I Turned Federal Compliance Regulations Into JSON So My AI Coding Agent Could Actually Use Them

A developer built a Python pipeline that converts CMMC Level 1 and NIST SP 800-171 Rev 2 compliance regulations into structured JSON, enabling AI coding agents to enforce compliance rules automatically. The pipeline produces 125 rules with agent-specific guidance that can be injected into system prompts, CI/CD gates, or GRC platforms. The developer notes that the hardest part was handling inconsistent source data from NIST's API.

If you've ever had to check code or infrastructure against a compliance framework, you know the drill: someone reads a 100-page PDF, then reads your codebase, then makes a judgment call. It's slow, inconsistent, and it can't be automated. So I built a pipeline to fix that — for real. The problem CMMC Level 1 and NIST SP 800-171 Rev 2 are two of the most common compliance frameworks small defense contractors and government-adjacent companies have to meet. Both exist only as dense regulatory text. There's no official machine-readable version. That means every compliance check is manual. Every AI coding assistant reviewing your infrastructure has zero built-in awareness of these requirements. Every CI/CD pipeline has to skip compliance checks entirely or rely on someone remembering to look. What I built A Python pipeline that: Here's what one rule actually looks like: \ json { "rule id": "nist sp 800-171 rev 2 3.1.1", "framework": "NIST SP 800-171 Rev 2", "control id": "3.1.1", "title": "ACCESS CONTROL — 3.1.1", "requirement": "Limit system access to authorized users, processes acting on behalf of authorized users, and devices.", "agent guidance": "When generating or reviewing code/infrastructure, ensure compliance with NIST SP 800-171 Rev 2 control 3.1.1. Flag any implementation that does not satisfy: Limit system access to authorized users, processes acting on behalf of authorized users, and devices.", "generated at": "2026-07-15T16:42:56.026218+00:00" } \ \ That agent guidance field is the interesting part — it's written specifically to drop straight into an AI coding agent's system prompt as a compliance guardrail. Three ways to actually use this 1. AI coding agent system prompt \ python import json with open "nist 800-171 rules.json" as f: rules = json.load f guardrails = "\n".join r "agent guidance" for r in rules system prompt = f"Apply these compliance rules when writing or reviewing code:\n{guardrails}" \ 2. CI/CD compliance gate — iterate the rules as a pipeline step, flag PRs that touch relevant systems without addressing applicable controls, use rule id as a stable reference for tracking exceptions over time. 3. GRC platform import — most GRC tools have their own framework mappings; control id gives you a clean join key. What I learned building the pipeline The hardest part wasn't the rule generation — it was source data. NIST's REST API for CPRT returns a 403 for direct automated access, so it has to be manually exported from their catalog first. And their JSON schema is genuinely inconsistent between versions — I had a bug where severity data was silently defaulting to "UNKNOWN" for weeks because CVSS v3 nests baseSeverity inside cvssData , while CVSS v2 puts it as a sibling field. Classic "the data looked fine until I actually checked it" bug. Where this is going I ended up with 125 rules across both frameworks — full coverage, not a sample. I've packaged the complete output both JSON files as a one-time license if anyone wants the finished dataset instead of building the pipeline themselves: link . But honestly, the more interesting part to me is the pattern itself — turning static regulatory text into something an AI agent can actually reason about, rather than a document a human has to remember to check. Curious if anyone else has tackled compliance-as-code for other frameworks SOC 2, ISO 27001, HIPAA — would love to compare notes on parsing approaches in the comments.