Where do existing commercial controls already do the job?
The agent maps each DoD-unique requirement — Cost Accounting Standards and DFARS contractor business-system criteria — against its nearest commercial equivalent under GAAP and the SOX 404(b) control environment (COSO), then proposes a coverage verdict with citations. You confirm or override each call.
For one supplier, what can DCAA actually rely on?
Given a company's existing control environment, the agent applies the crosswalk to produce a reliance map: where an audited commercial control can substitute for a DoD-unique audit, where reduced-scope testing suffices, and what remains genuinely incremental. Pick a profile to see how the burden changes.
| Requirement | Disposition | Basis for the agent's call | Incremental effort |
|---|
Across the segment, what does reliance actually free up?
The per-supplier dividend, rolled up. This is the figure the reform memo needs: how many duplicative business-system audits reliance removes each year, the combined government-plus-contractor compliance cost that avoids, and the program obligations it sits against. Adjust the burden assumptions — every input is visible and editable.
How the agent works (and its limits)
Two cooperating agents share one knowledge base. The crosswalk agent retrieves the governing text for each DoD-unique requirement (48 CFR 9904.xxx for CAS; the DFARS 252.242 / 252.244 / 252.245 / 252.215 / 252.234 business-system clauses) and the nearest commercial obligation (FASB ASC sections; the COSO 2013 framework underpinning SOX 404(b) ICFR attestation). It emits a structured judgement — covered, partial, or unique — a confidence score, a short rationale, and citations. Every call is agent-proposed; a human reviewer confirms or overrides, and that state is what the summary reflects.
The supplier-reliance agent takes a company's control profile (SOX 404(b) status, external audit firm, existing government-accounting infrastructure) and derives, per requirement, whether DCAA can rely on the commercial control, needs reduced-scope targeted testing, or must require an incremental DoD-specific control. A requirement's disposition can never be stronger than its crosswalk verdict — a unique requirement stays incremental for everyone.
Architecture. This build runs against a FastAPI backend that puts the reasoning model behind one swappable interface (Anthropic Claude via Bedrock in cloud/GovCloud; an open-weight model on vLLM/Ollama for air-gapped enclaves; a deterministic mock for offline demos) and retrieval behind another (pgvector on Postgres in production; in-memory lexical for the demo). The frontend is dependency-free static files and does not know which is live.
Limits. Coverage classifications are legal and accounting judgements: the agent accelerates the analysis, it does not replace CPA / counsel review or the CASB rulemaking and public-comment process the memo points to. Nothing here is a determination of allowability, adequacy, or compliance. The requirement set and rationales in this build are illustrative and abbreviated for demonstration.