Redline

Inspiration

Compliance teams at enterprise software companies are stuck in a relay race they can't win. A law changes somewhere in the world, GDPR gets amended, CCPA gets a new clause, and by the time it's noticed, interpreted by a lawyer, turned into a ticket, and finally fixed by an engineer, weeks have passed. Every handoff in that chain adds delay, and every day of delay is exposure to regulatory fines. We wanted to build something that closes that gap, not by flagging the problem for a human to solve, but by doing the translation work itself and handing over a reviewed, ready-to-merge fix.

What it does

Redline is an autonomous agent that continuously monitors regulatory sources such as government portals, RSS feeds, and legal-intelligence APIs for changes relevant to a company's jurisdictions and data types. When it finds one, it extracts the concrete compliance requirement, semantically searches the company's codebase to locate affected logic, and drafts a code patch annotated with the legal clause behind it. That patch never merges on its own. It's opened as a draft pull request, routed to an engineer for technical review and a legal reviewer for interpretive accuracy.

How we built it

We designed Redline as a seven-stage agentic loop rather than a fixed script:

scan → filter for relevance → extract requirements → locate affected code → draft patch → open PR → log for audit.

The agent dynamically selects among five external tools: a regulatory source monitor, an OCR/document parser, a semantic code-search/RAG layer, a Confluence/Notion fallback for tracing data ownership, and the GitHub API for opening draft PRs. Every tool choice was made against a rejected alternative: official feeds over scraping, OCR over plain-text extraction, semantic search over keyword matching, and draft PRs over autonomous commits, since PRs plug into review tooling engineers already trust.

Challenges we ran into

The hardest design problem wasn't the happy path. It was deciding what the agent should do when it isn't sure. Ambiguous requirements, like a retention period that isn't clearly defined in the legal text, can't be resolved by guesswork, so we built in an escalation path where the agent surfaces the interpretations it considered, rather than picking one silently. We also had to think carefully about where human oversight adds the most value without becoming a bottleneck, landing on a single high-leverage checkpoint after the agent's interpretive work but before anything reaches production.

What we learned

Building an agent that's trusted with legal interpretation is as much a trust-design problem as it is a technical one. The architecture matters less than the moments when the agent knows to stop and ask.

What's next for Redline

Phase 2 is building out the reasoning core and wiring up the five tools end-to-end against a real codebase and live regulatory feeds, starting with GDPR and CCPA as our proof-of-concept jurisdictions.