Compliance Advisory

An advisory answer carries weight because a client acts on it. A model can produce a confident paragraph about a rule that changed last quarter, and the reader cannot tell. Controls in this starter limit what reaches the model and hold the answer to a measured floor.

Identity is checked before any content check runs. Even with no roles listed, a call must arrive with a verified user and organization, because authentication defaults to on. Only two terms are blocked on the way in, secret and private key. Masking covers national identifier strings, which appear more often in client staff data than in advisory text.

Scoring is the main response control here. It requires 0.84 in aggregate, 0.78 for relevance and 0.80 for accuracy, with the two measures weighted alike. Fewer than 120 characters or fewer than two sentences also fails. A guidance draft that misses a floor is blocked, so a reviewer never receives a half formed recommendation.

No source check is configured. A cited rule, control reference or clause therefore needs an adviser to confirm it against the current requirement. The review step arrives empty and does nothing until you configure it. Audit marking notes allowed calls and neither stores nor retains anything by itself.

Reference material points at SOC 2 Type II, ISO 27001, GDPR and the NIST AI Risk Management Framework. Those are mapping targets for your own scoping work, not an assurance opinion. This starter can support an advisory workflow, and it cannot state that a client meets a requirement.