Skip to content

Carver Regulatory Context Graph

External regulatory context for AI agents — at dev time and at run time.

Carver RCG overview: the problem, how it works, and the before/after

The Problem

AI agents are built with rich internal context: code, schemas, tickets, docs, traces. They know your system well. But they don't know what they're allowed to do.

Regulators — SEC, RBI, MAS, FCA, GDPR, HIPAA, CFPB, and hundreds more — define the legal boundaries that govern every AI action and output. Today, compliance with those boundaries is enforced post-effect: audits, incident reviews, fines. By the time a violation is caught, the product has already shipped it.

RCG moves compliance to before the incident. It gives your AI agents the external regulatory context they need — at the moment they're writing code, and at the moment they're serving a user.

What RCG Is

The Regulatory Context Graph is an ever-growing knowledge graph built from 1,000+ regulators across 100+ geographies, scanned daily by Carver. For a given feature, RCG identifies which regulators apply, fetches the relevant guidance and enforcement signals, and synthesizes it into a single file: RCG.md — a structured set of dos and don'ts your agents can consume directly.

The RCG concept: internal context graph vs regulatory context graph, and the three core ideas

There are three core ideas:

  1. Context graphs today are inward-facing. Code, schemas, tickets, docs — the agent's context is everything inside the org. That makes agents good at your data, but blind to external law.

  2. External forces govern agent behavior. Regulators define what an agent is allowed to do. Today that's enforced post-effect — audits, reviews, fines. RCG brings it pre-effect.

  3. RCG is the external subgraph. It delivers the regulatory slice that governs a specific feature, and plugs it into two places: the coding agent's prompt at dev time, and the deployed agent's guardrail at run time.

Two Modes

Mode When What happens
Dev time While building a feature RCG.md is injected into the coding agent's prompt. Every prompt carries regulatory context — code is compliant by construction.
Run time While serving users RCG.md is loaded into the deployed agent's guardrail/policy layer. Every action and output is checked against the dos/don'ts before it reaches the user.

Next Steps