Compliance Findings & Autonomous Remediation

Rescile enables continuous governance and automated repair by allowing compliance controls to emit structured Compliance Findings linked directly to Remediation Contracts.

When a compliance audit rule detects an inconsistency, it does not merely log an error. It instantiates a finding vertex in the graph containing:

1. rule_id and code: Standardized identification of the violated rule.
2. severity: "CRITICAL", "WARNING", or "INFO".
3. remediation_contract: The name of the intent contract in contracts/*.toml that repairs the condition.
4. suggested_inputs: A pre-calculated inputs map tailored to resolve the finding immediately.

AI agents discover these findings via the MCP tool listComplianceFindings and execute the suggested repair via invokeContract, achieving closed-loop self-healing.

Configuring Compliance Targets for Remediation

Compliance controls are defined in compliance/*.toml or compliance/*.jsonnet:

audit_id = "GL-GOVERNANCE"
audit_name = "General Ledger Mapping Audit"

[[control]]
id = "CTRL-GL-001"
name = "Mandatory GL Account Assignment"
description = "All active fee schedules must have a mapped General Ledger account"

  [[control.target]]
  origin_resource_types = "fee_schedules"
  # Match condition detecting unmapped fee schedules
  match_on = [
    { property = "gl_account", exists = false }
  ]
  # Name of the contract to call for repair
  remediation_contract = "assign_fee_gl_account"
  
  # Pre-calculated parameters with dynamic template rendering
  suggested_inputs = {
    schedule_name = "{{ origin_resource.name }}",
    gl_account = "GL_DEFAULT_SUSPENSE"
  }

  [control.target.resource]
  resource_type = "compliance_violation"
  name = "gl-violation-{{ origin_resource.name }}"
  [control.target.resource.properties]
  code = "ERR_UNMAPPED_GL"
  severity = "CRITICAL"
  message = "Fee schedule {{ origin_resource.name }} lacks a General Ledger account mapping"

Generic Metadata Tagging

Rescile core automatically tags all resources created under compliance targets with:

• _compliance = true
• audit_id = "<audit_id>"
• control_id = "<control_id>"
• rule_id, code, severity, and message

The resource type can be named anything (compliance_violation, compliance_finding, temporal_gap, etc.). Core does not hardcode any resource name.

Workspace Contract Validation

During static workspace validation (rescile-ce validate), Rescile verifies that any contract referenced in remediation_contract actually exists in contracts/*.toml.

If a compliance rule references a missing contract, validation emits a warning:

WARN: Issue [compliance.remediation_contract.unresolved]:
  Control 'CTRL-GL-001' in module 'parameter-governance' references remediation contract 'assign_fee_gl_account', but no such contract is declared in the workspace.

Decoupling Domain Logic into Module Libraries (lib/)

Complex business domain logic (such as banking effective date timelines, network CIDR math, or custom cryptographic validations) should be kept out of Rescile core.

Instead, define your domain functions in module scripts:

• Rhai: lib/<domain>.rhai
• Jsonnet: lib/<domain>.libsonnet

Modules can use the built-in, sandboxed read_input_json function in Rhai to read reference tables without producing graph nodes:

// lib/temporal.rhai
fn is_timeline_valid(dummy, args) {
    let rules = read_input_json("determination_rules.json");
    // Run interval overlap or gap checks...
    true
}

In compliance templates or models, invoke the library function:

{% set is_valid = lib(path='temporal.rhai', function='is_timeline_valid') %}

The Closed-Loop Self-Healing Agent Workflow

┌─────────────────┐       ┌──────────────────────┐       ┌────────────────────────┐
│ Property Graph  │ ────> │ MCP Server           │ ────> │ AI Agent               │
│ - Assets        │       │ listComplianceFindings│       │ - Inspects finding     │
│ - Findings      │ <──── │ invokeContract       │ <──── │ - Submits suggested    │
└─────────────────┘       └──────────────────────┘       │   inputs to contract   │
                                                         └────────────────────────┘

1. Discovery: Agent calls listComplianceFindings.
2. Analysis: Agent receives:

   {
     "resource_type": "compliance_violation",
     "rule": "CTRL-GL-001",
     "severity": "CRITICAL",
     "remediation_contract": "assign_fee_gl_account",
     "suggested_inputs": {
       "schedule_name": "fee_wire_eur",
       "gl_account": "GL_DEFAULT_SUSPENSE"
     }
   }
   

3. Execution: Agent calls invokeContract:

   {
     "contract_name": "assign_fee_gl_account",
     "inputs": {
       "schedule_name": "fee_wire_eur",
       "gl_account": "GL_DEFAULT_SUSPENSE"
     }
   }
   

4. Reactive Re-evaluation: Rescile applies the validated mutation, re-evaluates the graph in memory, and the violation disappears instantly.