ClearStand
Problem
Architecture & Design
Start Page
Report
IBM Bob
IBM Technologies

🛡️ ClearStand | Responsible AI Auditing & Remediation Platform

Build with AI. Ship with confidence.

ClearStand is an agentic Responsible AI auditing platform that helps businesses build reliable, scalable, and trustworthy AI systems through evidence-backed evaluations, actionable recommendations, and human-approved GitHub code fixes.

💡 Inspiration

AI innovation is accelerating. But is responsible innovation keeping up?

According to McKinsey's 2025 State of AI report, 88% of organizations use AI in at least one business function. Yet IBM's 2025 Cost of a Data Breach Report found that 63% of organizations in its breach study lacked an established AI governance policy or were still developing one, while 97% of organizations reporting AI-related security incidents lacked proper AI access controls.

These risks aren't just theoretical. In October 2026, researchers discovered over 6,800 publicly discoverable conversation links from Meta's Muse AI assistant, some exposing sensitive personal and business information. Even widely used technologies can introduce unexpected privacy vulnerabilities.

As businesses race to integrate AI into their operations, ensuring these systems are ethical, transparent, inclusive, and secure becomes increasingly challenging. Developers understand code, compliance teams understand policies, and infrastructure operators understand deployment, but bridging these disciplines remains a major challenge.

Inspired by IBM's commitment to trustworthy AI, we built ClearStand to bridge the gap between AI governance and engineering through evidence-backed evaluations and actionable code fixes.

Because businesses shouldn't have to choose between rapid AI innovation and responsible development.

Together, we are empowering businesses to innovate confidently while building AI systems that are reliable, trustworthy, and sustainable at scale.

⚙️ What It Does

ClearStand evaluates AI-powered applications by addressing three fundamental questions:

🌍 1. Inclusive - Are we building AI that everyone can access and use?

AI applications should be accessible and useful to people with different abilities and needs.

Our Inclusive Agent uses IBM Equal Access Accessibility Checker and Playwright to evaluate a deployed application's user interface against accessibility standards.

It identifies potential barriers such as missing accessible labels, insufficient color contrast, and other detectable WCAG violations.

Each finding includes the affected interface element, relevant accessibility rule, and supporting evidence.

The goal: Help businesses create inclusive digital experiences that serve more users rather than unintentionally excluding them.

⚖️ 2. Ethical - Are we building AI that aligns with responsible policies and protects its users?

As businesses integrate AI into their products, ensuring alignment with privacy, safety, fairness, and governance requirements becomes increasingly important.

Our Ethical Agent uses Retrieval-Augmented Generation (RAG) to audit applications against a curated knowledge base of 1,815 AI risk records from 20 policy and governance sources, including NIST, OWASP, COPPA, FERPA, and IBM AI Atlas Nexus.

We use ASAGO Policy Mapper to transform governance documents into structured risk records and IBM Granite embeddings with ChromaDB to dynamically retrieve relevant requirements based on the application's purpose, target users, and sensitive data.

IBM Bob then analyzes the application's source code against these requirements, identifying potential privacy, safety, fairness, and governance violations.

For each finding, ClearStand verifies cited code excerpts against the actual repository and generates an evidence-backed risk assessment with policy references, severity, and actionable remediation recommendations.

The goal: Transform complex Responsible AI policies into actionable code-level assessments, helping businesses identify and address potential risks before deployment.

🔍 3. Transparent - Does our AI actually do what we say it does?

As businesses deploy AI agents, understanding what these systems do- and ensuring their implementation matches their documented behavior- is essential for trust, accountability, and reliability.

Our Transparency Agent uses IBM Mellea to audit the alignment between an application's AI implementation and its documentation.

It analyzes verified source-code and documentation excerpts to identify:

Undocumented AI functionality that stakeholders may not know exists
Implementation inconsistencies where AI behavior described in documentation differs from what the code implements
Transparency gaps that could make AI systems harder to understand, maintain, or govern

To prevent hallucinated evidence, ClearStand validates every cited excerpt against the original repository and flags uncertain findings for human review.

The goal: Help businesses understand what their AI systems are actually designed to do, identify gaps between documentation and implementation, and improve transparency, accountability, and long-term reliability.

🌱 Together - Building Sustainable AI for Business

Sustainable AI builds technology that businesses can trust, maintain, and scale for years to come.

