Canary

Inspiration

I lead IT and automation at a credit union, and I've watched our risk and compliance team work as human RSS readers — manually checking NCUA letters, NACHA rule updates, IRS bulletins, and the Federal Register, then forwarding emails and hoping the right team prepares in time. A miss is expensive: when the IRS retired the FIRE filing system for IRIS, catching it late would have broken 1099 filing season. Canary is the early-warning layer I wish I could buy.

What it does

Canary is an autonomous regulatory-intelligence agent for credit union compliance teams. It continuously monitors live government sources (Federal Register, NCUA, NACHA, IRS), detects new items, and classifies each one for this institution: impact level, which regulations are touched, and — the key output — which business units own the response. Every detection auto-opens a case. The agent drafts the owner notification itself, advances routine (LOW/MED) cases fully autonomously, and escalates HIGH-impact items to a human for review with the draft attached — graduated autonomy by policy, not vibes. Every action writes an audit event, because in regulated finance an agent's work has to survive an examiner. A second capability verifies field-of-membership eligibility: give it an address and it geocodes, checks district boundaries, and returns a verdict with an evidence chain.

How we built it

Python agent loop on AWS Bedrock — no frameworks — with source adapters polling real government APIs and a harness gate that every decision flows through. Guild.ai governs the agent and concurs on escalations; every state transition lands in ClickHouse Cloud (the audit trail the dashboard reads live); every model call is traced in Langfuse, tagged with impact and owning units. The UI is a three-pane compliance workspace (React + Tailwind + shadcn) where each case workspace is composed at runtime by Thesys C1 from a custom component library via OpenUI — the agent generates a different workspace per regulatory change, and the components render live database state exclusively so generative UI can never drift from ground truth. Measured end-to-end: a new item goes from detection to classified, owner-routed, and escalated on screen in 6–12 seconds.

Challenges we ran into

Generative UI truthfulness was the hard one: clicking a case before triage finished caused C1 to invent an impact level, so we re-architected the boundary — C1 composes the workspace, but the data layer renders only live DB state, showing "classifying impact…" until truth converges. Thesys custom components needed exact {component, schema} pairs with client-side Zod v4 schemas (two other formats crash). We also reordered the pipeline mid-build so escalation never blocks on the drafting call — the case lands red immediately and the agent's memo attaches asynchronously, which is both faster to demo and the correct production design.

Accomplishments that we're proud of

A solo, one-day build where five sponsor tools are load-bearing rather than decorative — remove any of Bedrock, Guild, ClickHouse, Langfuse, or Thesys C1 and a real feature dies. An agent that runs unattended on live government data — the dashboard's status strip ticks "last poll 8s ago" the entire time because the polling loop never stops. Graduated autonomy implemented as policy: the harness decides when a human is required. And a UI a compliance officer would recognize as a tool, not a hackathon demo.

What we learned

Generative UI needs a truth boundary: let the model compose the interface, never let it author the facts. Harness engineering is mostly deciding where autonomy ends — the interesting code is the gate, not the model call. And the highest-leverage demo engineering is making autonomy ambient: a status strip quietly proving the agent is working beats anything you can say out loud.

What's next for Canary

More sources — CFPB, FinCEN, and state regulators — plus notification delivery into Slack, Teams, and email so the agent's drafts land where teams actually work. Richer FOM verification against actual charter documents instead of a hardcoded district list. And multi-tenant deployment so one Canary serves many institutions, each with institution-specific classification — credit unions are cooperatives, and shared regulatory intelligence is a natural fit for how they already operate.

Built With

• aws-bedrock-(claude)
• boto3
• clickhouse-cloud
• federal-register-api
• guild.ai
• irs-public-sources
• javascript
• langfuse
• nacha
• ncua
• nominatim/openstreetmap
• openui
• playwright
• python
• react
• shadcn/ui
• sqlite
• tailwind-css
• thesys-c1
• uv
• vite
• zod