gc-validator

Controls-as-code validator for AI and agentic systems: policy checks, human-in-the-loop gates, and audit evidence.

Author: Deepanshu Goyal · personal capacity · @deepango · Organization -

Apache License 2.0. Inbound contributions use the Developer Certificate of Origin 1.1 — no CLA.

This is not legal advice. Packs encode checkable predicates that cite an instrument and section. They do not reproduce gazette text and do not claim that a system is compliant.

What it does

system.yaml  +  YAML control pack  →  JSON report (+ HITL gate records)

• Active pack: india-dpdp-meity — DPDP Act 2023, DPDP Rules 2025, and MeitY India AI Governance Guidelines (5 November 2025).
• Planned packs (stubs): NIST AI RMF, ISO/IEC 42001, EU AI Act, OWASP AI Exchange, CSA AICM. Those land in v0.1.

India is the only jurisdiction module. Out of scope: RBI, SEBI, FINOS, AIGF, bank consortia, and financial-services use cases. See SCOPE.md.

Quick start

Python 3.11+:

pip install -e ".[dev]"
gc-validator check -p india-dpdp-meity -i examples/agent_system.yaml

Write a report file:

gc-validator check -p india-dpdp-meity -i examples/agent_system.yaml -o report.json

Exit status is 0 only when every applicable control passes (no fail, no pending HITL sign-off).

Status

Public scaffold: github.com/deepango/gc-validator. International packs are status: planned until v0.1.