Autonomous Compliance Agent

An agentic system that ingests contracts and policy documents, extracts clauses, compares them against a compliance ruleset, classifies risks as HIGH / MEDIUM / LOW, self-corrects via a critic loop, and produces a structured audit report — fully autonomously.

---

Architecture

PDF Upload
    │
    ▼
┌─────────────┐
│  Ingestor   │  PyMuPDF → raw text
└──────┬──────┘
       │
       ▼
┌──────────────────┐        ┌─────────────────┐
│ Clause Extractor │        │  Rule Retriever │
│  LLM → clauses   │        │  FAISS + embed  │
└────────┬─────────┘        └────────┬────────┘
         └──────────┬────────────────┘
                    ▼
           ┌─────────────────┐
           │   Comparator    │  clause vs rules → HIGH/MED/LOW findings
           └────────┬────────┘
                    ▼
           ┌─────────────────┐
           │     Critic      │  confidence check + flags
           └────────┬────────┘
                    │
         ┌──────────┴──────────┐
         │ low confidence?     │
         ▼                     ▼
    ┌──────────┐          ┌──────────┐
    │  Refine  │──────────│ Reporter │
    │  (loop)  │  pass    │ JSON+PDF │
    └──────────┘          └──────────┘

Built on LangGraph StateGraph with a conditional critic→refine loop — each low-confidence finding is automatically sent back for re-assessment before the final report is generated.

---

Stack

Layer	Technology
PDF parsing	PyMuPDF (fitz)
Agent orchestration	LangGraph
Vector store	FAISS via LlamaIndex
Embeddings	FastEmbed (BAAI/bge-small-en-v1.5) — no OpenAI dependency
LLM	Groq llama-3.1-8b-instant
Report generation	ReportLab
API	FastAPI
UI	Streamlit

---

Key Features

• Autonomous clause extraction — LLM identifies every distinct contractual obligation from raw PDF text
• Semantic rule retrieval — FAISS vector search finds the most relevant compliance rules per clause (GDPR, ISO 27001, custom policy)
• Risk classification — each clause assessed as HIGH / MEDIUM / LOW / COMPLIANT with confidence score and justification
• Self-correcting critic loop — a second LLM pass reviews all findings, flags low-confidence ones, and triggers refinement automatically
• Structured output — JSON findings + formatted PDF audit report with severity badges and download
• Live agent trace — Streamlit UI streams each pipeline step in real time
• Framework-agnostic rules — add any .txt or .pdf rule file to data/rules/ to extend the compliance framework

---

Setup

Prerequisites

• Python 3.9+
• Groq API key (free tier works)

Install

git clone https://github.com/Vedant-1404/autonomous_compliance-_agent-LangGraph-Groq-FAISS.git
cd autonomous_compliance-_agent-LangGraph-Groq-FAISS
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

Configure

cp .env.example .env
# Add your GROQ_API_KEY to .env

Build the rules index

python scripts/build_index.py

Three rule sets are included out of the box — GDPR Articles 5–83, ISO 27001:2022 Annex A controls, and an internal contract policy template. Add your own .txt or .pdf files to data/rules/ and re-run with --force to extend.

Run

# Streamlit UI
streamlit run streamlit_app.py

# FastAPI (optional)
uvicorn main:app --reload

Upload any PDF contract → click Run Compliance Analysis → watch the agent trace → download JSON or PDF report.

---

API

POST /analyze

Upload a PDF and receive a full JSON audit report.

curl -X POST http://localhost:8000/analyze \
  -F "file=@contract.pdf" | python3 -m json.tool

Response:

{
  "meta": {
    "document": "contract.pdf",
    "generated_at": "2026-04-11T08:30:00Z",
    "total_clauses": 5,
    "refine_cycles": 1
  },
  "summary": { "HIGH": 2, "MEDIUM": 1, "LOW": 0, "COMPLIANT": 2 },
  "findings": [
    {
      "clause_id": "c2",
      "severity": "HIGH",
      "matched_rule": "GDPR Article 5 — Storage limitation",
      "violation_summary": "Indefinite retention without consent violates storage limitation.",
      "justification": "GDPR requires data deleted when no longer necessary.",
      "confidence": 0.91,
      "refined": false
    }
  ]
}

GET /report/{filename}

Download a previously generated PDF report.

GET /health

{ "status": "ok" }

---

Project Structure

├── app/
│   ├── graph/
│   │   ├── state.py          # AgentState TypedDict
│   │   ├── nodes.py          # 6 node functions (ingestor → reporter)
│   │   └── graph.py          # StateGraph wiring + conditional edges
│   ├── tools/
│   │   ├── ingestion.py      # PyMuPDF text extraction
│   │   ├── retrieval.py      # FAISS index build + semantic query
│   │   └── report.py         # JSON + ReportLab PDF generation
│   ├── prompts.py            # LLM prompt templates (extraction, comparison, critic, refine)
│   └── config.py             # Env vars + tunable constants
├── data/
│   └── rules/                # GDPR, ISO 27001, custom policy rule files
├── scripts/
│   └── build_index.py        # One-time FAISS index builder
├── tests/
│   ├── conftest.py
│   ├── test_nodes.py         # Unit tests for every node
│   ├── test_retrieval.py     # FAISS index + query tests
│   └── test_graph.py         # Routing logic + end-to-end integration
├── main.py                   # FastAPI app
├── streamlit_app.py          # Streamlit UI
└── requirements.txt

---

Configuration

All tunable constants in app/config.py:

Variable	Default	Description
GROQ_MODEL	llama-3.1-8b-instant	Groq model used for all LLM calls
CONFIDENCE_THRESHOLD	0.65	Below this, findings are flagged for critic refinement
MAX_REFINE_CYCLES	1	Hard cap on critic→refine iterations
RETRIEVAL_TOP_K	3	Rule chunks retrieved per clause
MAX_DOC_CHARS	12000	Character limit sent to LLM for clause extraction

---

Adding Custom Compliance Frameworks

1. Create a .txt file in data/rules/ — one rule per paragraph
2. Run python scripts/build_index.py --force
3. No code changes needed — the retriever is framework-agnostic

Supported rule file formats: .txt, .pdf

---