The analysis runs on command.
The regulatory watch does not stop.
Rote reads a compliance program against the provisions that govern it: gap analysis, BAA review, policy analysis, risk assessment. Every finding is cited to the document and the provision it came from, and every step waits for a human before the next one starts. Between runs, the regulatory watch pulls HHS and CMS documents from the Federal Register and matches them to the sections of a manual they touch, by citation rather than by resemblance.
Not currently open for signups. Rote runs as the instrument behind the practice that uses it, and access is arranged inside an engagement. Dan Gonzalez runs that practice, Dang's Solutions →
It starts with a conversation.
Most compliance tools start with a form. Rote starts with a conversation. The intake agent asks about organization type, compliance history, the frameworks in scope, and the documents on hand, one question at a time, then uses those answers to configure the workspace before anything runs. There are no dropdowns to configure or settings to understand. BAAs, a compliance manual, or a risk assessment can go in during the same conversation, and the intake agent picks them up for the analysis that follows.
What that context buys is specificity. The workspace knows the org type, the target framework and the maturity stage, so a finding names the provision that applies to this organization rather than the one that applies to a category.
From there the analyses run on command. The first pass walks gap analysis, BAA review, policy analysis and risk assessment in sequence, pausing for review at each step, and ends in a posture profile: maturity stage, prioritized gaps, enterprise blockers, and a 30/60/90 roadmap. After that the same analyses are available individually, against whatever changed. Framework mapping carries a control set across frameworks, and portfolio review runs one checklist across a stack of BAAs at once.
- Analyses run on demand, not on a schedule
- Human-in-the-loop gates at each step: nothing moves without review
- Long runs resume where they stopped rather than starting over
A finding you cannot check is an opinion.
The design constraint is not that the analysis is always right. It is that being wrong is visible.
Every finding names the provision it was read against.
A finding reports the provision and the document text behind it, so it can be checked against the source rather than argued about. The skills are written to say what they could not determine from what they were given, rather than filling the gap with a plausible answer. What decides which source counts is a four-tier hierarchy: a curated manifest first, then the regulatory wiki, then retrieval, then facts recorded about the workspace, with every chunk tagged by the authority it came from.
Every finding gets accepted, edited, rejected or deferred, with a reason.
Findings are not a list you read once. Each one carries a disposition, a reason code, and a reasoning trace showing how the analysis arrived at it. Rejections are the useful ones: dispositions aggregate into patterns that later runs read as calibration notes and confidence adjustments, so disagreeing with a finding is an input rather than a complaint.
A second pass reads each finding back against its own evidence.
After an analysis completes, a critic pass reads every finding against the evidence it cited and raises one of four objections: the finding contradicts that evidence, the evidence does not support it, the scope does not match, or the confidence is overstated. It then confirms the finding or revises it, and adjusts the confidence score either way. It is a filter, not a guarantee, which is why the human gate stays.
Matching by citation, not by resemblance.
Most compliance programs are assessed once, then age. The analysis is accurate on the day it is signed and quietly stops being accurate afterward, because the rules keep moving and nothing is reading them.
The regulatory watch is the part of Rote that reads them. It pulls documents from the Federal Register, scoped to HHS and CMS and to a fixed set of CFR parts, and matches each one against the CFR citations a compliance manual already carries. The match is citation overlap: exact, ancestor, or descendant. A rule change to 45 CFR 164.308 surfaces against the section that cites it, and a document that touches nothing in the workspace is reported as awareness rather than as an action item.
Both final and proposed rules are pulled, once a day. Each document gets a plain-language summary and a topic tag before it is matched, and a match raises a review task against the manual section that carries the citation. The weekly digest separates what touched the workspace from what did not.
A proposed rule is ingested and flagged like any other document. Nothing runs it against the environment to say what would change. That reading is a person's job, which is why the digest goes to a practitioner rather than into a queue.
Citation overlap is a deliberately narrow instrument. It will not catch a change that matters but never names a part the manual cites, which is the reason a practitioner still reads the digest. What it does is remove the failure where a rule changed and nobody noticed for a year.
The platform is not open for signups.
