Neo Governance GRC Agent

Graph-backed AI governance × GRC engineering lab (formerly AI GRC Governance Lab) — controls-as-code, agent tracing, multi-framework SCF bindings, and public assurance proofs.

Aimed at roles like:

• Plaid Security Engineer, GRC
• Zscaler Principal AI Security Specialist

Grounded in prior work: Sourceline Academy + GRC recovery lab.
Public proof patterns aligned with jtflack-grc/grc-engineering-pipeline (pass and fail custody, OSCAL traversal, offline verify).

Choose your review path

If you have…	Start here	What you get
60 seconds	PORTFOLIO-CASE-STUDY.md	Problem, six-stage design, AI differentiators, limitations
5 minutes	wiki/grc-pipeline-alignment.md	Gap matrix vs the public GRC engineering pipeline
10 minutes	ASSURANCE-CHECKLIST.md	Reviewer proof matrix
A terminal	scripts/verify-assurance-graph.sh	CHAIN INTACT + ASSURANCE GRAPH VERIFIED (no AWS creds)

./scripts/verify-assurance-graph.sh

Quick start (offline, $0)

cd /agent/ai-grc-governance-lab
PYTHONPATH=. python3 -m practice.agent_tracer run --scenario happy
PYTHONPATH=. python3 -m practice.agent_tracer run --scenario missing_tool_span
PYTHONPATH=. python3 -m practice.agent_tracer score
python3 practice/aws_lab/test_gateway_offline.py
PYTHONPATH=. python3 -m practice.tprm seed
PYTHONPATH=. python3 -m practice.tprm assess --scenario model_swap
PYTHONPATH=. python3 -m practice.meridian_adapter govern-tracer --scenario happy
PYTHONPATH=. python3 -m practice.agent_tracer run --scenario happy --governed
python3 scripts/query_control_graph.py role job:plaid-grc

AWS lab (low budget, destroyable)

See docs/aws-lab.md for the full teaching session.

cp terraform/terraform.tfvars.example terraform/terraform.tfvars
# set budget_alert_email
chmod +x scripts/*.sh
export BUDGET_EMAIL=you@example.com
./scripts/lab_up.sh                          # lab_mode=broken
./scripts/lab_invoke_gateway.sh leaky_secret
./scripts/lab_run_ccm.sh                     # expect fails
./scripts/lab_flip_mode.sh compliant
./scripts/lab_invoke_gateway.sh happy
./scripts/lab_run_ccm.sh                     # expect pass
./scripts/lab_destroy.sh                     # always

Budget target: ≤ $5/mo if forgotten, ~$0 if destroyed after class. No VPC/NAT/ALB/Config/GuardDuty.

SCF framework mappings (SOC2 · 800-53 · FedRAMP · KSI · CR26)

PYTHONPATH=. python3 -m practice.scf_mapper cache-hubs
PYTHONPATH=. python3 -m practice.scf_mapper map --offline
# → mappings/framework-satisfaction.json

Wiki: wiki/scf-framework-mappings.md · Attribution: docs/SCF-ATTRIBUTION.md
API: hackIDLE/scf-api (ethanolivertroy)

Hugging Face agent traces

pip install -r practice/hf_traces/requirements.txt
PYTHONPATH=. python3 -m practice.hf_traces govern --limit 3

Wiki: wiki/hf-agent-trace-governance.md · Cursor agent: .cursor/agents/hf-agent-trace-governance.md

Sourceline Academy site (AI × GRC track)

Dedicated learning subsite (Sourceline-branded, separate from the main GRC academy):

cd academy && npm install && npm run dev
# → http://localhost:5180          learn / scenario / guide / practice
# → http://localhost:5180/#/scenario   five-stage Northstar walkthrough
# → http://localhost:5180/boards.html   interactive tldraw boards

Five-stage Northstar scenario (real files + hashes)

cd scenarios/five-stages-northstar && python3 run_scenario.py
# control YAML → OIDC CCM → OPA on plan JSON → control board → agent attestation

See scenarios/five-stages-northstar/README.md.

Deployed production:

• https://sourceline-ai-grc.vercel.app
• Scenario (in-browser run): https://sourceline-ai-grc.vercel.app/#/scenario
• Boards: https://sourceline-ai-grc.vercel.app/boards.html

Redeploy:

cd academy && npx vercel deploy --prod --yes

Links back to sourceline-academy.vercel.app.

Capability boards (standalone Vite)

Interactive diagrams only (also embedded via academy/boards.html):

cd boards && npm install && npm run dev
# → http://localhost:5177

Prose companion: docs/program-operating-model.md.

Layout

Path	Purpose
academy/	Sourceline AI × GRC learning site (Vite SPA + boards)
scenarios/five-stages-northstar/	End-to-end quiz scenario with tf/rego/ci/agent
evidence/public/	Committed pass + signed-failure bundles (offline review)
oscal/	Profile + component definition → evidence URIs
sandbox/agent-job/	OCI-ready allowlist/deny sandbox harness
raw/	Immutable job + framework digests
wiki/	Synthesized knowledge with [[wikilinks]]
practice/	Offline agent-trace + TPRM vendor packet harnesses
boards/	tldraw capability diagrams (dev harness)
terraform/	Budget-safe AWS teaching infra
scripts/lab_*.sh	Up / invoke / CCM / flip / destroy
scripts/verify-assurance-graph.sh	Public assurance graph verifier
docs/aws-lab.md	Session guide + cost rules
docs/program-operating-model.md	Operating model + board walkthrough
mappings/control-graph.json	Assurance topology (incl. TPRM)
.understand-anything/	Knowledge graph for dashboard/skills

Principles

Compliance into code · evidence into telemetry · traces into audit controls · assess once / comply many.