By uniting ethical governance, transparency, and inclusivity, ClearStand helps businesses identify risks early, reduce costly rework, and build a stronger foundation for responsible innovation.

We envision a future where responsible AI isn’t an afterthought or a barrier to progress, but an integral part of how businesses innovate- making AI adoption more accessible, reliable, and sustainable.

Because the future of AI isn’t just about how fast we can build. It’s about building systems that last, serve everyone, and earn people’s trust.

📊 Unified Responsible AI Report Card

One dashboard. Three pillars. Actionable insights.

Developers submit a public GitHub repository, application context, and optionally a deployed URL. ClearStand's multi-agent pipeline transforms its evaluations into a unified, evidence-backed Responsible AI report.

Each finding answers five key questions: What's wrong? Where's the evidence? Why does it matter? How severe is it? How can we fix it?

Using a deterministic likelihood × impact scoring framework informed by OWASP and NIST, ClearStand prioritizes risks while distinguishing confirmed findings from those requiring further review. Failed or skipped evaluations are never treated as passing results.

The result: A transparent, accessible report that bridges the gap between compliance teams, AI engineers, and business stakeholders- turning complex technical findings into shared understanding and actionable next steps.

🤖 IBM Bob-Powered Remediation

ClearStand helps businesses identify risks and take action.

Once an issue is detected, IBM Bob acts as an AI remediation assistant, allowing developers to ask questions about findings, understand their impact, and generate targeted code fixes based on verified source code.

While Bob explains issues and proposes solutions, ClearStand independently validates the generated code, checks for security risks, and presents a reviewable code diff. Developers can then approve, regenerate, or reject the proposal before ClearStand creates a GitHub pull request.

Our pipeline incorporates approximately 20 security and reliability safeguards, including source-code verification, SHA-256 stale-code checks, credential isolation, responsible vulnerability disclosure, and human approval.

🏗️ How We Built It

We built ClearStand as a multi-agent Responsible AI auditing system that connects codebase analysis, policy intelligence, accessibility testing, and AI-powered remediation into one workflow.

🧠 1. Codebase Understanding & Agent Orchestration

When a developer submits a public GitHub repository, our Codebase Understanding Agent clones and analyzes the code to identify AI functionality, sensitive data, API endpoints, and the application's technology stack.

It combines deterministic code searches with parallel LLM analysis to generate a structured application profile, which is shared with three specialized agents running concurrently:

⚖️ Ethical: Uses RAG and IBM Bob to assess source code against relevant governance requirements.
🔍 Transparent: Uses IBM Mellea to identify gaps between documented AI functionality and its implementation.
🌍 Inclusive: Uses Playwright and IBM Equal Access to test a deployed webpage for accessibility barriers.

The agents return structured findings to a shared reporting engine, which powers our unified React dashboard.

📚 2. Policy Intelligence — ASAGO, Granite & ChromaDB

To power the Ethical Agent, we built a knowledge base of 1,815 AI risk records across 20 policy and governance sources, including NIST, OWASP, COPPA, FERPA, and IBM AI Atlas Nexus.

We used ASAGO Policy Mapper to extract structured risks from policy documents, then IBM Granite embeddings through Ollama and ChromaDB to retrieve requirements relevant to each application's users, functionality, and sensitive data.

IBM Bob examines the retrieved risks against actual source code, while our system verifies cited excerpts and merges overlapping findings to avoid duplicate scoring.

🛡️ 3. Evidence Verification & Responsible AI Scoring

We designed ClearStand to verify AI-generated findings rather than blindly trust them.

Each agent follows a shared validation process:

Codebase Agent: Verifies referenced files exist and were included in the analysis.
Ethical Agent: Matches cited code excerpts against actual repository files.
Transparency Agent: Validates source-code and documentation evidence.
Inclusive Agent: Returns accessibility findings from IBM's automated checker.

We developed four versioned JSON Schema contracts to standardize communication between agents, the backend, and frontend.

Our reporting engine then calculates severity using a deterministic likelihood × impact framework informed by OWASP and NIST. Only confirmed findings affect pillar scores, while incomplete evaluations remain explicitly identified.

This creates a consistent, explainable, and evidence-backed assessment rather than relying on arbitrary LLM judgments.

