# StructureClerk - The authority layer for AI agents ## About StructureClerk answers "what is this AI agent allowed to do?" before it acts: advisory ALLOW, DENY, APPROVE or ESCALATE decisions, with Ed25519-signed evidence a third party can verify, exposed over REST, A2A and MCP. The map covers 192 jurisdictions for data protection, with AI governance and cybersecurity mapped for the main ones. Compliance and authority infrastructure for the agentic economy in emerging markets: priority regions are Australasia, the Gulf, the large South American economies, then India, South East Asia and Mexico, with Africa covered throughout. The way in is the free compliance assessment, no account needed: every saved assessment produces the organisation's policy profile, which the API then applies to each decision. Built by Michel Fotsing, CISSP, ISO/IEC 42001 Lead Auditor, member of the ISC2 Exam Review Committee. ## Main capabilities - Multi-jurisdiction compliance assessment (192 jurisdictions for data protection) - 4 areas: data protection, AI governance, cybersecurity, algorithmic compliance - CISO-level questionnaire (200+ weighted questions, one question per screen) - Free summary report; the detailed action plan comes with the Pro plan - Compliance AI agent (Law 25, GDPR, AI Act, POPIA and more) - Advisory authority API for AI agents: ALLOW, DENY, APPROVE, ESCALATE decisions with evidence (POST /api/v1/authority/decide, also over A2A and MCP). StructureClerk decides, your infrastructure enforces. - Posture ledger: every scan, agent decision and piece of evidence enters the same signed, append-only chain. Gaps are shown as gaps, never smoothed over. - Five languages, English by default: en at the root, then /fr, /es, /ar, /zh. ## Regulatory frameworks covered ### Data protection - GDPR (European Union) - Law 25 (Quebec) - PIPEDA (Canada) - CCPA/CPRA (California) - LGPD (Brazil) - POPIA (South Africa) - NDPA (Nigeria) - DPDP (India) - PDPL (United Arab Emirates, Saudi Arabia) - Privacy Act (Australia) - PIPL (China) - And 150+ other national regimes ### AI governance - EU AI Act (European Union) - Bill C-27 / AIDA (Canada) - ISO/IEC 42001, NIST AI RMF - Sector guidance ### Cybersecurity - NIS2 (European Union) - ISO/IEC 27001 - NIST CSF 2.0 - SOC 2 ## Geographic coverage - Europe: 48 jurisdictions - Africa: 42 jurisdictions - Asia-Pacific: 34 jurisdictions - Americas: 51 jurisdictions - Middle East: 17 jurisdictions These five display groups cover the 8 regions the dataset distinguishes. Checkable figures: GET https://structureclerk.ca/api/agent-manifest (field `coverage`), which computes them from the dataset itself. ## Author Michel Fotsing - Cybersecurity and AI governance architect - CISSP (Certified Information Systems Security Professional) - ISO/IEC 42001 Lead Auditor (AI management systems) - Member of the ISC2 Exam Review Committee - Author of "L'Architecte Numerique: Orchestrer les intelligences a l'ere de l'IA" - Newsletter "L'Architecte Numerique": https://michelfotsing.substack.com ## Full document for LLMs Detailed version (regulatory summaries, FAQ, canonical URLs): https://structureclerk.ca/llms-full.txt ## Key URLs - Main site: https://structureclerk.ca - Assessment: https://structureclerk.ca/scan - AI agent: https://structureclerk.ca/agent - Authority layer for AI agents: https://structureclerk.ca/authority - Web compliance observatory: https://structureclerk.ca/observatoire - REST API: https://structureclerk.ca/docs/api - Methodology: https://structureclerk.ca/methodologie - Glossary (definitions, en): https://structureclerk.ca/glossary - Glossaire (definitions, fr): https://structureclerk.ca/fr/glossary - Require an attestation (buyers, investors, tenders): https://structureclerk.ca/attestation - Verify an attestation you received (free, no account): https://structureclerk.ca/verify - Human review terms (escalation, countersignature): https://structureclerk.ca/legal/review - Where StructureClerk stands against AARM: https://structureclerk.ca/aarm - Newsletter: https://michelfotsing.substack.com - Book: https://larchitectenumerique.com ## Regional pages - Quebec/Canada: https://structureclerk.ca/fr/quebec - Africa: https://structureclerk.ca/afrique - Europe: https://structureclerk.ca/france ## Pages by framework - Law 25: https://structureclerk.ca/loi-25 - GDPR: https://structureclerk.ca/rgpd - EU AI Act: https://structureclerk.ca/ai-act - NIS2: https://structureclerk.ca/nis2 - POPIA: https://structureclerk.ca/popia ## AARM AARM (Autonomous Action Runtime Management) is an open runtime security specification for AI agents (arXiv:2602.09433), given to the Cloud Security Alliance where it is a technical working group. StructureClerk claims NO AARM conformance level. It is a member of the working group, which is a different statement and not a conformance claim. spec: AARM level: null claimed: false twg_member: true twg_joined_at: 2026-09-18 source: arXiv:2602.09433 The table of the nine requirements, one by one, including the ones that are not met: https://structureclerk.ca/aarm ## Contact Email: info@structureclerk.ca ## Pricing - Assessment, score and summary report: free, no credit card - Verifying a decision's evidence: free and without an account, permanently - Pro plan (99 USD/month), the only paid self-serve plan: voice assessment, detailed action plan, multi-assessment history, regulatory alerts, continuous attestation, read-only internal connectors - Authority plans, for putting agents in production: - Design partner: 0 USD, six months, 10,000 decisions/month, by conversation - Team: 500 USD/month, 50,000 decisions/month - Fleet: 2,000 USD/month, 250,000 decisions/month Past the included allowance, decisions