-
-
ATLAS Output
-
TiTle
-
Action center Human Review
-
Architecture
-
Automatic Jobs running in orchestrator
-
Maestro Flow
-
Successful Maestro Flow
Inspiration
Federal Authority to Operate (ATO) reviews are slow, manual, and exception-heavy. Security findings must be triaged, mapped to NIST 800-53 controls, evidenced, and adjudicated — today largely by hand, by scarce and expensive security staff, with the audit trail assembled manually at the end.
What it does
FedClear is an agentic case-management solution on UiPath Maestro Case. An AI agent triages incoming ATO security findings, maps each to the relevant NIST 800-53 control(s), assembles tamper-evident evidence packages, and routes ambiguous or high-risk findings to a human reviewer for sign-off. Clear-cut, low-risk findings are auto-cleared and bypass human review entirely; high-severity, ambiguous, low-confidence, or under-evidenced findings are escalated to a human in UiPath Action Center who sees the agent's reasoning and signs off. Every adjudication produces a hash-chained, tamper-evident NIST audit record automatically.
How we built it
Built solo on the UiPath Platform. Findings are stored in a Data Fabric ATOFinding entity. A Maestro case orchestrates five stages — Intake, Triage, Evidence, Review, and Sign-off — triggered automatically on record creation. Inside the Triage stage, an Agentic Process (BPMN) runs a UiPath Agent Builder agent (GPT-5.4) that applies five priority-ordered routing rules and writes its decision back to Data Fabric. The four human stages are handled through UiPath Action Center. The evidence layer is a port of my separately published ATLAS.Compliance.Logging library, reproduced as an agent-callable MCP tool and registered in UiPath AgentHub, producing structured NIST audit records with SHA-256 hash chaining, PII redaction, an evidence-packet manifest, and a retention policy. Both the auto-clear and escalation case paths were verified running end-to-end on UiPath Cloud.
Challenges we ran into
Surfacing the agent's decision into the human review forms was non-trivial — the case trigger snapshot is frozen at record-creation time, before the agent runs, so the decision had to be re-read inside the BPMN and surfaced through Case variables. Getting a conditionally-skipped Review stage to complete cleanly on the auto-clear path required fixing the Case-complete rule rather than the per-stage toggle. And faithfully porting the ATLAS hash-chaining contract so the chain is independently verifiable across records demanded careful, line-for-line fidelity to the original library's logic.
Accomplishments that we're proud of
A complete, working agentic compliance pipeline where the agent handles the routine autonomously and a human owns every risky decision — with genuinely tamper-evident, auditor-ready evidence generated automatically. Both decision paths run end-to-end on UiPath Cloud, the routing logic was validated across all five decision outcomes, and the hash chain is independently verifiable.
What we learned
The agent's real value is interpreting unstructured finding text and routing it — not replacing human judgment on compliance. Deterministic routing rules make excellent, auditable safety guardrails, while the language-level work (reading findings, mapping to controls) is where an LLM genuinely earns its place. We also learned how much of a production-grade compliance system is about traceability and evidence integrity, not just classification — which is why the tamper-evident evidence layer matters as much as the triage agent.
What's next for FedClear — Agentic ATO Compliance Adjudication
Have the agent derive NIST controls and severity directly from raw finding text — using upstream-provided values only as a corroborating hint — via a hybrid deterministic-first, LLM-fallback resolver. Add cross-finding correlation, risk-weighted confidence thresholds, and a reviewer-feedback loop. Connect to live continuous-monitoring feeds and host the evidence logger for fully autonomous, live MCP operation.
Coding agent usage
Built with the assistance of Claude Code via UiPath for Coding Agents. Claude Code (using the UiPath MCP-servers and RPA skills) read all six workflows of my published ATLAS.Compliance.Logging library and reproduced their exact contract as a Python MCP tool, with runtime-verified SHA-256 hash chaining proven across records. Claude Code was also used to build and validate the triage agent's routing logic against a synthetic dataset covering all five decision paths. Coding-agent usage is documented with session write-ups and an evidence index in the public repository (CODING_AGENTS.md and docs/coding-agent/).
Note on data and scope
All data is synthetic/mock. This submission is newly created for AgentHack and builds on top of the separately published open-source ATLAS.Compliance.Logging library; the agentic adjudication layer is new work.
Log in or sign up for Devpost to join the conversation.