# I Turned Federal Compliance Regulations Into JSON So My AI Coding Agent Could Actually Use Them > Source: > Published: 2026-07-22 21:27:59+00:00 If you've ever had to check code or infrastructure against a compliance framework, you know the drill: someone reads a 100-page PDF, then reads your codebase, then makes a judgment call. It's slow, inconsistent, and it can't be automated. So I built a pipeline to fix that — for real. **The problem** CMMC Level 1 and NIST SP 800-171 Rev 2 are two of the most common compliance frameworks small defense contractors and government-adjacent companies have to meet. Both exist only as dense regulatory text. There's no official machine-readable version. That means every compliance check is manual. Every AI coding assistant reviewing your infrastructure has zero built-in awareness of these requirements. Every CI/CD pipeline has to skip compliance checks entirely or rely on someone remembering to look. ** What I built** A Python pipeline that: Here's what one rule actually looks like: `\` `json` { "rule_id": "nist_sp_800-171_rev_2_3.1.1", "framework": "NIST SP 800-171 Rev 2", "control_id": "3.1.1", "title": "ACCESS CONTROL — 3.1.1", "requirement": "Limit system access to authorized users, processes acting on behalf of authorized users, and devices.", "agent_guidance": "When generating or reviewing code/infrastructure, ensure compliance with NIST SP 800-171 Rev 2 control 3.1.1. Flag any implementation that does not satisfy: Limit system access to authorized users, processes acting on behalf of authorized users, and devices.", "generated_at": "2026-07-15T16:42:56.026218+00:00" } \`\` That `agent_guidance` field is the interesting part — it's written specifically to drop straight into an AI coding agent's system prompt as a compliance guardrail. **Three ways to actually use this** **1. AI coding agent system prompt** `\` `python import json with open("nist_800-171_rules.json") as f: rules = json.load(f) guardrails = "\n".join(r["agent_guidance"] for r in rules) system_prompt = f"Apply these compliance rules when writing or reviewing code:\n{guardrails}" ``\` **2. CI/CD compliance gate** — iterate the rules as a pipeline step, flag PRs that touch relevant systems without addressing applicable controls, use `rule_id` as a stable reference for tracking exceptions over time. **3. GRC platform import** — most GRC tools have their own framework mappings; `control_id` gives you a clean join key. **What I learned building the pipeline** The hardest part wasn't the rule generation — it was source data. NIST's REST API for CPRT returns a 403 for direct automated access, so it has to be manually exported from their catalog first. And their JSON schema is genuinely inconsistent between versions — I had a bug where severity data was silently defaulting to "UNKNOWN" for weeks because CVSS v3 nests `baseSeverity` inside `cvssData` , while CVSS v2 puts it as a sibling field. Classic "the data looked fine until I actually checked it" bug. **Where this is going** I ended up with 125 rules across both frameworks — full coverage, not a sample. I've packaged the complete output (both JSON files) as a one-time license if anyone wants the finished dataset instead of building the pipeline themselves: [link]. But honestly, the more interesting part to me is the pattern itself — turning static regulatory text into something an AI agent can actually reason about, rather than a document a human has to remember to check. Curious if anyone else has tackled compliance-as-code for other frameworks (SOC 2, ISO 27001, HIPAA) — would love to compare notes on parsing approaches in the comments.