AI Risk and Compliance Copilot for Startups

AI Prompts to Build This

Copy these build prompts into Claude, Cursor, or your AI coding tool. Create a free account to unlock the full research behind them.

1. 1. Project Setup

   Build the weekend MVP of "AgentLedger": scan a GitHub org for AI usage, map the risks, and draft the missing policies.
   
   Stack: Next.js (App Router), TypeScript, Tailwind, Supabase (Postgres, Row Level Security, Auth with GitHub sign-in), a GitHub App with read-only contents and metadata, Claude (Anthropic API) for the policy drafts. Deploy on Vercel.
   
   Tables (Row Level Security on, each organization reads only its own rows):
   - organizations(id, user_id, name)
   - connections(id, org_id, provider, credential_ref)
   - inventory_items(id, org_id, provider, path, snippet_hash, last_seen_sha)
   - findings(id, org_id, inventory_item_id, control_id, severity, evidence, status, recommended_policy_slug)  where severity is low, medium or high and status is one of open, accepted, remediated
   - policies(id, org_id, slug, version, markdown)
   Encrypt provider secrets and never log raw keys.
   
   Screens: /app/connect, /app/ledger (inventory), /app/gaps (ranked findings), /app/pack (the export).
   Env vars (names only): NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_ANON_KEY, SUPABASE_SERVICE_ROLE_KEY (server only), GITHUB_APP_ID, GITHUB_PRIVATE_KEY, ANTHROPIC_API_KEY.
   
   Do not build: billing, plans or per-integration pricing, the OpenAI, Anthropic and AWS usage APIs, AWS roles, a second AI model, an admin area.
   Done when: npm run dev starts, the GitHub App installs on a test org, and the five tables exist with Row Level Security on.

2. 2. Core Feature

   Build the one feature that proves AgentLedger: a scan, a ranked gap list, and a data-room pack.
   1. Scan: through the GitHub App, list default-branch files that match AI SDK patterns (openai, anthropic, bedrock, langchain, vercel/ai). Store the path, a snippet hash and the provider in inventory_items. Never store the contents of a .env file. Flag a suspected secret and ask the user to rotate it. Re-scan only when the git SHA changed.
   2. Map risk: score each item for prompt_pii_possible, training_opt_out, retention_known, subprocessors_listed, eu_ai_act_role and soc2_evidence_gap. Return JSON findings with control_id, severity, evidence and recommended_policy_slug.
   3. /app/gaps lists findings ranked by severity, with Draft policy and Mark accepted buttons.
   4. Draft policies with Claude. System prompt: "You are a startup compliance copilot. Draft short, lawyer-editable Markdown from a machine inventory. Never invent statutes. Cite finding IDs. If something is unknown, write a TODO. Do not guess a date or a DPA." Generate ai-acceptable-use, ai-vendor-inventory, model-card-stub, ai-incident-response-addendum and data-retention-for-prompts, each with purpose, scope, roles, allowed and prohibited uses, a vendor table, retention and escalation.
   5. Export a zip: inventory.csv, findings.csv, the policies as Markdown, and a risk_memo.md under 600 words. Version each policy and turn scan differences into a changelog.md.
   Empty state: with no connection, show the GitHub App install button.
   Done when: a test org with one OpenAI import shows an inventory item and ranked findings, drafted policies cite finding IDs and use TODO for unknowns, and the zip contains the five files.

3. 3. Landing Page

   Build a one-page landing site for AgentLedger, an AI risk and compliance copilot for startups.
   Hero: "Know where your AI is, before an auditor asks." Sub: "Scan your stack, map the gaps, and draft the missing policies. No enterprise contract needed." One button: Join the waitlist.
   Sections: the problem (AI tools spread faster than anyone writes the policy), how it works in three steps (connect sources, map risk, generate the pack), a mock gap list, and an FAQ that says plainly the policies are drafts for a lawyer to edit and that nothing here is legal advice.
   Waitlist: store the email in a waitlist table in Supabase. No other service.
   Voice: calm, specific and honest about limits.
   Done when: the page renders on a phone and a submitted email appears in the waitlist table.

4. 4. Branding Package

   Use a design or image tool for this one. A coding agent cannot draw a logo.
   Brand for AgentLedger: a wordmark and an icon that suggest a ledger line and a checkmark.
   Colors: near-black, warm paper and one steady blue, with amber and red used only for severity. Type: a clean sans for the interface and a mono for control IDs.
   Deliverables: wordmark, icon, three severity badges that differ by shape as well as color, and one launch graphic.
   Done when: each deliverable is saved in one folder and the badges are distinguishable without color.