Compliance review

The playbook's own composability example, implemented literally: "a compliance skill might call a document analysis skill, which in turn uses a specialized extraction skill."

Workflow

1. Apply document-analysis first. Don't re-parse the document from scratch — get its type, structure, and section summaries from that skill.
2. Apply extraction for the specific fields the policy cares about. Pull only what's needed to check compliance (e.g. dates, amounts, required-clause presence) as structured fields, with source pointers.
3. Check each policy requirement against the extracted fields, one at a time. Don't eyeball the whole document against the whole policy at once — go requirement by requirement, citing which extracted field or document section satisfies (or fails) each one.
4. Classify each finding. Compliant / non-compliant / cannot-determine (missing information). "Cannot determine" is a valid, honest outcome — don't force a compliant/non-compliant call without evidence.
5. Apply escalation criteria explicitly. See references/escalation-criteria.md for the standard triggers (this repo's synthetic example). Any match escalates regardless of how minor the rest of the review looks.
6. Never approve by default. If review is incomplete or blocked, the output is "needs human review," not silence or an assumed pass.

Composition

Calls document-analysis then extraction as its first two steps, per the workflow above. Can be paired with legal-contract-review or financial-analysis when the compliance check is domain-specific.

Quality bar

• Every policy requirement is checked individually and cited, not reviewed in aggregate.
• Every finding is classified compliant / non-compliant / cannot-determine — no silent skips.
• Escalation criteria are checked explicitly, every time, not just when something "looks bad."
• The review never defaults to "compliant" in the absence of evidence.