Rote runs as the instrument behind the practice that uses it, not as a product sold here. It runs on infrastructure the practice controls, which is what lets the analysis stay where the documents are. Where a client engagement needs it, access is arranged directly as part of that engagement.
What a customer-facing deployment would need is the login surface, not the machinery under it. Roles, workspace scoping and server-side enforcement were built in from the start, so the second list below describes what is in the codebase rather than what is planned for it.
- Intake configures the workspace before anything runs: org type, frameworks in scope, documents on hand
- Gap analysis, BAA review, policy analysis and risk assessment, each on command against whatever changed
- Framework mapping carries one control set across frameworks
- Portfolio review runs one checklist across a stack of BAAs at once
- The regulatory watch reads HHS and CMS activity in the Federal Register and matches it to manual sections by CFR citation
- Four roles, super_admin, org_admin, analyst and viewer, enforced on the server as request dependencies rather than in the browser
- Every read and write scoped to a workspace at the query layer, with one explicit path across it
- An audit record on every mutating request, carrying the actor and the address, queryable after the fact
- Per-account API keys stored as hashes, individually expirable and revocable
- Lockout after repeated failed logins, per-account rate limits, and sessions that can be revoked
- Controls scoped to the jurisdictions selected for a workspace
- Analysis run against a local model by default
That last line carries the most weight. The standalone deployment runs inference on llama.cpp with the embedding model loaded from disk, and vLLM or Ollama are the other local paths. A client's own model or endpoint is used where the client directs it, by an access method agreed in the engagement, and not otherwise.
The method underneath it is open source and free to read. If the work needs a practitioner behind the output, for an audit response, board-level documentation, or a third-party validated assessment, that is an engagement rather than software. See the practice that delivers it →
Common questions.
A one-time assessment produces a snapshot. Rote runs the same analysis against the same documents whenever the program changes, so a policy revision is a re-run rather than a re-engagement. Between runs, the regulatory watch reads HHS and CMS activity in the Federal Register and matches it to the sections of the manual it touches.
Every finding is traceable. The analysis reads the documents in the workspace against a named provision and reports the citation behind each result, so a finding a practitioner disagrees with can be checked against the source text rather than argued about. The skills are also written to report what they could not determine from what they were given, instead of filling the gap with a plausible answer. Language models can still be wrong; the design constraint is that being wrong is visible and checkable rather than buried. Every first-run step pauses for review before the next one starts.
No, and it is not sold on its own. Rote carries the mechanical reading: which provision a document fails, which clause a BAA is missing, which control has nothing behind it. The judgment about what to do with that, and the signature under it, stays with a practitioner. That work is a separate business, delivered by Dang's Solutions, Dan Gonzalez's practice.
No tool is accepted or certified by HHS, and any vendor claiming otherwise is describing something that does not exist. What OCR examines is the program itself: the risk analysis that was conducted, the safeguards that were implemented, and the documentation behind both. The platform produces evidence-cited artifacts an organization keeps and attests from. The artifacts belong to the organization, and so does the judgment.
Rote runs on AWS under a single business associate agreement covering the HIPAA-eligible infrastructure. Each workspace is scoped separately, and that scoping is enforced on the server for every read and write rather than in the client. A business associate agreement is executed before any document containing PHI is uploaded.
Documents, findings and compliance data are scoped to a workspace, and that scoping is enforced on the server for every read and write. Rote runs on AWS under a single business associate agreement covering the HIPAA-eligible infrastructure. Analysis runs against a local model by default, and a client's own model is used only where the client directs it. See the privacy policy for the full terms.
This page describes the second one. The first is published, free, and available now.
Every skill is published under Apache 2.0 and free to read. Run them in your own environment, against your own documents, on whatever model you already use. Change what does not fit before you trust it with a client's files.
Browse the library Dan runs it· inside an engagementThe same skills, run by a set of agents against a configured workspace instead of one document at a time. It is the instrument behind the practice rather than a product sold here, it is not open for signups, and access is arranged inside an engagement.
How it worksThe method is open source.
Run it yourself first.
Every skill the platform runs is published under Apache 2.0 and free to read. The Self-Checks, published at dangssolutions.com, run in your browser with no email gate.
Need this done rather than explained? Dan Gonzalez runs Dang's Solutions, the practice that delivers it.