If you've ever had to check code or infrastructure against a compliance framework, you know the drill: someone reads a 100-page PDF, then reads your codebase, then makes a judgment call. It's slow, inconsistent, and it can't be automated. So I built a pipeline to fix that — for real.
The problem
CMMC Level 1 and NIST SP 800-171 Rev 2 are two of the most common compliance frameworks small defense contractors and government-adjacent companies have to meet. Both exist only as dense regulatory text. There's no official machine-readable version.
That means every compliance check is manual. Every AI coding assistant reviewing your infrastructure has zero built-in awareness of these requirements. Every CI/CD pipeline has to skip compliance checks entirely or rely on someone remembering to look.
** What I built**
A Python pipeline that:
Here's what one rule actually looks like:
\
json
{
"rule_id": "nist_sp_800-171_rev_2_3.1.1",
"framework": "NIST SP 800-171 Rev 2",
"control_id": "3.1.1",
"title": "ACCESS CONTROL — 3.1.1",
"requirement": "Limit system access to authorized users, processes acting on behalf of authorized users, and devices.",
"agent_guidance": "When generating or reviewing code/infrastructure, ensure compliance with NIST SP 800-171 Rev 2 control 3.1.1. Flag any implementation that does not satisfy: Limit system access to authorized users, processes acting on behalf of authorized users, and devices.",
"generated_at": "2026-07-15T16:42:56.026218+00:00"
}
``
That agent_guidance
field is the interesting part — it's written specifically to drop straight into an AI coding agent's system prompt as a compliance guardrail.
Three ways to actually use this
1. AI coding agent system prompt
\
`python
import json
with open("nist_800-171_rules.json") as f:
rules = json.load(f)
guardrails = "\n".join(r["agent_guidance"] for r in rules)
system_prompt = f"Apply these compliance rules when writing or reviewing code:\n{guardrails}"
```
2. CI/CD compliance gate — iterate the rules as a pipeline step, flag PRs that touch relevant systems without addressing applicable controls, use rule_id
as a stable reference for tracking exceptions over time.
3. GRC platform import — most GRC tools have their own framework mappings; control_id
gives you a clean join key.
What I learned building the pipeline
The hardest part wasn't the rule generation — it was source data. NIST's REST API for CPRT returns a 403 for direct automated access, so it has to be manually exported from their catalog first. And their JSON schema is genuinely inconsistent between versions — I had a bug where severity data was silently defaulting to "UNKNOWN" for weeks because CVSS v3 nests baseSeverity
inside cvssData
, while CVSS v2 puts it as a sibling field. Classic "the data looked fine until I actually checked it" bug.
Where this is going
I ended up with 125 rules across both frameworks — full coverage, not a sample. I've packaged the complete output (both JSON files) as a one-time license if anyone wants the finished dataset instead of building the pipeline themselves: [link]. But honestly, the more interesting part to me is the pattern itself — turning static regulatory text into something an AI agent can actually reason about, rather than a document a human has to remember to check.
Curious if anyone else has tackled compliance-as-code for other frameworks (SOC 2, ISO 27001, HIPAA) — would love to compare notes on parsing approaches in the comments.