tutorial: Generating compliance policies with complypack's test-driven workflow

[sonupreetam]

Topic

Step-by-step guide to generating Rego compliance policies using ComplyPack's test-driven workflow (/comply:build-assessment).

Target Audience

Platform engineers and compliance practitioners who need to generate OPA/Conftest policies from Gemara Control Catalogs. No Rego expertise required — the workflow is designed so practitioners review test scenarios in domain terms.

Suggested Structure

1. Prerequisites: MCP server configured (/comply:mcp-setup), Gemara catalog loaded, child policy compiled (/comply:audit-pipeline)
2. Single mode walkthrough: Step through one requirement end-to-end
   • Pause 1: Review the requirement
   • Pause 2: Review suggested checks and variable usage
   • Pause 3: Approve the test case (the hard gate)
   • Pause 4: Review the generated policy and test results
3. Batch mode walkthrough: Process all requirements at once (Phase 1: all tests, Phase 2: all policies)
4. Using helpers: Providing reusable Rego functions across requirements
5. Provider mapping: Understanding complytime-mapping.json (OPA) or complytime-ampel-policy.json (Ampel)
6. Troubleshooting: Common issues (MCP unreachable, contract violations, test failures)

Prerequisites

• ComplyPack MCP server running with a Gemara catalog
• A compiled child policy (.complytime/child-policy.yaml)
• One of: Claude Code, OpenCode, Cursor, or Gemini CLI

Reference

• skills/build-assessment/SKILL.md — orchestrator skill
• skills/test-driven-assessment/SKILL.md — test generation logic
• skills/pack-assessment/SKILL.md — policy generation logic