AI compliance for Laravel apps: markdown-authored policy documents with versioning and draft/publish, consent records, provider registry, disclosure surfaces, and automated compliance checks.

Requires PHP ^8.4.1 || ^8.5 and Laravel ^13.0.

composer require laranail/ai-compliance
php artisan laranail::ai-compliance.install

The npm bindings for React/Vue apps ship in lockstep: npm install @laranail/ai-compliance-react (or -vue, or the framework-agnostic core).

The install command publishes the editable policy markdown, migrates, seeds the checklist, and imports every policy as published version 1.0. From there:

<x-ai-compliance::disclosure surface="chat" />   {{-- before any model output --}}
<x-ai-compliance::preferences />                 {{-- the consent panel --}}

use Simtabi\Laranail\AiCompliance\Facades\AiConsent;

if (AiConsent::allows($user, 'smart_summaries')) {
    $response = AiConsent::provider('support-assistant')
        ->forSubject($user)
        ->send('POST', $endpoint, $payload);     // do-not-train flag + inference log
}

php artisan laranail::ai-compliance.audit        # run the compliance checks

See Getting started for the full tour.

Full documentation lives at opensource.simtabi.com/documentation/laranail/ai-compliance.

• Installation — requirements, install, publishing the policy files
• Getting started — the policy pipeline, endpoints, and facade in five minutes
• Configuration — placeholders, locales, routes, shortcodes, tables
• Architecture — how the pipeline works and why it is shaped this way
• Release — versioning, tags, and the release pipeline

• Policy pipeline — files, frontmatter, shortcodes, placeholders, fallback, cache
• Policy versioning — documents, versions, draft/publish, sync, staleness, the editing api
• Consent — the AiConsent facade, append-only records, guests, re-consent
• Blade components — disclosure, gate, policy, preferences, server-side islands
• Livewire — the interactive preferences panel and re-consent prompt
• JS SDK — @laranail/ai-compliance: boot client, consent api, island hydrator
• React — @laranail/ai-compliance-react bindings
• Vue — @laranail/ai-compliance-vue bindings
• Checklist — the seeded items, classification, evidence, staleness, dashboard
• Checks — the automated checks, scheduling, and alerting
• Activity log — event coverage, hash chain, retention, read auditing
• Filament — the admin plugin: policy editor, registry, consent log, checklist
• Exports and reports — pseudonymized log exports, the auditor report, re-consent

• Customizing policies — publish and edit the shipped markdown
• Translating policies — add locales and track re-translation work
• Gating features by consent — allows() and the ai.consent middleware
• Writing custom checks — automate your own checklist items
• Do-not-train enforcement — consent-aware provider calls
• Auditor handover — the evidence bundle in four commands

Pre-1.0: the API surface described in the docs is what 1.0 will ship; the boot payload carries a contract integer so the JS packages fail loudly on mismatch rather than misreading state. No breaking config or schema changes are planned inside 1.x.

composer install resolves everything from Packagist; composer test, composer lint, npm install && npx vitest run. See CONTRIBUTING.md.

Part of the laranail family: package-tools (the service provider base this package builds on), console, and db-tools.

Questions and ideas: GitHub Issues.

See CONTRIBUTING.md. Report vulnerabilities per SECURITY.md.

MIT © Simtabi LLC.