Casebook AI

Turn messy compliance reports, policies, and evidence into an auditable, human-controlled investigation workflow.

Comment

Inspiration

Compliance investigations rarely arrive as clean data. A reviewer may receive a report, policy passages, email excerpts, a partial system export, and a deadline—then spend hours building a timeline, identifying missing evidence, and documenting why each next step was chosen. Generic AI summaries are not enough because regulated work needs provenance, human judgment, and an audit trail.

I had already built Casebook as a local case-management tool for small compliance teams. For OpenAI Build Week, I extended it with a narrow AI workflow that tackles the hardest part of an investigation without pretending the model is the decision-maker.

What it does

The investigator opens a case, pastes an approved report, policy excerpt, and evidence notes, and explicitly submits that packet for analysis. GPT-5.6-sol produces a structured brief containing:

  • allegations distinguished from verified facts
  • a dated timeline
  • policy matches
  • evidence gaps and source conflicts
  • risk flags and recommended actions
  • review and interview questions

Every factual proposal includes a short source quote. Casebook independently checks each quote against the submitted text and displays whether it is an exact match. The case owner then accepts or rejects proposals one by one. Accepted evidence gaps and recommended actions become ordinary checklist items, and every generation or review decision is appended to the case activity timeline.

The model cannot silently edit the case or make a final misconduct or legal determination.

How I built it

Casebook is a portable Go application with an embedded HTML/CSS/JavaScript interface and a local SQLite database. The Build Week extension uses the OpenAI Responses API with GPT-5.6-sol, medium reasoning effort, and strict JSON Schema output.

The server adds safeguards around the model call:

  • explicit user submission and cloud-processing notice
  • store: false
  • only the packet pasted into the AI Brief tab plus minimal case context
  • input limits and a SHA-256 packet fingerprint
  • a per-user hashed safety identifier
  • exact-quote grounding performed after generation
  • owner/coverer permission checks
  • immutable, idempotent review decisions
  • append-only provenance events

A deterministic synthetic fixture lets judges exercise the complete workflow without an API key.

Challenges

The hardest problem was designing useful model assistance without weakening the case record. A polished summary would have been easy, but it would not be defensible. I separated model proposals from human decisions, required evidence for factual items, verified quotes outside the model, and made accepted actions flow into the same operational checklist and audit trail as ordinary case work.

Maintaining a clear privacy boundary in a local-first application was equally important. The UI makes the cloud step explicit and sends only the packet the investigator chooses to paste.

Accomplishments

  • AI output is operational, not decorative: accepted actions become trackable work.
  • Every factual citation is independently checked against the submitted packet.
  • Human review is item-level and permanent; the AI never writes silently.
  • The complete flow works with deterministic synthetic data and no API key.
  • A live GPT-5.6-sol test returned 32 citations, all 32 verified as exact matches.
  • The pre-existing application and Build Week additions are separated by a tagged baseline and dated commits.

What I learned

The most valuable AI pattern for regulated work is not “answer the question.” It is “propose a structured, sourced intermediate artifact that a responsible human can inspect and apply.” Strict schemas make the interface predictable, but product trust comes from the surrounding controls: data minimization, independent grounding, permissions, immutable decisions, and visible provenance.

What's next

  • Local file extraction and redaction before optional model submission
  • Policy-library versioning and effective-date checks
  • Conflict review across interviews and evidence packets
  • Configurable retention and encryption for AI inputs
  • Enterprise authentication, TLS, and role-based access control
  • Evaluation sets for citation coverage, unsupported claims, and investigator usefulness

Try it without an API key

Download the release, create or open a sample case, open AI Brief, choose Load synthetic demo, then Generate synthetic brief. Accept one recommended action and confirm it appears in Checklist and Activity.

Built With

Share this project:

Updates