README

AI compliance for Laravel apps: markdown-authored policy documents with versioning and draft/publish, consent records, provider registry, disclosure surfaces, and automated compliance checks.

Requires PHP ^8.4.1 || ^8.5 and Laravel ^13.0.

Install

composer require laranail/ai-compliance
php artisan laranail::ai-compliance.install

The npm bindings for React/Vue apps ship in lockstep: npm install @laranail/ai-compliance-react (or -vue, or the framework-agnostic core).

Quick start

The install command publishes the editable policy markdown, migrates, seeds the checklist, and imports every policy as published version 1.0. From there:

<x-ai-compliance::disclosure surface="chat" />   {{-- before any model output --}}
<x-ai-compliance::preferences />                 {{-- the consent panel --}}

use Simtabi\Laranail\AiCompliance\Facades\AiConsent;

if (AiConsent::allows($user, 'smart_summaries')) {
    $response = AiConsent::provider('support-assistant')
        ->forSubject($user)
        ->send('POST', $endpoint, $payload);     // do-not-train flag + inference log
}

php artisan laranail::ai-compliance.audit        # run the compliance checks

See Getting started for the full tour.

Documentation

Full documentation lives at opensource.simtabi.com/documentation/laranail/ai-compliance.

Guides

• Installation — requirements, install, publishing the policy files
• Getting started — the policy pipeline, endpoints, and facade in five minutes
• Configuration — placeholders, locales, routes, shortcodes, tables
• Architecture — how the pipeline works and why it is shaped this way
• Release — versioning, tags, and the release pipeline

Reference

• Policy pipeline — files, frontmatter, shortcodes, placeholders, fallback, cache
• Policy versioning — documents, versions, draft/publish, sync, staleness, the editing api
• Consent — the AiConsent facade, append-only records, guests, re-consent
• Blade components — disclosure, gate, policy, preferences, server-side islands
• Livewire — the interactive preferences panel and re-consent prompt
• JS SDK — @laranail/ai-compliance: boot client, consent api, island hydrator
• React — @laranail/ai-compliance-react bindings
• Vue — @laranail/ai-compliance-vue bindings
• Checklist — the seeded items, classification, evidence, staleness, dashboard
• Checks — the automated checks, scheduling, and alerting
• Activity log — event coverage, hash chain, retention, read auditing
• Filament — the admin plugin: policy editor, registry, consent log, checklist
• Exports and reports — pseudonymized log exports, the auditor report, re-consent

Recipes

• Customizing policies — publish and edit the shipped markdown
• Translating policies — add locales and track re-translation work
• Gating features by consent — allows() and the ai.consent middleware
• Writing custom checks — automate your own checklist items
• Do-not-train enforcement — consent-aware provider calls
• Auditor handover — the evidence bundle in four commands

Stability

Pre-1.0: the API surface described in the docs is what 1.0 will ship; the boot payload carries a contract integer so the JS packages fail loudly on mismatch rather than misreading state. No breaking config or schema changes are planned inside 1.x.

Local development

composer install resolves everything from Packagist; composer test, composer lint, npm install && npx vitest run. See CONTRIBUTING.md.

Sister packages

Part of the laranail family: package-tools (the service provider base this package builds on), console, and db-tools.

Community

Questions and ideas: GitHub Issues.

Contributing & security

See CONTRIBUTING.md. Report vulnerabilities per SECURITY.md.

License

MIT © Simtabi LLC.