Compliance Agent
Evaluates a script against admin-defined organizational rules. Three rule kinds, each with distinct evaluation semantics and cost.
Rule kinds
| kind | Evaluation | Best for |
|---|---|---|
regex | Deterministic. Compiled with new RegExp(pattern, flags). Pass = (matches XOR negate). No LLM call. | Hard rules: forbid DROP TABLE, require BEGIN/COMMIT, enforce naming. |
llm | Rule name + description go to the model; it returns pass/fail + evidence + reason. | Judgment: "no PII columns without encryption", "changes must carry a purpose comment". |
hybrid | Regex first. Regex pass → done, no LLM call. Regex fail → LLM confirms or exonerates. | Fast common case; model only adjudicates borderline matches. |
Per-rule fields
name,description,severity(info / warning / error), only error-severity failures block overall pass.kind+pattern+patternFlags+patternNegatecategory, free-form taxonomy ('security', 'naming', 'performance', ...) for filtering.appliesToDialects, multi-select; empty = all dialects.appliesToEnvironments, multi-select from defined environments; empty = all.remediation, plain-English fix surfaced to authors.isActive, inactive rules are skipped.
patternNegate
Default (false): script fails when the pattern matches, forbidden constructs.
negate=true: script fails when the pattern is missing, required clauses (e.g. BEGIN[\\s\\S]*COMMIT with negate=true to mandate transaction wrapping).
Overall pass
pass = !checks.some(c => !c.pass && c.severity === 'error'), only error-severity failures block; warnings and info are advisory.
Management
Left navigation → Compliance Rules (admin / release_manager only). Sortable rule table with an editor modal covering the full rule shape.
Seed rules
- No DROP TABLE, kind=regex, pattern=
\\bDROP\\s+TABLE\\b, severity=error - Require ticket reference, kind=regex, pattern=
--\\s*[A-Z]+-\\d+, negate=true, severity=warning, category=naming - No PII columns without encryption, kind=llm, severity=error, description "Reject scripts adding columns named email, ssn, phone, dob, etc. unless explicitly marked encrypted"
- DELETE without WHERE, kind=hybrid, pattern=
(?i)\\bDELETE\\b(?![^;]*WHERE), severity=error