Things I am building because the manual version kept failing.
Everything here is in active development — not generally available, certified, or in use by clients. It is a record of the problems that pushed me to write software instead of another spreadsheet.
Veritas
In development — not available
Veritas connects assessment findings to their source evidence and flags unsupported conclusions for human review. It reads the documents a vendor actually sends and returns findings tied to specific source text; where the evidence falls short, it raises an open question for a person instead of stating a claim as fact.
What it ingests
SOC 2 reports
Security questionnaires
Penetration-test summaries
Informed by
NIST AI Risk Management Framework
NIST Generative AI Profile
ISO/IEC 42001
These are design references. Veritas is not certified against them and no compliance claim is made.
How a finding stays tied to its evidence
Source — vendor SOC 2 report (sample passage)
… §4.2 Logical Access. Access to production systems requires multi-factor authentication for all personnel. Access rights are reviewed on a quarterly basis by the security team. …
Finding, linked to source
The report states that production-system access requires MFA for all personnel.
Cited: SOC 2 Type II report · p. 24, §4.2
Pending review — a person confirms whether this reflects the control in operation.
Illustrative. Sample content, not a screenshot of a working product.
Evidence chain — how a finding is produced
01Source ingestedDocument parsed and retained with version and date.
02Passage citedA candidate finding must point to specific source text.
03Citation checkedA deterministic check confirms the quoted text exists in the source. Failures are discarded, not smoothed over.
04Supported, or an open questionInsufficient evidence produces a question for review rather than a conclusion.
05Human decision recordedA reviewer accepts, edits, or rejects. The assessment is versioned and the trail preserved.
Core principles
Human-in-the-loop verificationNo finding leaves the system without a reviewer’s decision attached.
Deterministic citation checksQuotation matching is code, not a model’s self-assessment.
Versioned assessmentsRe-assessment creates a new version; prior conclusions remain readable.
Audit trailsWho changed what, when, and on the basis of which source.
Regression testingA fixed evaluation set catches drift when prompts or models change.
Evidence provenanceEvery claim traces back to a document, version, and location.
Governed AI useModel use is scoped, documented, and reviewable — the same standard I would ask of a vendor.
Automation projects
Also in development.
In development
Approval notification pipeline
A webhook-based pipeline connecting GRC, ticketing, and notification tools so a stalled approval surfaces on its own — without moving approval authority away from the person who holds it.
Webhooks
GRC → ticketing → notification
Stall detection
In development
Governed reporting workflow
An AI-assisted workflow that consolidates ticket and form data into leadership reporting, with a defined human review step before publication. The point is not faster slides; it is that someone accountable has checked the numbers.
Data consolidation
Defined review gate
Leadership reporting
Have a workflow that needs this kind of thinking?
The same approach applies to client work: build only what removes real manual effort, and keep the review step visible.