Automate Obligation Review Without Turning Unknown into Compliant

Integrate a review process, not a green badge

A release pipeline receives an assessment that has completed processing. That does not establish that all relevant rules were considered, every applicability fact was known, or the organization has implemented the required work. Keep those dimensions separate in your automation.

Use the shared MCP integration guide for authentication, request/response examples, and the supported tool sequence. Both developer sites describe the same Carver service; this page focuses on downstream decision handling.

Separate the gates

Gate	Data to inspect	Stop or escalate when
Progress	state and mapping_status from get_ai_agent	Waiting, assessing, incomplete, or preparation failure needs attention
Coverage	Returned coverage and any trimmed counts	A partial or capped result cannot support the claimed scope
Applicability	Conditions, citations, and missing facts	Material facts remain unresolved
Decision	Recorded answer, note, and history	A suggestion has no authorized decision behind it
Release	Your organization’s approval policy	Required evidence or confirmation is missing

These gates are a proposed client-side policy, not a server guarantee or a legal standard.

Read results completely

Use returned agent and act IDs. list_act_obligations is paginated: consume returned and has_more, and preserve plan-related limits. Finishing a page sequence means reading the available result set; it does not establish an exhaustive legal corpus.

The integration guide documents ready, partial, preparation, and waiting states. A pipeline should surface these as states, not collapse them into a single pass/fail label.

Treat writes differently from reads

Do not automatically turn an unresolved applicability result into an answer_obligation call with a favorable compliance state. Obtain the required human confirmation before recording a decision on someone’s behalf. Preserve the reason and evidence so get_agent_history remains useful.

Avoid repeating a create or decision write merely because a transport response was lost; inspect the current record first. No write-idempotency guarantee is asserted here.

Keep an auditable hand-off

Record the profile version, returned source set, coverage limits, unresolved questions, proposed owner, and decision history with the release review. The NIST Govern playbook is useful governance background; it does not certify this pipeline or supply a universal approval rule.

Carver provides assessment support. Your automation must preserve its uncertainties rather than invent a clearance that the service did not issue.