-
-
GPT-5.6 Compliance Copilot analyzing a seeded national-platform exception in the local judge demo.
Inspiration
What it does
How we built it
Challenges we ran into
Accomplishments that we're proud of
What we learned
What's next for HazWaste Five-Now SaaS
Inspiration
Hazardous-waste operations connect physical weighing, QR labels, one-package-one-code inventory, enterprise approvals, and a national reporting platform. A network or business-code failure can look harmless while creating a serious ledger mismatch. Operators need fast guidance, but the most sensitive actions cannot be delegated to an opaque model. We built a Copilot that helps people reason through failures while keeping the regulator response, approval chain, and business state authoritative.
What it does
The underlying SaaS platform covers the “five immediate” workflow: record generation, packaging, weighing, QR labeling, and warehousing. It also includes Android field operations, national-platform adapters, outbox retries, one-package-one-code inventory, RBAC, MFA-ready Console sessions, audit logs, and production-readiness gates.
During OpenAI Build Week we added a GPT-5.6 Compliance Copilot to the exception center. An operator selects an unresolved national-platform exception and explicitly confirms the outbound data boundary. The backend creates a sanitized incident summary, calls the OpenAI Responses API, and requests strict structured output. The UI presents the risk level, recommended action, rationale, verification checklist, prohibited actions, and whether approval is required.
The Copilot cannot retry, close, approve, or mutate anything. It cannot claim a regulator response. High-risk work remains in the existing approval workflow.
How we built it
- Frontend: Vue 3, TypeScript, Vite, Element Plus, and ECharts.
- Backend: Java 21, Spring Boot 3.5, Spring Data JPA, Flyway, MySQL/H2, Redis, RabbitMQ, and MinIO/S3.
- Field client: Android/Kotlin.
- AI: OpenAI Responses API with
gpt-5.6, medium reasoning effort,store: false, and strict JSON Schema output. - Safety: allowlisted context, hashed case fingerprint, length limits, explicit consent, read-only endpoint, RBAC permission, audit event, and production startup guards.
Codex accelerated repository analysis, implementation, testing, documentation, and the review of the privacy boundary. We preserved the pre-existing compliance invariants instead of adding a generic chatbot.
Build Week extension
The platform predates the event. The qualifying extension was implemented on 2026-07-17 and consists of the GPT-5.6 client, sanitized domain adapter, API endpoint, RBAC and production guards, Console experience, deterministic judge demo, audit trail, test suite, and English documentation. Timestamped commits and tests make the new work distinguishable from the earlier codebase.
Challenges we ran into
The hardest part was deciding what the model must never see or do. Raw exception numbers, enterprise IDs, business identifiers, payloads, credentials, and evidence files are useful for debugging but inappropriate for an external reasoning call. We designed the context as an allowlist rather than attempting to redact an arbitrary payload. We also had to preserve nuanced rules: HTTP 200 alone is not success, duplicate submissions should trigger ledger recovery, and high-risk remediation requires human approval.
Accomplishments that we're proud of
- The AI feature is useful without becoming a second source of truth.
- Judges can exercise the complete experience without a secret through a visibly labeled deterministic demo mode.
- A real GPT-5.6 mode can be enabled with environment variables only; no key is committed.
- The model output is machine-validated before it reaches the operator.
- Sanitization and non-mutation are enforced and tested on the server, not merely promised in UI copy.
What we learned
The best AI integration for regulated operations is often narrow and asymmetric: the model may explain and recommend, while trusted state machines, regulator receipts, and humans retain authority. Structured output and explicit data minimization made the feature easier to test, audit, and present than a free-form chat interface.
What's next
Next steps include multilingual operator guidance, retrieval over approved internal SOPs, offline-safe incident capture, evaluation datasets for common national error codes, model-response quality scoring, and a signed approval bundle that links the recommendation to the final human decision without exposing sensitive payloads.
Log in or sign up for Devpost to join the conversation.