{"slug": "i-turned-federal-compliance-regulations-into-json-so-my-ai-coding-agent-could", "title": "I Turned Federal Compliance Regulations Into JSON So My AI Coding Agent Could Actually Use Them", "summary": "A developer built a Python pipeline that converts CMMC Level 1 and NIST SP 800-171 Rev 2 compliance regulations into structured JSON, enabling AI coding agents to enforce compliance rules automatically. The pipeline produces 125 rules with agent-specific guidance that can be injected into system prompts, CI/CD gates, or GRC platforms. The developer notes that the hardest part was handling inconsistent source data from NIST's API.", "body_md": "If you've ever had to check code or infrastructure against a compliance framework, you know the drill: someone reads a 100-page PDF, then reads your codebase, then makes a judgment call. It's slow, inconsistent, and it can't be automated.\n\nSo I built a pipeline to fix that — for real.\n\n**The problem**\n\nCMMC Level 1 and NIST SP 800-171 Rev 2 are two of the most common compliance frameworks small defense contractors and government-adjacent companies have to meet. Both exist only as dense regulatory text. There's no official machine-readable version.\n\nThat means every compliance check is manual. Every AI coding assistant reviewing your infrastructure has zero built-in awareness of these requirements. Every CI/CD pipeline has to skip compliance checks entirely or rely on someone remembering to look.\n\n** What I built**\n\nA Python pipeline that:\n\nHere's what one rule actually looks like:\n\n`\\`\n\n`json`\n\n{\n\n\"rule_id\": \"nist_sp_800-171_rev_2_3.1.1\",\n\n\"framework\": \"NIST SP 800-171 Rev 2\",\n\n\"control_id\": \"3.1.1\",\n\n\"title\": \"ACCESS CONTROL — 3.1.1\",\n\n\"requirement\": \"Limit system access to authorized users, processes acting on behalf of authorized users, and devices.\",\n\n\"agent_guidance\": \"When generating or reviewing code/infrastructure, ensure compliance with NIST SP 800-171 Rev 2 control 3.1.1. Flag any implementation that does not satisfy: Limit system access to authorized users, processes acting on behalf of authorized users, and devices.\",\n\n\"generated_at\": \"2026-07-15T16:42:56.026218+00:00\"\n\n}\n\n\\`\\`\n\nThat `agent_guidance`\n\nfield is the interesting part — it's written specifically to drop straight into an AI coding agent's system prompt as a compliance guardrail.\n\n**Three ways to actually use this**\n\n**1. AI coding agent system prompt**\n\n`\\`\n\n`python\n\nimport json\n\nwith open(\"nist_800-171_rules.json\") as f:\n\nrules = json.load(f)\n\nguardrails = \"\\n\".join(r[\"agent_guidance\"] for r in rules)\n\nsystem_prompt = f\"Apply these compliance rules when writing or reviewing code:\\n{guardrails}\"\n\n``\\`\n\n**2. CI/CD compliance gate** — iterate the rules as a pipeline step, flag PRs that touch relevant systems without addressing applicable controls, use `rule_id`\n\nas a stable reference for tracking exceptions over time.\n\n**3. GRC platform import** — most GRC tools have their own framework mappings; `control_id`\n\ngives you a clean join key.\n\n**What I learned building the pipeline**\n\nThe hardest part wasn't the rule generation — it was source data. NIST's REST API for CPRT returns a 403 for direct automated access, so it has to be manually exported from their catalog first. And their JSON schema is genuinely inconsistent between versions — I had a bug where severity data was silently defaulting to \"UNKNOWN\" for weeks because CVSS v3 nests `baseSeverity`\n\ninside `cvssData`\n\n, while CVSS v2 puts it as a sibling field. Classic \"the data looked fine until I actually checked it\" bug.\n\n**Where this is going**\n\nI ended up with 125 rules across both frameworks — full coverage, not a sample. I've packaged the complete output (both JSON files) as a one-time license if anyone wants the finished dataset instead of building the pipeline themselves: [link]. But honestly, the more interesting part to me is the pattern itself — turning static regulatory text into something an AI agent can actually reason about, rather than a document a human has to remember to check.\n\nCurious if anyone else has tackled compliance-as-code for other frameworks (SOC 2, ISO 27001, HIPAA) — would love to compare notes on parsing approaches in the comments.", "url": "https://wpnews.pro/news/i-turned-federal-compliance-regulations-into-json-so-my-ai-coding-agent-could", "canonical_source": "https://dev.to/firststeptechnology/i-turned-federal-compliance-regulations-into-json-so-my-ai-coding-agent-could-actually-use-them-4p6n", "published_at": "2026-07-22 21:27:59+00:00", "updated_at": "2026-07-22 21:31:08.630585+00:00", "lang": "en", "topics": ["developer-tools", "ai-agents", "artificial-intelligence"], "entities": ["NIST", "CMMC", "NIST SP 800-171 Rev 2"], "alternates": {"html": "https://wpnews.pro/news/i-turned-federal-compliance-regulations-into-json-so-my-ai-coding-agent-could", "markdown": "https://wpnews.pro/news/i-turned-federal-compliance-regulations-into-json-so-my-ai-coding-agent-could.md", "text": "https://wpnews.pro/news/i-turned-federal-compliance-regulations-into-json-so-my-ai-coding-agent-could.txt", "jsonld": "https://wpnews.pro/news/i-turned-federal-compliance-regulations-into-json-so-my-ai-coding-agent-could.jsonld"}}