GovSpec · experimental

From policy text to controls, with the ambiguity left visible.

GovSpec is the experimental tool side of AIGovSpec. A local implementation proposes structured requirements from policy text, supports reviewer decisions and generates candidate controls with source references. The public knowledge site does not offer document upload or a hosted GovSpec service.

Repository: services/govspec

Shared IR: packages/spec

Status: experimental local implementation

Test the schema against real provisions

Five manually structured cases expose conditions, exceptions, rights and voluntary recommendations before relying on extraction. All annotations remain pending human review.

Inspect the manual provision review

Ingest with stable citations

The local pipeline splits a document into addressable clauses, with paths such as art-9/para-2. Candidate artifacts retain those paths so a reviewer can check them against the source. A path identifies a passage; it does not establish its meaning or applicability.

Extract, verify, review

A model proposes candidate requirements: actor, modality, action, conditions, exceptions and timing. The pipeline checks quote matches and uses a second model pass to assess support. A reviewer accepts, edits, splits, merges or rejects candidates. Acceptance is a workflow decision; legal force comes from the instrument and its applicability.

Name the ambiguity, record the decision

For accepted requirements, the pipeline proposes ambiguities such as undefined terms, missing thresholds or unclear actors. Reviewers can record resolutions and their rationale. Identified blocking ambiguities stop compilation until a decision is approved; the system may still miss an ambiguity.

Compile and export

The implemented workflow gates generation on accepted requirements and approved decisions. It can propose controls, tests and evidence contracts, compile eligible controls to Cedar policies and export JSON, OSCAL, CSV and reviewer reports. These outputs still require review for completeness and suitability in the actual context.

Built on the framework

Requirements and gaps can carry tags from the framework: the governance object it bears on (incentives, institutions, infrastructures, safeguards), the cross-cutting test it engages (power, legitimacy, distribution, adaptability) and the lifecycle stage. The same vocabulary that organizes the field model organizes the output. Tags help connect a candidate requirement to the questions it raises; missing or incorrect tags remain review work.

What GovSpec does not conclude

Whether an organization complies with anything. GovSpec produces a traceable specification for people to act on, never a verdict.
That every ambiguity has been found or resolved correctly. It proposes ambiguities and resolutions for a policy owner to review and records their decisions.
That its extraction is complete. Benchmark annotations still await human review. Actor/action matching does not establish preserved meaning. Reviewers still need to inspect conditions, exceptions and timing. A quote match does not prove the proposed requirement follows from the text.
That a machine-testable control is the whole obligation. Judgment-required and procedurally-verifiable requirements are labelled as such and keep their human steps.

For local evaluation

Developers with the project checkout can follow services/govspec/README.md for local setup. The reviewer guide, architecture, IR reference and deployment guide are in the repository's docs/ directory. This is a separate service with its own database, document parser and model configuration; deploying the knowledge site does not deploy it.

You can inspect the manual provision review on this site without running the service. Its AI-assisted annotations are pending human review and are not legal advice.