Team: Vetted
Team Participants:
Aryan Kumar (San José State University)
Daniel Villanueva (California State University, Bakersfield)
Khush Patel (San Diego State University)
Amreen Kousar (California State University, Long Beach)
“Vendors have to upload the documents, which is taking a lot of time, and then after that we have to go back and forth for emails, which creates a loop.”
Problem
CSUB’s technology purchase review process requires manual security and accessibility assessments that extend review cycle times from weeks to months to complete, even for low-risk software requests. ISO reviewers spend significant time on routine validation of vendor documentation-HECVAT forms, SOC 2 Type II reports, VPATs, accessibility plans- and manual packet assembly rather than focusing on genuine security risks. Requesters must chase vendors for required documentation while navigating unclear submission requirements, leading to high rates of incomplete submissions and rework. An AI enabled preparation and routing process with humans in the loop at each stage gate is needed.
Technical Solution
The Vetted team developed a technology review platform that automates CSU Bakersfield’s Solutions Consulting workflow by transforming ServiceNow requests into guided vendor evidence submissions with parallel security and accessibility analysis, producing cited recommendation packets for reviewer approval. The solution uses a deterministic policy rules engine implementing a documented decision tree, where AWS Lambda (serverless compute) functions invoke Amazon Bedrock (managed generative AI) with Claude models configured for consistent outputs to explain ambiguities and compose packets while the model cannot override risk classifications. When a reviewer creates a case, the system issues a tokenized vendor invitation stored in Amazon DynamoDB (NoSQL database), and vendors upload evidence through presigned Amazon S3 (cloud storage) POST URLs with five-minute expiration, where S3 events trigger an SQS queue invoking a Lambda processor that validates file formats before using Amazon Textract (document text extraction) for PDFs and images or standard parsers for DOCX and XLSX files, with extracted content stored in DynamoDB and originals encrypted with AWS KMS (key management). The review workflow runs parallel specialist agents for security and accessibility that evaluate evidence against the 982-row approved-software catalog and generate assessments with required-evidence checklists and citations, while an evidence specialist validates document contents and a citation checker ensures claim provenance with one repair pass before failing closed. The React reviewer workspace is deployed to Amazon S3 and served via Amazon CloudFront (content delivery network), providing a dashboard, review queue, editable packets, and simulated ServiceNow write-back, with authentication via Amazon Cognito (authentication). The system includes automated deployment with safety checks that automatically roll back to the previous working version if problems are detected, while Slack notifications keep reviewers informed, reducing low-risk review cycle time from weeks to same-day processing while ensuring all final decisions remain with human reviewers.
Showcase
| Presentation Recording | A recording of AI Summer Camp students presenting their project. |
| Slideshow | The accompanying slides shown in the video. |
| Source Code | All of the code and assets developed during the course of the AI Summer Camp. |
About the DxHub
The Cal Poly Digital Transformation Hub (DxHub) is a strategic relationship with Amazon Web Services (AWS) and is the world’s first cloud innovation center supported by AWS on a University campus. The primary goal of the DxHub is to provide students with real-world problem-solving experiences by immersing them in the application of proven innovation methods in combination with the latest technologies to solve important challenges in the public sector. The challenges being addressed cover a wide variety of topics including homelessness, evidence-based policing, digital literacy, virtual cybersecurity laboratories and many others. The DxHub leverages the deep subject matter expertise of government, education, and non-profit organizations to clearly understand the customers affected by public sector challenges and develop solutions that meet the customer needs.