LLM-to-S010 Bridge

The LLM-to-S010 bridge turns a model-generated AML content draft into validated runner input.

It exists because an LLM may produce useful structured content, but the model must not control gates, create audit logs, inject auto-confirm plans or make final AML decisions.

Bridge pipeline#

The bridge follows a controlled sequence:

LLM draft text
→ JSON object extraction
→ schema validation
→ safety boundary checks
→ correction prompt or hard stop
→ validated S010 content JSON
→ analyst-interactive runner

The bridge should not call the runner with auto-confirm. It should produce a validated file and instruct the user to run the deterministic runner interactively.

Content fields and control fields#

An LLM may draft content such as:

• declared-data inventory;
• subject classification;
• verification plan;
• source checks;
• evidence references;
• discrepancy register;
• risk triggers;
• case summary;
• open questions.

An LLM must not supply control fields such as:

• auto_confirm_plan;
• gates;
• gate_event_log;
• analyst_review decision fields;
• final approve/reject decision.

Control fields belong to the deterministic runner and analyst review process, not to the model draft.

Normal schema errors#

If the model output is not valid JSON or fails the S010 schema for ordinary formatting reasons, the bridge can create a correction prompt.

Examples include:

• missing required field;
• wrong enum value;
• wrong type;
• incomplete object;
• truncated JSON;
• extra text around a JSON block.

The correction prompt should be grounded in the actual schema error rather than handwritten assumptions. This reduces drift between the schema and prompt instructions.

Safety violations#

Some errors are not normal formatting issues. They indicate that the model tried to cross a control boundary.

Safety violations should cause a hard stop without automatic retry, including attempts to:

• set analyst_review.decision to an approval, rejection or other final decision;
• provide auto_confirm_plan;
• create gate status or gate event logs;
• bypass analyst gate confirmation;
• instruct the runner to auto-confirm a real or LLM-generated case.

A safety violation is a signal for analyst inspection of the prompt, model output and implementation boundary.

Retry limit#

Correction retry should have a maximum number of attempts. If the model cannot produce valid S010 content after the retry limit, the process should stop and require analyst correction.

Analyst handoff#

After bridge validation, the next step is not an automatic decision. The validated content should be handed to the S010 runner, and a AML analyst should confirm gates interactively.