Norma - Compliance and Procedure Compiler

Turn policies and procedures into traceable, human-reviewed assessments. From complex policy documents to auditable decisions in minutes

Comment

Inspiration

Policies, regulations and administrative procedures are usually written for people to read, not for software to execute.

Turning these documents into an operational process is a slow and error-prone process. Someone must read each page to identify the requirements, exceptions, thresholds, deadlines, and necessary evidence. After that, the next step is to translate them into questions and decision rules, implement the workflow, and then verify that each decision continues to match the original source. In short: a manual, labor-intensive, and error-prone task.

We wanted to explore a different idea:

What if an AI system could compile a regulation into a reviewable and executable decision workflow?

That idea became Norma.

We built Norma to shorten that path without handing final decisions to a language model. Norma is not a chatbot that simply answers questions about a document. It is a compliance and procedure compiler designed around one principle:

AI proposes. Humans approve. Deterministic software evaluates.

What it does

Norma is a policy and procedure compiler.

Each author has a workspace, and within that workspace, they can create projects. In a project, the author can upload a source PDF and use GPT-5.6 to interpret the document as a structured policy proposal. Norma identifies the variables, questions, rules, open issues, and source references needed to evaluate a case.

The generated proposal is kept separate from executable policy. It must first enter a human-review workflow, where the author can inspect the proposed content and its supporting evidence.

Once a policy has been reviewed, its questionnaire can be used to evaluate a case through a deterministic rule engine. The same approved policy version and the same answers always produce the same logical result.

The result explains:

  • the overall outcome
  • which requirements passed or failed
  • which information is missing
  • which situations need manual review
  • and which source passages support each finding

Norma also supports structured JSON and readable Markdown exports.

The deployed demonstration uses a fictional student-support scholarship policy. It includes eligibility requirements, income thresholds, deadlines, supporting documents, incomplete cases and manual-review conditions.

How we built it

Norma is a full-stack TypeScript application built with Next.js, React and Tailwind CSS.

The application is divided into clearly separated responsibilities:

  1. Document ingestion validates and stores uploaded PDFs, extracts page text and creates stable source blocks.
  2. GPT-5.6 interpretation uses the OpenAI Responses API and Structured Outputs to propose a structured policy specification.
  3. Source verification checks whether proposed citations can be located in the uploaded document.
  4. Human review keeps AI-generated proposals separate from approved executable policy.
  5. Deterministic evaluation uses a closed JSON rule AST and three-state logic: true, false and unknown.
  6. Traceability and exports connect every finding to its policy version and supporting source.

GPT-5.6 is used for document interpretation and structured extraction. It does not make the final runtime decision.

The deterministic rule engine is isolated from OpenAI, the database and the web framework. This makes it testable, reproducible and suitable for auditable workflows.

The application also includes Google authentication for the private author workspace, workspace-level data isolation, safe PDF handling, configurable AI usage controls, health endpoints and a reproducible Docker deployment.

How we used Codex

Norma was built from the ground up with Codex.

We used Codex throughout the complete lifecycle:

  • refining the product and domain model
  • defining the architecture and implementation plan
  • creating the Next.js and TypeScript application
  • designing the PolicySpec and closed rule AST
  • implementing the deterministic three-state rule engine
  • integrating PDF ingestion and source traceability
  • integrating the OpenAI Responses API and Structured Outputs
  • implementing authentication, workspace isolation and deployment controls
  • generating and maintaining automated tests
  • reviewing changes and correcting regressions
  • documenting architectural decisions and deployment procedures

Codex accelerated implementation, testing, refactoring and documentation. The team retained responsibility for the product concept, functional scope, architecture, security boundaries and final design decisions.

Challenges we faced

Separating interpretation from decision-making

The most important challenge was preventing AI-generated text from becoming executable logic without control.

We solved this by creating explicit boundaries:

  • GPT-5.6 proposes a structured interpretation.
  • The proposal is validated and checked against source references.
  • A human remains responsible for reviewing and approving it.
  • Only a closed deterministic rule engine evaluates cases.

Preserving source traceability

A plausible rule is not enough for a regulated workflow. Every proposed rule must be linked to evidence in the original document.

Norma stores page-level text blocks and validates the citations returned by the model. Missing, ambiguous or unverified references are surfaced as review issues instead of being silently accepted.

Building a real product within the event

We wanted more than a prompt demonstration. Norma includes a complete interface, document ingestion, private author workspaces, a generated questionnaire, deterministic results, source traceability, exports, automated tests and a publicly deployed demo.

Managing that scope required strict prioritization and a vertical implementation strategy.

What we learned

We learned that generative AI is especially valuable as a compiler front end: it can translate human-oriented documents into structured candidate models, while conventional software retains control over validation, execution and auditability.

We also learned that the most important part of an AI system for regulated processes is not only model quality. The product must make uncertainty, provenance, approval status and deterministic behavior visible to the user.

Finally, working extensively with Codex showed us that an agent can contribute across the entire software lifecycle when it is given clear specifications, architectural constraints, acceptance criteria and continuous verification.

It’s truly incredible what we’ve been able to accomplish in just one week. It wouldn’t have been possible without the help of an agent like Codex.

What's next

The next steps for Norma are:

  • Compare policy versions and highlight the affected rules and questions
  • Support multiple source documents
  • Incorporate OCR capabilities for scanned PDF files
  • Add enterprise roles, audit controls, and external integrations
  • Expand its use beyond rules and regulations to include RFPs, public tenders, and similar documents

Built With

Share this project:

Updates