Assessment Pipeline - Technical Details
Step 1: Policy Document Retrieval
// Retrieve P1 (mandatory) policy documents from MCP server
$cuiDocs = McpDocument::where('priority', 'P1')
->whereIn('category', ['cui', 'export-control'])
->where('is_uploaded', true)
->get();
// Load full text of each policy document into context
foreach ($cuiDocs as $doc) {
$policyContext[] = $this->extractDocumentContent($doc);
}
Before the AI sees any submitted document, the system loads the full text of every P1 (Priority 1) policy document into the assessment context.
Step 2: Policy-Grounded Assessment (Pass 1)
// Send document + policy context to Claude for assessment
$response = $this->callEnhancedAssessmentApi(
$context,
$policyContext,
$assessmentType
);
The Claude API receives the user's document along with the full text of all P1 policy documents. Every finding must cite a specific section of a specific policy document.
CUI Categories Explicitly Checked:
EXPTExport Controlled
PROPINProprietary Info
CTICritical Technology
ITARArms Regulations
EARExport Admin Regs
PRVCYPrivacy Info
INTELIntelligence
LAWLaw Enforcement
TAXTax Information
Plus 10 additional categories. Full list of 124+ subcategories loaded from CUI Registry (doc 3.1).
Step 3: Adversarial Verification (Pass 2)
// Second pass: actively try to find misclassifications
if ($this->requiresVerification($response)) {
$response = $this->verifyComplianceFindings(
$context,
$policyContext,
$response
);
}
A second API call asks the AI to review the first assessment adversarially, looking for missed categories or alternate interpretations.
Step 4: Confidence Scoring & Escalation
// Auto-escalate to human review if confidence is insufficient
$requiresHumanReview = $complianceConfidence < 0.7
|| $compliance['status'] === 'flagged'
|| $compliance['cui']['status'] !== 'none';
if ($requiresHumanReview) {
$assessment->compliance_status = 'review_required';
$assessment->requires_human_review = true;
}
If confidence falls below 0.7, the result is automatically flagged for human review. The system will never store a "clear" status without sufficient confidence.
Example Assessment Output
Click to expand JSON example
{
"cui": {
"status": "potential",
"categories_checked": ["EXPT", "PROPIN", "CTI", "PRVCY"],
"findings": [
{
"category": "EXPT",
"trigger_phrase": "specific alloy composition: Ni-22Cr-14W-2Mo",
"reference": "3.1 CUI Registry - Section 4.2.1",
"confidence": 0.87,
"rationale": "Specific material composition may be export controlled"
}
]
},
"compliance_confidence": 0.85,
"requires_human_review": false
}
Reference Document Inventory
P1
Always Loaded (Every Assessment)
| Doc ID |
Name |
Role |
Status |
| 3.1 |
CUI Registry |
Defines all CUI categories (124+) |
Ready |
| 3.2 |
CUI Marking Handbook |
Identification & marking requirements |
Ready |
| 3.3 |
DOE CUI Implementation Guide |
DOE-specific CUI interpretation |
Ready |
| 2.1 |
EAR Summary |
Export Administration Regulations |
Ready |
| 2.2 |
ITAR Overview |
International Traffic in Arms |
Ready |
| 3.6 |
Science & Technology Risk Matrix |
Technical content risk classification |
Ready |
P2
P3
Conditional (When Content Triggers)
| Doc ID |
Name |
Trigger |
| 3.5 |
PII Handling Guidelines |
Names, personal data, or identifiable information |
Living Documents
These reference documents are maintained in the MCP server. When DOE or NETL updates a policy (new CUI categories, revised export control guidance), the updated document is uploaded to the MCP server. The assessment system immediately begins using the updated policy — no code changes, no retraining, no redeployment required.
