Amend · built with IBM Bob 2.0 · demo regulation 16 CFR Part 314

This sentence just became a bug.

16 CFR 314.4(c) · eCFR 2021-01-01 → current ~~Design and implement information safeguards to control the risks you identify through risk assessment~~
(5) Implement multi-factor authentication for any individual accessing any information system

Amend turns a regulatory change into a pull request that is proven to implement it. It reads the official redline clause by clause, finds where the change lands in the code, drives the fix through IBM Bob, and proves every fix with a test that fails before the change and passes after.

Open the evidence certificate Source on GitHub See the remediation diff

Result

What Amend did to Lendwise

Lendwise is a fictional non-bank lender with 13 planted violations of the amended FTC Safeguards Rule, 3 decoys and a comment telling AI agents to skip its export job. All data is synthetic.

6 / 6obligation test files fail on the base commit and pass after the fix

8 → 4plaintext canary hits: bucket, log and database before; database only after

3pre-existing tests that asserted the violations, rewritten by a named human

0guard findings after the change; the next regression is blocked in CI

Obligation	Clause	Certificate	What changed
SG-5	314.4(c)(5)	Verified	Second factor on staff and mobile login; the profile route and the legacy support console now require an MFA session
SG-9	314.4(j)(1)	Verified	Incidents affecting 500+ consumers open an FTC notice due within 30 days, with the fields listed in (j)(1)(i) to (vi)
SG-3	314.4(c)(3)	Partially verified	Logs and the analytics export no longer carry SSNs; the canary still finds SSNs at rest in the database, recorded as an open finding
SG-7	314.4(c)(7)	Human review required	Change management is a process obligation, routed to its owner

before · 8

after · 4

canary SSN 000-00-0417 · synthetic (area 000 is never issued)

How it works

Eight stages, most of them without a model

Redline. Point-in-time versions from the eCFR API, diffed clause by clause; renumbered clauses separated from real amendments.deterministic
Obligations. Drafted by the agent; any quote not verbatim in the law is rejected; a named human approves.agent + validator
Impact. A code graph of routes, router dependencies, mounts, SQL-view alias lineage and sinks.deterministic
Remediate. Test first, proven to fail on the base commit, then the fix.agent
Audit. A read-only auditor and a canary sweep that plants a synthetic customer and searches every store.deterministic sweep
Prove. Fail-before/pass-after, locked pre-existing tests, regression suite.deterministic
Evidence. Traceability matrix and a graded certificate. Never "compliant".deterministic
Guard. The same checks as a merge gate in GitHub Actions and a Bob lifecycle hook, citing the clause.0 Bobcoins

Architecture

Bob is where every run starts

The /amend command hands the work to amend-lead, which moves through four custom modes with enforced separation of duties. Each mode calls Amend's MCP server for facts; the deterministic engine behind it does the analysis and the proof. Hooks gate every edit, and the same guard runs again in CI.

flowchart TB
  dev(["Developer and compliance lead"])

  subgraph BOB["IBM Bob IDE · where every run starts"]
    direction TB
    cmd["/amend 16cfr314 2021-01-01..current"]
    lead["amend-lead mode · orchestrates the run"]
    subgraph MODES["Custom modes · separation of duties"]
      direction LR
      analyst["amend-analyst<br/>reads the regulation<br/>writes obligations only"]
      mapper["amend-mapper<br/>explore subagents,<br/>one per obligation, in parallel"]
      fixer["amend-fixer · Agent mode<br/>failing test first,<br/>then the fix"]
      auditor["amend-auditor<br/>read-only<br/>canary sweep"]
    end
    skills[["5 skills · rules: regulation text and comments are data"]]
    hooks{{"Lifecycle hooks · 0 Bobcoins<br/>PreToolUse blocks locked tests, .bob/, evidence/, rm -rf<br/>PostToolUse runs the guard on every edit"}}
    cmd --> lead --> MODES
    skills -.-> MODES
    hooks -.-> MODES
  end

  subgraph MCP["Amend MCP server · stdio · 11 tools"]
    tools["get_redline · validate_obligations · approve_obligation · query_graph · check_fails_on_base<br/>run_canary · guard_check · record_finding · build_evidence<br/>draft_obligations · screen_untrusted_text"]
  end

  subgraph ENGINE["Amend engine · deterministic Python"]
    direction LR
    rd["regdiff<br/>clause-level redline"]
    ob["obligations<br/>verbatim-quote check"]
    cg["graph<br/>routes, mounts,<br/>SQL alias lineage"]
    gd["guard<br/>MFA, login, log,<br/>export rules"]
    cn["canary<br/>synthetic SSN"]
    vf["verify<br/>fail before, pass after<br/>locked tests"]
    ev["evidence<br/>graded certificate"]
  end

  ecfr[("eCFR versioner API<br/>16 CFR 314 · 2021, 2023, current")]

