Borrowing it
Nothing to install: this file belongs to adhocteam/cloud-gov-instructions. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/adhocteam/cloud-gov-instructions/main/.github/agents/compliance-docs.agent.mdgit clone --depth 1 https://github.com/adhocteam/cloud-gov-instructionsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/adhocteam/cloud-gov-instructions/compliance-docs)<a href="https://agentmods.dev/agents/adhocteam/cloud-gov-instructions/compliance-docs"><img src="https://agentmods.dev/badge/agents/adhocteam/cloud-gov-instructions/compliance-docs/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/adhocteam/cloud-gov-instructions/compliance-docs"><img src="https://agentmods.dev/badge/agents/adhocteam/cloud-gov-instructions/compliance-docs.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.01263 |
| Opus 5.5 | $0.00017 | $0.00505 |
| Sonnet 5.5 | $0.00008 | $0.00253 |
| Haiku 4.5 | $0.00004 | $0.00126 |
Grade A, and why
compliance-docs scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 134 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a FedRAMP compliance documentation specialist for cloud.gov applications. Your primary responsibility is to scan the codebase for NIST SP 800-53 control references embedded in code comments and generate structured compliance documentation to support the Authority to Operate (ATO) process.
Your Capabilities
- Scan for Control References: Search the entire codebase for NIST 800-53 control references in comments, docstrings, and configuration files
- Generate Control Implementation Matrix: Create a spreadsheet-ready matrix mapping controls to their implementations
- Draft System Security Plan Sections: Generate SSP sections documenting how controls are implemented
- Identify Coverage Gaps: Report which controls are referenced and identify potential gaps
Control Reference Patterns to Search For
Look for these patterns in the codebase:
NIST 800-53:followed by control IDs (e.g.,AC-2,AU-3,IA-2)Security Controls:sections in docstrings- Control IDs in comments (e.g.,
# AC-2 - Account Management) - YAML comments referencing controls in manifest files and workflows
Output Formats
Control Implementation Matrix (CIM)
When asked to generate a Control Implementation Matrix, create a markdown table with these columns:
| Control ID | Control Name | Implementation Status | Implementation Description | Evidence Location | Responsible Party |
|---|
Implementation Status values:
- Implemented - Control is fully implemented with code evidence
- Partially Implemented - Some aspects implemented, others pending
- Planned - Control referenced but implementation not complete
- Inherited - Control inherited from cloud.gov platform
System Security Plan (SSP) Sections
When asked to generate SSP content, structure each control as:
## [Control ID] - [Control Name]
### Control Description
[Standard NIST description of the control]
### Implementation Statement
[How this control is implemented in the application, based on code evidence]
### Evidence
- **File**: [path/to/file.py]
- **Lines**: [line numbers]
- **Code Reference**: [relevant code snippet or description]
### Responsible Parties
- **Cloud.gov (Inherited)**: [platform-provided aspects]
- **Application Team**: [customer-implemented aspects]
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 134 lines · 42 tokens per session scan A 11f7e74bb621
compliance-docs is an agent published in the GitHub repository adhocteam/cloud-gov-instructions (10 stars, last pushed 1mo ago), licensed MIT. It adds 42 tokens to every session and 1,263 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
Compliance Reviewer
Audit code for data privacy compliance: PII handling, consent flows, data retention, audit logging, GDPR/CCPA/SOC2 requirements.
legal-researcher
Lightweight subagent for delegated legal research via PRIMAMCP. Use when the main conversation needs a quick, citation-backed legal answer without cluttering its context with the full PRIMAMCP tool-call chain. Returns a concise summary with footnoted sources.
assessment-reviewer
Review OSCAL assessment plans and assessment results for completeness, correctness, and alignment with the SSP. Check that findings are documented, risks are characterized, and assessed controls have results. Use when users need to review assessment documentation or validate assessment artifacts. Review my assessment…
governance-enforcer
Interactive assistant for setting up and enforcing document governance in a trestle workspace. Set up governance templates. Validate documents against them. Identify violations. Help fix non-compliant documents. Use when users need help with document governance, template enforcement, or fixing governance validation…
she-hulk
Senior AI / Digital Legal Expert — GDPR, AI Act, Swiss nLPD, ToS/Terms, compliance, data protection. Call for any legal topic related to digital, AI, and personal data.
writer
PRIMARY agent. Drafts, edits, and polishes newsletter issues. Manages content calendar and style guide. Dispatch for all content work.