Security are available as installable extensions). Each one is a curated set of attack scenarios specific to that domain's actual failure modes — not a generic vulnerability scanner with a different label stapled on.
The HIPAA playbook's nine scenarios include things like "Emergency Access — Hardcoded Override Credentials" and "PHI Integrity — Missing Tamper Detection" — the kind of finding a generic SAST tool has no vocabulary for, because it's not a code pattern, it's a regulatory failure mode. The FINRA playbook is a different nine entirely: "SEC 17a-4 — Non-WORM Record Storage Race Condition," "AML — Structuring Detection Bypass," "Best Execution — Pricing Calculation Error" — scenarios written for people who've actually read those regulations, not reverse-engineered from a CVE database.
gauntlex run --issue patient_api_spec.md --mode standard --domain hipaa
This is the part that actually matters for a compliance review. Every finding GAUNTLEX produces carries a CWE tag and maps to real control frameworks:
CONTROL_MAPPINGS = {
"NIST_SSDF": ["RV.2.2", "RV.3.1", "PW.8.1"],
"OWASP_SAMM": ["Verification/Security-Testing/2"],
"SOC2_CC": ["CC7.1", "CC8.1"],
"ISO_27001": ["A.14.2.8", "A.14.2.9"],
}
That's not decoration. It's the difference between handing an auditor "we ran a security tool" and handing them a report where every finding traces to the specific control it violates — the artifact a compliance reviewer actually needs, in the format they actually work in.
Here's where it stops being a reporting tool and becomes an enforcement mechanism. GAUNTLEX runs in CI with a configurable minimum Adversarial Resilience Score — 0.80 by default — and fail_open: false
. Below that threshold, the merge is blocked. Not a Slack notification to review later. The same mechanism that blocks a merge on a failing test suite, applied to compliance-relevant security posture.
gate:
minimum_ars: 0.80
fail_open: false
That single config line is the actual point of this whole system: compliance testing that happens before code ships, gating the same pipeline everything else already gates, instead of a quarterly audit finding what a machine could have caught on day one.
pip install gauntlex-ai
gauntlex policy list # see all available domains
gauntlex run --issue your_spec.md --domain hipaa --mode quick
gauntlex audit
lists every past run with its full compliance control mapping over a configurable window — useful the next time an auditor asks "show me your security testing evidence" and you'd rather hand over a report than a explanation.
Repo, MCP integration, and the full domain list: github.com/sanjoy1234/gauntlex. If you're building in a regulated space and want to see what GAUNTLEX flags in your own spec, I'd genuinely like to know — open a discussion.