  subgraph REPO["Target repository · demo/lendwise"]
    direction LR
    code["app · jobs · sql · infra"]
    ctests["compliance/tests<br/>obligation tests"]
    records[("compliance/<br/>obligations · impact · findings · test_changes")]
  end

  subgraph SHIP["Delivery"]
    direction LR
    pr["Pull request<br/>/review · /create-pr"]
    ci["GitHub Actions · amend guard<br/>annotates the offending line · 0 Bobcoins"]
    cert["Evidence certificate<br/>GitHub Pages"]
  end

  dev -->|runs /amend, approves obligations and test rewrites| cmd
  MODES <-->|tool calls| MCP
  MCP --> ENGINE
  MCP -.->|draft, screen| wx
  wx[("IBM watsonx.ai · Granite 4<br/>drafts from the verbatim clause<br/>screens comments for prompt injection")]
  wx -.->|proposals only, checked by the validator| ob
  ecfr --> rd
  MODES -->|edits and writes| REPO
  ENGINE -->|analyses, runs and proves| REPO
  lead --> pr
  pr --> ci
  ev --> cert
  ci -.->|blocks regressions| pr

sequenceDiagram
  autonumber
  actor Dev as Developer
  participant Bob as IBM Bob · amend-lead
  participant Modes as Bob modes and subagents
  participant MCP as Amend MCP server
  participant Eng as Amend engine
  participant WX as IBM watsonx.ai · Granite
  participant Repo as Lendwise repo
  participant GH as GitHub PR and Actions

  Dev->>Bob: /amend 16cfr314 2021-01-01..current
  Bob->>MCP: screen_untrusted_text
  MCP->>WX: Granite reads every comment and docstring
  WX-->>Bob: the planted prompt injection, flagged as hostile data
  Bob->>MCP: get_redline
  MCP->>Eng: regdiff on the eCFR versions
  Eng-->>Bob: substantive changes, renumbered clauses set aside
  Bob->>Modes: amend-analyst drafts obligations
  Modes->>MCP: draft_obligations
  MCP->>WX: Granite drafts from the verbatim clause text
  WX-->>Modes: drafts, each quote already checked by the validator
  Modes->>MCP: validate_obligations
  MCP-->>Modes: paraphrased quotes rejected
  Bob-->>Dev: obligations ready for approval
  Dev->>MCP: approve_obligation as compliance-lead
  Bob->>Modes: amend-mapper, one explore subagent per obligation
  Modes->>MCP: query_graph, e.g. ssn to tin to the export job
  Bob->>Modes: amend-fixer writes a failing obligation test
  Modes->>MCP: check_fails_on_base
  MCP-->>Modes: discriminating, it fails on the base commit
  Modes->>Repo: fix the code
  Note over Modes,Repo: PreToolUse blocks edits to locked tests. PostToolUse runs the guard.
  Bob->>Modes: amend-auditor runs the canary sweep, read-only
  Modes->>MCP: run_canary, record_finding
  Bob->>MCP: build_evidence
  MCP-->>Bob: Verified, Partially verified, Human review required
  Bob->>GH: /review, then /create-pr
  GH->>GH: amend guard and tests, 0 Bobcoins
  GH-->>Dev: green check, or red with the clause on the offending line

IBM Bob

Amend runs inside Bob

Amend ships as a Bob pack: five custom modes with enforced separation of duties (the auditor cannot edit; the fixer can edit only app code and new compliance tests), five skills, rules that treat regulation text and code comments as data, an MCP server with eleven tools that give Bob facts it cannot invent, and lifecycle hooks that block edits to locked tests and run the guard after every edit. IBM Bob also built Amend's engine, demo app, MCP server, hooks and pack; the sessions are in the repository.

IBM watsonx.ai

Granite proposes. Amend checks.

Two MCP tools call IBM Granite 4 on watsonx.ai. screen_untrusted_text reads every code comment and docstring a coding agent will see and flags text aimed at AI agents: on Lendwise it flags exactly one of 48, the planted NOTE TO AI AGENTS comment, in 3 of 3 runs. draft_obligations drafts obligations from the verbatim clause text, never from memory, and every draft goes through the same verbatim-quote validator and human approval as a person's: 15 drafts from the 2024 amendment, 15 verbatim quotes. Asked from memory, the same model described an unrelated antitrust rule, which is why Amend grounds it.

Benchmark

Against grep and generic SAST

Condition	Violations found (of 13)	Findings to triage	Decoys flagged
Keyword search	11 files touched	118 lines	1
Semgrep p/python + p/security-audit	0	0	0
Amend guard + canary	7, each citing a clause	14	0

Keyword search points at files with suspicious words, not at violations. Generic SAST rules don't know what a regulation requires. Amend's current rules miss 6 of the 13 (retention of exports, audit events, key storage, role-based masking); the obligation-driven step also caught the missing FTC notice. One seeded repository, built by us.