Compiling Regulatory Statutes into Gateway Code: An Engineering Mapping of NIST AI RMF, the EU AI Act, and China's Generative AI Measures

The Gap Between Legal Policy Binders and Runtime Enforcement

Imagine an institution deploying an internal large language model assistant across customer service, legal review, and back-office operations. Legal and compliance teams review applicable governance texts and write a policy manual requiring personal data protection, role-based access boundaries, and documented human review before external actions occur. When engineers deploy the system, however, those rules are pasted into a system prompt rather than enforced at the gateway or workflow layer. Tool permissions and document repositories are not isolated by role, and no workflow gate pauses execution for human approval. When an audit later asks for the authorization basis and review record of a case handoff, engineers have only unstructured logs.

Written compliance policies do not enforce themselves through natural-language instructions. This article is not legal advice; rather, it presents an engineering mapping and analytical framework. Although the NIST AI Risk Management Framework, the EU Artificial Intelligence Act, and China’s Interim Measures for the Management of Generative Artificial Intelligence Services differ in legal status, they share comparable operational demands across risk classification, data provenance, content labelling, and human oversight that map into gateway access policies, prompt registries, and audit records.

Legal Status and an Analytical Framework Across Governance Texts

Translating regulatory texts into software design starts by distinguishing voluntary standards from binding statutes.

At the international level, the OECD Recommendation of the Council on Artificial Intelligence—adopted in 2019 and updated in 2024^[4]—was the first intergovernmental standard on AI and is a non-binding recommendation^[4]. It sets out five values-based principles^[4]: inclusive growth, sustainable development and well-being; human rights and democratic values including fairness and privacy; transparency and explainability; robustness, security and safety; and accountability, alongside national policy recommendations^[4]. In the United States, the National Institute of Standards and Technology issued the Artificial Intelligence Risk Management Framework (AI RMF 1.0) in 2023^[1] as directed by the National Artificial Intelligence Initiative Act of 2020 (P.L. 116-283)^[1]. The AI RMF is voluntary, rights-preserving, non-sector specific, and use-case agnostic, offering organizations of all sizes and sectors a practical, adaptable resource to manage AI risks so society can benefit from AI while being protected from potential harms^[1].

By contrast, jurisdictional legislation is legally binding. In the European Union, Regulation (EU) 2024/1689 (the Artificial Intelligence Act), signed on 13 June 2024, is binding EU law with staged application dates^[2]. Its risk-based framework prohibits certain AI practices (Art. 5)^[2] and requires high-risk AI systems to maintain a risk management system (Art. 9), data and data governance (Art. 10), technical documentation (Art. 11), record-keeping and automatic logging (Art. 12), transparency and information to deployers (Art. 13), human oversight (Art. 14), and accuracy, robustness and cybersecurity (Art. 15)^[2]. It also sets transparency obligations for specific AI systems, including marking AI-generated content (Art. 50), and obligations for general-purpose AI model providers^[2]. In mainland China, the Interim Measures for the Management of Generative Artificial Intelligence Services (Order No. 15)^[3], issued in 2023 by the Cyberspace Administration of China and six other departments and effective 15 August 2023^[3], binds providers of generative AI services to the public in mainland China^[3]. Under “inclusive and prudent” and classified and graded supervision, the Measures require lawful training data sources, respect for intellectual property and personal information, data labelling rules, lawful content, and labelling of generated content such as images and video under deep synthesis rules, alongside security assessments and algorithm filing for services with public-opinion attributes or social mobilization capacity, user complaint mechanisms, and measures preventing minors’ over-reliance^[3].

As the authors' analytical framework—not an empirical finding—we group the engineering implications across comparable dimensions: **risk grading and scope limitation** (separating restricted actions from ordinary drafting), **data provenance and minimization** (bounding readable repositories by role), **transparency and prompt registration** (versioning prompt templates and output marking), and **human oversight and record-keeping** (pausing for human approval before consequential execution or handoffs).

Mapping Requirements to rlab.works: Gateway Policies, Prompt Registries, and Human Gates

Within rlab.works, this analytical framework maps onto AI Gateway and Agent OS, turning policy principles into input contracts, human review gates, and execution records.

For risk grading, access boundaries, and prompt transparency, the Set access rules (S14) skill pack in AI Gateway takes Team roles, service catalog and access requirements as input. Assisted scoping drafts role and request rules; next, a human review gate requires an assigned reviewer or requesting user to validate rule diffs (rejected outputs return for revision and do not advance, while approval produces a versioned rule set); assisted enforcement then classifies requests as allowed, denied, or pending approval; finally, a human review gate inspects request evidence to produce an acceptance conclusion and rollback-ready version. Underneath, the Workspace and agent access governance component applies workspace, team, and namespace roles to bound access scope and connectors, while Prompt registry, cache and semantic policies manages prompt templates and caches, identifies request intent, and emits context and guardrail evidence (its context optimization includes an advisory suggestion mode).

For human oversight and record-keeping, Agent OS pairs complementary skill packs. When an assistant interacts with files or interfaces, Approve computer actions (S03) takes Action goal, account and permitted materials: it checks readiness for a bounded context, pauses at a human review gate to approve the action list (blocking unapproved actions), executes approved steps while retaining screenshots, file diffs, and execution receipts, and ends with a human review of changes and anomalies. For sensitive handoffs, Intake and handoff (S09) takes Service request, identity assertions and assignment rules, confirms operator permissions, creates an account-bound service record, and pauses at a human review gate to approve data access so only the minimum approved data package is handed over and logged. These gates rely on the Auditable workflows, human confirmation and decision review component, which persists versioned steps, checks permissions, pauses for human decisions, and records review outcomes.

Across government and public services, finance, healthcare, and legal services, none of these skill packs carries a source-supported industry tag:

• Set access rules (S14) is a transferable use only in government and public services, scoping what a consultation tool may read and do by window and department duty and testing requests before release; adaptation requires connecting to organizational identity and actual document permissions rather than prompts. It has no tag for finance, healthcare, or legal services, serving there only as a general pattern.
• Approve computer actions (S03) is a transferable use only in legal services, where an assistant lists case-file actions, runs authorized file and page operations, and checks diffs; adaptation requires restricting read and write directories item by item, with external submissions excluded by default. It has no tag for government, finance, or healthcare.
• Intake and handoff (S09) is a transferable use only in healthcare, verifying reception access and collecting minimum records for administrative staff; adaptation requires hospital identity and ticketing integration, supporting administrative services only and never automated symptom triage. It has no tag for government, finance, or legal services.

Current limits must be stated plainly. Every skill pack on rlab.works is a proposed composition demonstrated with synthetic data and not yet connected to live services. Component maturity reflects static source inspection: Workspace and agent access governance and Prompt registry, cache and semantic policies are working code, whereas Auditable workflows, human confirmation and decision review is a prototype whose tool steps act as placeholders and records, with agent suggestions coming from inputs or defaults rather than autonomous execution. Retained logs are application-level records, not tamper-proof audit receipts.

Pre-Pilot Checks for Engineering and Governance Leaders

Before funding a generative AI pilot in a regulated workflow, leaders can apply these checks:

• Are access boundaries enforced outside the prompt? Confirm that role permissions and document scopes are enforced by an independent gateway policy layer with version diffing and rollback rather than prompt instructions.
• Do consequential actions and handoffs hit a blocking human gate? Verify that file edits, UI actions, and data transfers pause at a checkpoint where an assigned reviewer can reject proposals before execution proceeds.
• Does every request leave a traceable context and decision record? Check that the system logs the registered prompt version, policy decision, and reviewer approval alongside file or state diffs.