Our Methodology
Rulisto evaluates automated decision-making technologies (ADMT) using a rules-based mapping to the enrolled text. Unlike "AI Lawyers" that hallucinate compliance answers, our core evaluation engine executes a strict, human-reviewed knowledge graph of statutory obligations. Generative AI (Gemini Pro) is used strictly as an assistive drafting tool in our Remediation pipeline, keeping a human-in-the-loop at all times.
1. The State Model & Three-Valued Logic
Legal applicability is rarely a simple boolean. Rulisto evaluates systems using strict three-valued logic:
- TRUE: A statutory condition is met by the empirical facts provided.
- FALSE: A condition is explicitly negated.
- UNKNOWN: Missing facts prevent evaluation. If any required branch of a condition tree is undefined, the obligation's status resolves to
INDETERMINATE_INSUFFICIENT_DATA, returning partial answers using Kleene three-valued logic where possible without blocking fully resolved obligations.
2. Exemption Carve-Back Ordering
Statutory exemptions (e.g., HIPAA carve-outs in Colorado SB 26-189) are modeled as overriding edges in the knowledge graph. The engine evaluates exemptions first. If an exemption applies, the obligation is short-circuited and marked as NOT_APPLICABLE. However, we rigorously model carve-backs—conditions where an exemption is voided (e.g., using patient data for employment decisions).
3. Dual-Sign-Off Review Process
No rule enters production unreviewed. Rule versions publish only with review_status = 'approved'. We enforce a strict dual-sign-off cryptographic constraint at the database layer: the attorney who authored a rule logic tree cannot be the same user who approves it for production.
4. Deterministic Fixture Methodology
Every statute update must pass our golden fixture suite before release. We test the engine against hundreds of known system archetypes (e.g., "HR Resume Scanner", "Clinical Diagnostic AI"). If the ruleset update changes the outcome of any fixture unexpectedly, the build is failed.