Greenlit — the chatbot can recommend. It cannot approve.
- Problem
- Every AI-tool approval starts from zero, because the last privacy contract is buried in Slack — and a search for it returns past yeses that do not transfer to this vendor.
- Solution
- A control catalogue decides what carries and what stays open, deterministic code compiles the record and hashes it, and a named person signs.
- Result
- 4th place at the Cognee × Qdrant hack night, Berlin, 14 August 2026. Built and demoed on a synthetic Slack corpus.
Someone asks in Slack to use a new AI tool. The company has done this twice before, and both answers are somewhere in the archive — inside a month of thread for the first tool, and a shorter one for the second. Nobody can say which parts of those answers still apply, so the review starts again.
Greenlit turns the discussion into a record: five company checks inherit from the last signed approval, the two that are about this vendor stay open, and the thread only carries what is unresolved. Built for the Cognee × Qdrant hack night in Berlin on 14 August 2026, where it placed 4th.
- The specialist agents write recommendations. The catalogue and the compiler decide what is inherited and what is a gap.
- A person signs. There is no query box that ends in an approval.
- Greenlit runs an approval and keeps the trail. It does not certify that a company is legally compliant — the people who sign stay accountable.
Similarity finds two yeses that do not transfer
The demo is the third request: Replit, for internal prototypes. Two approvals already exist. Cursor took a month of Slack — terms pasted into the thread, a data-processing agreement chased down — and was recorded when it finished. Notion AI took days rather than a month, because the Cursor record already existed, though people still pasted terms and waited on a vendor agreement.
Searching Slack for “privacy contract” finds both, and both look like the answer. Neither is. Cursor's agreement is signed with a different company and does not carry over to this vendor. Notion is not a coding tool, so nothing in its approval can prove that Replit will not retain the code written in it. Vector search does rank them sensibly, Cursor above Notion.
That is the gap the product sits in. Retrieval can find the neighbours; it cannot tell you which of their conditions you are entitled to reuse.
Five checks carry, two stay open
Every check in the catalogue is one of two kinds, and the kind decides whether it can be inherited. Five are company controls: they describe how this company uses any AI tool, so a new request inherits them from the last signed record. Two are about this specific vendor, and those never inherit.
For the Replit request, the five carry and both vendor checks are open — so the compiled record comes out blocked at five inherited and two gaps. The review opens on two questions instead of seven.
- Company — no customer data in prompts
- Company — company login only
- Company — prompt logs kept 6 months
- Company — internal use only
- Company — named owner and department
- Vendor — a signed privacy contract with this company
- Vendor — proof the vendor does not train on or keep our code
The agents can disagree. The record cannot.
Four specialists read the request — Legal, Security, Procurement, and a Challenger whose entire mandate is to block bad reasoning: do not treat a document tool's approval as evidence about a coding tool, do not copy one vendor's agreement onto another. Each returns a JSON envelope with a stance, an inherited list, a gaps list, and a few sentences in its own voice.
The compiler does not average them. It computes the split from the catalogue itself and discards any control id an agent invented. When an envelope disagrees, the Challenger's envelope is replaced with the catalogue's answer and a note recording that it was overridden — so the disagreement is preserved in the record rather than smoothed out of it. What comes out is validated against a fixed JSON schema and hashed: tool, vendor, status, inherited, gaps, source thread, agent envelopes, human sign-offs, version, timestamp, and a sha256 hash — a tamper-evident fingerprint — computed over everything except the hash itself.
Closing a gap moves the record, not the outcome. When Legal files the vendor agreement, that control moves from gaps to inherited, the version increments, the sign-off is appended with signer and rationale, and the hash is recomputed — and the status stays blocked, because the code-retention gap is still open.
Where the record lives
Each layer does one thing it is actually good at. Slack stays the place people argue, paste terms and attach files. Qdrant finds prior approvals phrased in different words. Cognee holds the relationships similarity cannot prove — who signed what, for which company, against which controls. A model drafts the Legal and Security notes. The record itself is written by code.
The last step is a web surface where the named human signs, and Legal's signature covers only the privacy contract — one desk, one control, not a blanket approval. That signature is what turns the record into a prior, so the next request opens with five checks already covered instead of zero.
The demo runs on a synthetic corpus of two completed approvals and one new request; no company data goes in, by design. The record stores references, hashes and only the excerpts it needs, rather than copying private threads into a log that keeps them forever.