Compliance Gating

The harness enforces model allowlists based on compliance requirements. When a compliance mode is set, only models in the corresponding allowlist are permitted.

Python Compliance Modes

Mode	Allowed Models	Use Case
`gdpr`	gpt-4o, gpt-4o-mini, gpt-3.5-turbo	EU data protection
`hipaa`	gpt-4o, gpt-4o-mini	Healthcare data
`pci`	gpt-4o-mini, gpt-3.5-turbo	Payment card data
`strict`	gpt-4o	Maximum restriction

TypeScript Compliance Modes

Mode	Allowed Models	Tool Policy
`regulated`	gpt-4o, Claude Sonnet 4.5	Allowed
`strict`	gpt-4o, gpt-4o-mini, Claude Sonnet 4.5, Claude Haiku 4.5	Denied

Compliance profile names currently differ between the Python and TypeScript harnesses. TypeScript does not currently implement the gdpr, hipaa, or pci profiles. An unknown TypeScript profile does not apply an allowlist.

Usage

import cascadeflow

cascadeflow.init(mode="enforce")

# GDPR compliance — only gpt-4o, gpt-4o-mini, gpt-3.5-turbo allowed
with cascadeflow.run(compliance="gdpr") as session:
    result = await agent.run("Process this EU customer data")

import { init, run } from '@cascadeflow/core';

init({ mode: 'enforce' });

await run({ compliance: 'regulated' }, async () => {
  await agent.run('Process this regulated customer data');
});

Or as agent metadata:

@cascadeflow.agent(compliance="hipaa")
async def medical_agent(query: str):
    return await llm.complete(query)

import { harnessAgent } from '@cascadeflow/core';

const regulatedAgent = harnessAgent({ compliance: 'regulated' })(
  async (query: string) => llm.complete(query),
);

Enforcement Behavior

When a model outside the allowlist is requested:

In observe mode: the trace records action: "switch_model" with the suggested compliant alternative, but execution continues with the original model
In enforce mode: the harness blocks the non-compliant model and either switches to a compliant alternative or stops execution

Combining with Budget

Compliance and budget constraints are independent. Both are checked at every step:

with cascadeflow.run(budget=0.50, compliance="gdpr") as session:
    # Must stay within budget AND use only GDPR-approved models
    result = await agent.run("Analyze EU customer feedback")

await run({ budget: 0.50, compliance: 'regulated' }, async () => {
  await agent.run('Analyze regulated customer feedback');
});

Custom Policies

The harness APIs select built-in profiles by name. They do not currently accept custom model allowlists. For custom requirements, validate the selected model in your integration before sending the request.

approved_models = {"my-approved-deployment"}
if selected_model not in approved_models:
    raise PermissionError("Model is not approved")

Example walkthrough: Compliance Gating | GitHub: enforcement/basic_enforcement.py

Overview

Getting Started

Core Concepts

Harness

Integrations

Guides

Resources

Python Compliance Modes

TypeScript Compliance Modes

Usage

Enforcement Behavior

Combining with Budget

Custom Policies

​Python Compliance Modes

​TypeScript Compliance Modes

​Usage

​Enforcement Behavior

​Combining with Budget

​Custom Policies

Python Compliance Modes

TypeScript Compliance Modes

Usage

Enforcement Behavior

Combining with Budget

Custom Policies