Skip to content

Things I am building because the manual version kept failing.

Everything here is in active development — not generally available, certified, or in use by clients. It is a record of the problems that pushed me to write software instead of another spreadsheet.

Veritas

In development — not available

Veritas connects assessment findings to their source evidence and flags unsupported conclusions for human review. It reads the documents a vendor actually sends and returns findings tied to specific source text; where the evidence falls short, it raises an open question for a person instead of stating a claim as fact.

What it ingests

  • SOC 2 reports
  • Security questionnaires
  • Penetration-test summaries

Informed by

  • NIST AI Risk Management Framework
  • NIST Generative AI Profile
  • ISO/IEC 42001

These are design references. Veritas is not certified against them and no compliance claim is made.

How a finding stays tied to its evidence

Source — vendor SOC 2 report (sample passage)

§4.2 Logical Access. Access to production systems requires multi-factor authentication for all personnel. Access rights are reviewed on a quarterly basis by the security team. …

Finding, linked to source

The report states that production-system access requires MFA for all personnel.

Cited: SOC 2 Type II report · p. 24, §4.2

Pending review — a person confirms whether this reflects the control in operation.

Illustrative. Sample content, not a screenshot of a working product.

Evidence chain — how a finding is produced

  1. 01Source ingestedDocument parsed and retained with version and date.
  2. 02Passage citedA candidate finding must point to specific source text.
  3. 03Citation checkedA deterministic check confirms the quoted text exists in the source. Failures are discarded, not smoothed over.
  4. 04Supported, or an open questionInsufficient evidence produces a question for review rather than a conclusion.
  5. 05Human decision recordedA reviewer accepts, edits, or rejects. The assessment is versioned and the trail preserved.

Core principles

  • Human-in-the-loop verificationNo finding leaves the system without a reviewer’s decision attached.
  • Deterministic citation checksQuotation matching is code, not a model’s self-assessment.
  • Versioned assessmentsRe-assessment creates a new version; prior conclusions remain readable.
  • Audit trailsWho changed what, when, and on the basis of which source.
  • Regression testingA fixed evaluation set catches drift when prompts or models change.
  • Evidence provenanceEvery claim traces back to a document, version, and location.
  • Governed AI useModel use is scoped, documented, and reviewable — the same standard I would ask of a vendor.

Automation projects

Also in development.

In development

Approval notification pipeline

A webhook-based pipeline connecting GRC, ticketing, and notification tools so a stalled approval surfaces on its own — without moving approval authority away from the person who holds it.

  • Webhooks
  • GRC → ticketing → notification
  • Stall detection

In development

Governed reporting workflow

An AI-assisted workflow that consolidates ticket and form data into leadership reporting, with a defined human review step before publication. The point is not faster slides; it is that someone accountable has checked the numbers.

  • Data consolidation
  • Defined review gate
  • Leadership reporting

Have a workflow that needs this kind of thinking?

The same approach applies to client work: build only what removes real manual effort, and keep the review step visible.

Discuss a project