draw on prepaid credits rather than stopping. - Details: https://structureclerk.ca/pricing ## API - how a call is billed Resolution order, and the first that applies wins: 1. Zero-cost endpoint -> served, nothing counted 2. Free daily allowance (10 calls/day, per API key or per IP) -> served, 0 credits 3. Monthly included allowance of an Authority plan -> served, 0 credits 4. Prepaid credits -> served, debited (1 credit = 0.01 USD) A refusal costs nothing, and a server error after a debit is refunded. Possible refusals: 401 invalid_api_key - 403 insufficient_scope - 429 free_tier_exhausted - 402 insufficient_credits - 503 metering_unavailable. Current rate card, machine readable: https://structureclerk.ca/api/v1/pricing Coverage computed from the dataset: https://structureclerk.ca/api/agent-manifest ## Free endpoints, no key - POST https://structureclerk.ca/api/v1/authority/decide (daily allowance) - GET https://structureclerk.ca/api/v1/authority/verify/{evidence_id} - evidence verification - GET https://structureclerk.ca/api/v1/authority/verify/anchors - published anchors of the chained log - GET https://structureclerk.ca/api/v1/authority/stats - aggregate counters - GET https://structureclerk.ca/api/v1/pricing - current rate card ## Jurisdiction pages One page per jurisdiction whose data protection law is in force, in the FIVE languages of the site (en, fr, es, ar, zh), with the transfer regime, the localisation duty, the rights against an automated decision, the date it was last checked, and three authority decisions actually computed for that jurisdiction. Each page carries a schema.org Legislation + FAQPage graph in its own language (inLanguage), and the five versions point at one another. - English index: https://structureclerk.ca/jurisdictions - French index: https://structureclerk.ca/fr/jurisdictions - Spanish index: https://structureclerk.ca/es/jurisdictions - Arabic index: https://structureclerk.ca/ar/jurisdictions - Chinese index: https://structureclerk.ca/zh/jurisdictions - One page per law in force, in each language; the exact count is computed from the dataset (field `coverage` of https://structureclerk.ca/api/agent-manifest). The segment is the same everywhere (/jurisdictions) under the language prefix; the SLUG is the jurisdiction's name in the language of the page, without accents and in lower case. Arabic and Chinese reuse the English slug: a percent-encoded URL does not travel well. Examples: /jurisdictions/germany - /fr/jurisdictions/allemagne - /es/jurisdictions/alemania - /ar/jurisdictions/germany - /zh/jurisdictions/germany - The five indexes list every page and cite one another in hreflang; the sitemap carries them: https://structureclerk.ca/sitemap.xml - Law titles, regulator names, key duties and penalties are quoted as the source states them; they are not translated, and the page says so. ## Blog - technical guides Every article is published in French and in English, each at its own URL, and is available as raw Markdown by appending /llms.txt to the article URL. - Machine-readable index: https://structureclerk.ca/blog/llms.txt - RSS feed: https://structureclerk.ca/blog/rss.xml - Making Claude Desktop Law 25 compliant with MCP: https://structureclerk.ca/blog/claude-desktop-law-25-mcp - Publishing an AI governance server to the MCP registry: https://structureclerk.ca/blog/publish-ai-governance-server-mcp-registry - AI agent compliance across jurisdictions: https://structureclerk.ca/blog/ai-agent-compliance-many-jurisdictions ## Integrations - governing your platform's AI agents One page per AI agent vendor, in French and in English, describing where to insert an authority decision into the platform's public mechanisms (webhook, automation block, MCP tool, tool call) and what the signed evidence lets you demonstrate to a third party. - Index: https://structureclerk.ca/integrations - monday.com: https://structureclerk.ca/integrations/monday-com-ai-agent-governance - https://structureclerk.ca/fr/integrations/gouvernance-agents-ia-monday-com - Salesforce Agentforce: https://structureclerk.ca/integrations/salesforce-agentforce-ai-agent-governance - https://structureclerk.ca/fr/integrations/gouvernance-agents-ia-salesforce-agentforce - Microsoft Copilot Studio: https://structureclerk.ca/integrations/microsoft-copilot-studio-ai-agent-governance - https://structureclerk.ca/fr/integrations/gouvernance-agents-ia-microsoft-copilot-studio - ServiceNow AI Agents: https://structureclerk.ca/integrations/servicenow-ai-agent-governance - https://structureclerk.ca/fr/integrations/gouvernance-agents-ia-servicenow - Google Gemini Enterprise / Vertex AI: https://structureclerk.ca/integrations/google-vertex-gemini-ai-agent-governance - https://structureclerk.ca/fr/integrations/gouvernance-agents-ia-google-vertex-gemini - OpenAI: https://structureclerk.ca/integrations/openai-ai-agent-governance - https://structureclerk.ca/fr/integrations/gouvernance-agents-ia-openai - Anthropic Claude: https://structureclerk.ca/integrations/claude-mcp-ai-agent-governance - https://structureclerk.ca/fr/integrations/gouvernance-agents-ia-claude-mcp - Zapier: https://structureclerk.ca/integrations/zapier-ai-agent-governance - https://structureclerk.ca/fr/integrations/gouvernance-agents-ia-zapier - n8n: https://structureclerk.ca/integrations/n8n-self-hosted-ai-agent-governance - https://structureclerk.ca/fr/integrations/gouvernance-agents-ia-n8n-auto-heberge - HubSpot Breeze: https://structureclerk.ca/integrations/hubspot-breeze-ai-agent-governance - https://structureclerk.ca/fr/integrations/gouvernance-agents-ia-hubspot-breeze - StructureClerk is not affiliated with any of these vendors; their names are the trademarks of their respective owners.