Features
What VRM does
Seven areas, following the pipeline the product runs. Every statement on this page traces to the README or to shipped code; where the product does not do something, this page does not say it does.
Document intake and evaluation
Permits, plans and SOPs go in as files. Compliance obligations come out as structured records that still point at the sentence they came from.
- Each document type is parsed with a prompt written for that type — SPCC, SWPPP, RCRA, Title V, UST and FRP.
- Every extracted compliance requirement carries its regulatory citation and the verbatim source text it was taken from.
- Extraction returns a typed compliance obligation: authority, requirement type, frequency, criticality and any qualified-person requirement.
- The extraction instructions carry protection against prompt injection — text inside a document that tries to give the AI instructions — because a document is read, never obeyed.
Document evaluation summary across the entire system
One register display of every obligation across every facility — the Inspection Requirements Register — reviewed by a specialist before it can generate work.
- Nothing extracted goes live unreviewed — requirements enter the register for specialist review.
- Requirements are versioned with append-only history, so an earlier reading of a compliance obligation is never overwritten.
- Requirements carry a regulatory authority — federal, state, county, municipal or company SOP — so the register reflects who imposed each compliance obligation.
- The register is searchable on title and citation, and filters on authority, type, criticality and status composed together.
Compliance frequency, resolution and scheduling
The part that is genuinely hard: turning "monthly", "within 72 hours of a qualifying rain event" and "every five years" into dated tasks somebody can be assigned.
- Four frequency types are resolved: calendar, rolling, event-triggered and multi-year.
- All four support grace periods and qualified-person requirements — PE, Class A operator, accredited inspector.
- The resolver carries 43 tests covering SPCC monthly inspections, API 653 multi-year integrity tests, SWPPP post-storm triggers, rolling completion windows, grace periods, leap years and year boundaries.
- Activating a requirement resolves its frequency into inspection tasks with due dates and compliance windows.
- A daily sweep scans every facility for overdue tasks and triggers escalation.
| Type | Example | How it resolves |
|---|---|---|
| calendar | Monthly visual inspections | Tasks at fixed intervals — weekly, monthly, quarterly, semiannual or annual — with optional fixed deadlines. |
| rolling | 30-day rolling from last completion | Next due date is the last completion plus N days. |
| event | Post-storm inspection when rainfall exceeds 0.5" | Triggers within a configurable window after the threshold event. |
| multi_year | 5-year integrity test | Tasks at N-year intervals. |
Field checklists and documented evidence of completion
The checklist is the inspection. It is built for one hand, outdoors, on a bad connection.
- Checklists are completed on mobile, with photo, document or reading evidence attached to the item it belongs to.
- Each item records pass, fail or not-applicable against its own acceptance criteria.
- Every button and control on the field surface is at least fingertip-sized — 44 pixels square on a 375-pixel phone screen — so a checklist can be completed start to finish by touch alone.
- Pass, fail and N/A are distinguishable without color — three different glyphs, a text label, a fill, a ring and a colored card edge.
- Evidence is append-only at the database level: no UPDATE and no DELETE.
Non-compliance and corrective actions
Identified non-compliance findings get an owner, a severity level — low, medium, high or critical — and a target date for completion. Not just a red cell on a spreadsheet.
- Each non-compliance carries a severity, a corrective action owner, a corrective plan and a target date, and is tracked through to specialist review.
- Severity level is rendered as a four-step ramp whose lightness is monotonic, so the level survives color-blindness and a greyscale print of a report.
Reporting
Four templates, generated on demand, each one carrying the citations the findings rest on. Three of the four templates run for one facility or for the entire company; the site assessment is always for one facility.
- Four report templates: IRR export, non-compliance analysis, compliance roadmap and full site assessment.
- Report generation loads the facility context first — requirements, gaps, evidence and tasks — then writes against it.
- Every generated report carries an advisory notice stating that it is not legal advice.
- Inspection Requirements Register
- Non-Compliance Analysis Report
- Prioritized Compliance Roadmap
- Full Site Assessment Report
User access control, data management and view authority
Who has management authority to use the system for which activities, and who can see data from which facilities.
- 62 row-level-security policies enforce company-scoped data isolation across 17 tables.
- Field staff are scoped at the database to the facilities they are assigned to.
- In the demo, executive leadership sees every facility and every other view sees only its assigned facilities — the rule the product is being built to enforce for every role.
- Evidence, the audit log and requirement versions are append-only, protected by triggers rather than by convention.
- Controls prevent privilege escalation: a user cannot modify their own role, company, active flag or facility assignments.
- The role-to-route matrix is written once and read by both guard layers, and a test re-derives it from the pre-migration source on every run.
- Every AI function call is authenticated with a signed identity token (a JWT), authorized against the caller’s company, and validates its identifiers.
Next step
Open it and look
The demo carries a full worked dataset — a refinery complex, its documents, the requirements extracted from them, the tasks scheduled, the gaps raised and a delivered report.