04 / 05 · SIA GIT Hackathon 2026
PolicyPaul
The model flags the gaps. A person decides what happens next.
Python · Streamlit · Anthropic SDK · Sample data only
The problem
Regulations keep changing, but policy reviews usually happen on a cycle, before an audit or after an incident. Mapping a new regulation to internal policy by hand takes days and needs specialist knowledge.
My role
Team hackathon entry. I built the full working app and the pitch deck, and pitched it with the team.
How it works
- InputChoose teamSecurity or Legal sets the analyst role
- SourceDetect new publicationsUpdates from regulatory sites (sample data)
- Human gateConfirm clausesReviewer edits and approves the list
- Code gateWrap untrusted textDelimiter tags, fake tags stripped
- ModelCheck each clauseAI returns a JSON verdict per clause
- Code gateValidate the replySeven fields, risk level, escaped
Model stepHuman or code gatePlain step
What I built
- 01Built a four-stage Streamlit workflow with a human checkpoint before any model call
- 02Wrote a per-clause gap check that returns seven structured fields: verdict, one-line summary, risk level, current vs required state, draft policy wording and remediation tasks.
- 03Added delimiter-based prompt protection, reply validation and output escaping to reduce the risk from untrusted text.
Trust boundaries · where the AI is held in check
- AA person confirms the clauses before Claude sees them. The tool helps analysts; it does not replace them.
- BRegulation, clause and policy text is treated as data: delimiter tags, look-alike tags removed, and a system prompt that says to ignore instructions inside the text.
- CThe reply must be valid JSON with the expected fields and a risk level of High, Medium or Low, and it is HTML-escaped on screen. Anything else shows as an error card.
- DThe whole policy goes into the prompt instead of retrieval, which avoids retrieval misses on a short policy.
- EOne request per clause, each isolated, so one failure does not stop the run. Failed clauses are flagged and left out of the totals.
Outcome
Presented at the SIA GIT Hackathon 2026. Runs locally with a working live analysis step.
Screens