🔐 4. IBM Bob Remediation & GitHub Integration

Once findings appear in the dashboard, developers can use IBM Bob Shell to ask questions, understand risks, and generate targeted code fixes.

Bob runs in an isolated, read-only environment without direct repository access or GitHub credentials.

Our Node.js backend independently validates proposed changes, verifies source code, and generates reviewable diffs. Developers can then approve, regenerate, or reject each proposal.

Approved changes are submitted through the GitHub REST API as pull requests on new branches.

We implemented approximately 20 security and reliability safeguards, including SHA-256 stale-code detection, credential isolation, safe file-path validation, responsible vulnerability disclosure, and human approval.

The result: An end-to-end workflow from codebase analysis → Responsible AI evaluation → evidence-backed reporting → AI-assisted remediation → human-approved GitHub pull requests.

💻 Technology Stack

Component	Technologies
AI & Agents	IBM Bob Shell, IBM Mellea, IBM Granite
Responsible AI	IBM Equal Access, IBM AI Atlas Nexus, ASAGO Policy Mapper
RAG & Retrieval	ChromaDB, Ollama, Granite Embeddings
Backend	Python, Node.js, GitHub REST API
Frontend	React 19, TypeScript, Vite
Testing & Validation	Playwright, JSON Schema, Ajv, Pydantic
Governance Frameworks	NIST AI RMF, OWASP, COPPA, FERPA

🧩 Challenges We Ran Into

Preventing AI Hallucinations: LLMs occasionally produced incorrect file references, inaccurate line numbers, or unsupported conclusions. We implemented source-code quote verification, evidence-index validation, structured contracts, and retry mechanisms to ensure findings are grounded in actual repository evidence.
Integrating Independently Developed Agents: Our team developed multiple evaluation components in parallel, each producing different types of findings. We introduced four versioned JSON Schema contracts to standardize communication and enable reliable aggregation into one report.
Building Secure AI-Assisted Remediation: Allowing AI-generated code changes to reach a real GitHub repository introduced security, reliability, and accountability challenges. We implemented isolated model execution, credential protection, source validation, stale-code detection, and human-approved pull requests.
Balancing Automation With Human Accountability: We learned that identifying a potential issue doesn't necessarily prove a legal violation or security vulnerability. ClearStand distinguishes confirmed source evidence from unconfirmed findings, uses deterministic scoring, and restricts legal claims.

🏆 Accomplishments We're Proud Of

We're proud to have built an end-to-end, multi-agent Responsible AI auditing platform in under 24 hours, integrating 1,815 risk records across 20 governance sources, four versioned JSON Schema contracts, and approximately 20 security safeguards for AI-powered remediation and human-approved GitHub pull requests.

Beyond the technical execution, we're especially proud of our teamwork and innovation - developing specialized agents in parallel and integrating them into one cohesive, evidence-driven platform designed with transparency, accountability, and human oversight at its core.

Most importantly, we're proud to be solving a meaningful real-world problem: bridging the gap between AI governance and engineering through an accessible, practical, and scalable solution that empowers businesses of all sizes to innovate responsibly.

📚 What We Learned

Our biggest lesson was that Responsible AI tools must embody the principles they evaluate.

LLMs are powerful for interpreting complex requirements and generating solutions, but their outputs require independent verification. We learned that combining AI reasoning with deterministic validation creates a more transparent and accountable workflow.

We also discovered the importance of shared contracts when integrating independently developed agents, particularly under hackathon time constraints.

Most importantly, we learned that Responsible AI becomes meaningful when organizations can move from identifying risks to taking measurable action.

🚀 What's Next for ClearStand

Our long-term vision is to make ClearStand a continuous Responsible AI governance layer throughout the software development lifecycle.

🔁 Automated Fix Verification: Rerun relevant evaluations after remediation pull requests are merged and verify improvements before marking findings resolved.
🔗 CI/CD Integration: Integrate with GitHub Actions and development pipelines to automatically evaluate Responsible AI risks as applications evolve.

- 📊 Enterprise Governance: Introduce continuous monitoring, historical assessments, approval workflows, and collaboration across compliance, engineering, and infrastructure teams.

💙 Our Mission

As AI becomes easier to build, building it responsibly should become easier too.

ClearStand bridges the gap between governance and engineering, empowering businesses to innovate with AI while identifying risks, understanding their impact, and making evidence-backed improvements.