Orchestrating AI Agents Over a Compliance Knowledge Base
Orchestrating AI Agents Over a Compliance Knowledge Base
Compliance work is repetitive, high-stakes, and document-heavy - exactly the kind of work AI agents should handle. But most agent frameworks are stateful, making them a nightmare to audit. The fix is stateless sub-agents with structured JSON I/O.
The Stateless Sub-Agent Pattern
Each sub-agent receives a JSON input, does one thing, and returns a JSON output. No persistent memory between runs. No hidden state that regulators cannot inspect. The orchestrator chains these agents together but each step is independently verifiable.
{
"agent": "policy-checker",
"input": { "document_id": "SOC2-2026-Q1", "section": "access-controls" },
"output": { "compliant": false, "findings": ["MFA not enforced for admin accounts"] }
}
Why Stateless Matters for Compliance
Auditors want to see exactly what happened at each step. With stateful agents, you get "the AI decided X" with no clear trace. With stateless sub-agents, every decision is a JSON record that maps input to output. You can replay any step, verify any finding, and prove to regulators exactly how the system reached its conclusion.
Building the Orchestrator
The orchestrator is a simple pipeline. It pulls documents from your compliance knowledge base, routes them to the appropriate sub-agent, collects outputs, and generates a report. Each sub-agent is specialized - one checks access controls, another reviews encryption policies, another validates data retention rules.
The key design choice is keeping the knowledge base separate from the agents. Agents query it but never modify it. Updates to regulations flow through a reviewed, versioned process - not through an AI deciding to update its own knowledge.
Practical Limits
This pattern works well for structured compliance frameworks like SOC 2, HIPAA, and ISO 27001 where rules are codified. It struggles with ambiguous regulations where human judgment is genuinely required. Use agents for the mechanical checking and flag the ambiguous cases for human review.
Fazm is an open source macOS AI agent. Open source on GitHub.