Compliance Copilot lists every requirement of a proposal's RFP next to this proposal's response. Use it to find requirements with no settled answer, correct a status the AI set, and tell evaluators which section answers each requirement. The page is titled Compliance Matrix.
Opening the page
When the proposal wizard finishes generating, select Review Compliance Copilot. At any other time, open the address /dashboard/proposals/<proposal id>/compliance, using the id from the proposal editor's address. The proposal editor does not link to this page. Select Back to Proposal to return to the editor.
The page needs a proposal created from an RFP. For a proposal with no RFP, it shows "Compliance Copilot unavailable" and "Proposal is not linked to an RFP".
The summary tiles
- Requirements: how many requirements the RFP's analysis extracted.
- Controls Covered: how many different control tags appear across the requirements. It measures the RFP's wording, not your responses. See What the control tags mean below.
- Compliant: requirements whose response is marked Compliant.
- High-Risk Gaps: mandatory requirements that are still gaps. A requirement is mandatory when the RFP analysis marked it mandatory or must-have. It is a gap when its response has no text, or is marked Not compliant, TBD or Needs input.
- Unmapped: requirements with a settled status but no linked section ("Not linked to a section"). Requirements at TBD or Needs input are not counted, because they have no answer to locate yet.
The quality gate is stricter than High-Risk Gaps: it also treats a mandatory requirement answered only Partial as missing. See The quality gate.
The Action Queue
The Action Queue turns the counts into a short to-do list, such as "Resolve 3 mandatory compliance gaps before submission." or "Link 5 responses to a proposal section so evaluators can find the answer." Two items are prompts rather than problems. One appears when fewer than four in ten requirements have a response containing a reference word. The other appears when fewer than eight control tags matched. When nothing needs doing, the queue says "Maintain current compliance posture and run a final reviewer pass before export."
The Requirement Matrix
The Requirement Matrix has one card per requirement. Each card shows the response status, a mandatory badge where it applies, a gap badge while the requirement is a gap, the requirement's category and its text. Below that are:
- Priority: the priority the RFP analysis gave the requirement.
- Citations: how many times the response uses the words appendix, evidence, attachment, source or "see:". It counts the words; it does not check that the reference exists.
- Numeric signals: how many numbers the response contains. A number is not checked for accuracy.
- The first part of the response text, when there is one.
A requirement with no response yet shows the status TBD.
Correcting a status
The AI sets each status when it drafts the requirement responses. To change one:
- Find the requirement's card.
- Choose a new value under Compliance Status Override: Compliant, Partial, Not Compliant, TBD or Needs Input.
The change saves straight away, and "Saving override..." shows while it does. It is the same status as the Compliance field in the proposal editor's Requirements tab, and the quality gate reads it. Changing the status does not change the response text, and the quality gate gives no credit for Compliant when the response has no text.
Linking a requirement to a section
- Find the requirement's card.
- Choose the section under Addressed in Section, or "— Not linked —" to remove the link.
The card then says "Evaluators will find this in" and the section's title. If the linked section has been deleted, the card says "Linked section was deleted — please pick a new one."
Regenerate Stale Responses
Regenerate Stale Responses asks the AI to draft new responses for requirements that have no response, or whose response is at TBD or Needs Input. That includes statuses you set yourself. The new text and status replace the old ones for those requirements. Every other response is left alone, and a section link that is already set is kept. The button reads "Regenerating…" while it runs.
What the control tags mean
The line under the page title names the proposal and the control baseline the tags come from, FEDRAMP MODERATE. Each card can show up to three tags, such as "AC-2 | Access Control" or "SC-13 | System and Communications Protection". A tag means that words tied to that control appear in the requirement's text or category. For example, "encryption" matches SC-13 and "incident" matches IR-4.
A tag is a reading aid. It is not an assessment of your response, and it does not mean your company, your proposal or Propivix meets that control. A requirement with no matching words has no tags.
For the RFP-level view of the same requirements, grouped by RFP section, see The compliance matrix.