The Fine Print

import os
from typing import TypedDict
from langgraph.graph import StateGraph, END
from langchain_openai import ChatOpenAI
from langchain_core.prompts import ChatPromptTemplate
class AuditState(TypedDict):
    internal_policy: str
    target_regulation: str
    extracted_clauses: str
    evaluation_result: str
    final_report: str
llm = ChatOpenAI(model="gpt-4o", temperature=0)
def extractor_node(state: AuditState) -> dict:
    prompt = ChatPromptTemplate.from_messages([
        ("system", "You are a GRC data extraction specialist. Extract only the clauses from the Internal Policy that directly relate to the Target Regulation. If none apply, state 'No relevant clauses found.'"),
        ("human", "Internal Policy:\n{policy}\n\nTarget Regulation:\n{regulation}")
    ])
    chain = prompt | llm
    res = chain.invoke({"policy": state["internal_policy"], "regulation": state["target_regulation"]})
    return {"extracted_clauses": res.content}
def evaluator_node(state: AuditState) -> dict:
    prompt = ChatPromptTemplate.from_messages([
        ("system", "You are a Senior GRC Auditor. Evaluate the extracted internal clauses against the target regulation. Determine status: COMPLIANT, NON_COMPLIANT, or PARTIALLY_COMPLIANT. Detail concrete gaps."),
        ("human", "Target Regulation:\n{regulation}\n\nExtracted Clauses:\n{clauses}")
    ])
    chain = prompt | llm
    res = chain.invoke({"regulation": state["target_regulation"], "clauses": state["extracted_clauses"]})
    return {"evaluation_result": res.content}
def reporter_node(state: AuditState) -> dict:
    prompt = ChatPromptTemplate.from_messages([
        ("system", "You are a GRC Reporting Agent. Format the evaluation into a clean, professional Markdown report containing: Status, Regulatory Scope, Findings, and Actionable Recommendations."),
        ("human", "Evaluation:\n{evaluation}")
    ])
    chain = prompt | llm
    res = chain.invoke({"evaluation": state["evaluation_result"]})
    return {"final_report": res.content}
workflow = StateGraph(AuditState)
workflow.add_node("extractor", extractor_node)
workflow.add_node("evaluator", evaluator_node)
workflow.add_node("reporter", reporter_node)
workflow.set_entry_point("extractor")
workflow.add_edge("extractor", "evaluator")
workflow.add_edge("evaluator", "reporter")
workflow.add_edge("reporter", END)
app = workflow.compile()
if __name__ == "__main__":
    sample_policy = "Section 4.1: Access controls require passwords to be at least 12 characters. MFA is encouraged for remote access."
    soc2_req = "CC6.1: Enforce MFA for all user access across all infrastructure endpoints and internal tools."
    
    inputs = {
        "internal_policy": sample_policy,
        "target_regulation": soc2_req,
        "extracted_clauses": "",
        "evaluation_result": "",
        "final_report": ""
    }
    
    out = app.invoke(inputs)
    print(out["final_report"])