gc-validator

Controls-as-code validator for AI and agentic systems: policy checks, human-in-the-loop gates, and audit evidence.

Author: Deepanshu Goyal · personal capacity · @deepango · Organization -

Apache License 2.0. Inbound contributions use the Developer Certificate of Origin 1.1 — no CLA.

This is not legal advice. Packs encode checkable predicates that cite an instrument and section. They do not reproduce gazette or standard text and do not claim that a system is compliant, certified, or AARM-conformant.

What it does

system.yaml  +  YAML control pack  →  JSON report (+ HITL gate records)

v0.1 active packs

Pack	Instrument (subset)
india-dpdp-meity	DPDP Act 2023, DPDP Rules 2025, MeitY India AI Governance Guidelines (5 Nov 2025)
nist-ai-rmf	NIST AI RMF 1.0 Core (NIST.AI.100-1)
iso-42001	ISO/IEC 42001:2023 Annex A
eu-ai-act	Regulation (EU) 2024/1689
owasp-ai-exchange	OWASP AI Exchange named controls
csa-aicm	CSA AICM v1.0 domains

India is the only jurisdiction module. Out of scope: RBI, SEBI, FINOS, AIGF, bank consortia, and financial-services use cases. See SCOPE.md.

Not AARM conformance. The CSA pack is AICM, not Autonomous Action Runtime Management. This tool is not listed on the AARM builders registry. Do not open a registry PR unless CSA chairs ask for a listing.

Quick start

Python 3.11+:

pip install -e ".[dev]"
gc-validator packs
gc-validator check -p india-dpdp-meity -i examples/agent_system.yaml

Write a report file:

gc-validator check -p nist-ai-rmf -i examples/agent_system.yaml -o report.json

Exit status is 0 only when every applicable control passes (no fail, no pending HITL sign-off). Unknown or inactive packs exit 2.

The example system is a fictional description used to exercise all v0.1 packs. It is not a real deployment and not a classification opinion.

Status

Tagged release: see CHANGELOG.md and github.com/deepango/gc-validator.