Audit plugin

Use when the user asks how the platform works, requests a task walkthrough, wants a term defined, or needs a sourced explanation of an error.

Use when the user asks to run or dry-run an autopilot pass over their assigned-step queue. A headless driver uses the verified tenant/user privileges, bounded scan and dependency-ready execution procedures to draft suggestions, report missing inputs and retain pending work. It never approves or repeats already handled steps. Scheduling requires a verified host scheduler; a manual pass does not.

Use when the user asks to offboard an owner, reassign work across a person's records or steps, or prepare a cross-record handoff report. Resolve the live tenant schema and exact scope; propose changes through native suggestions. Reassigning one issue or item uses coach-item-update.

Use when the user asks to build, create, design or make a new custom dashboard, report page or live chart that no existing dashboard or view provides. Builds a live artifact dashboard: a page the host publishes with access to the AssureSwarm connector, whose sections read the tenant through the MCP's query_data whenever someone opens it, with that viewer's own permissions. Needs a host that can publish such a page. Setting the variables of an existing dashboard uses coach-dashboard-view; a question or show-me request uses coach-dashboard-link.

Use when the user asks to view or link a dashboard, discover available dashboards, show a filtered dashboard, or answer a question about overdue issues, workflow progress, owner workload, audit coverage, template usage, vendor reassessments, risk treatment, policies or requirements. A view with chosen variables uses coach-dashboard-view; a new custom dashboard uses coach-dashboard-build. Creating an item, starting a workflow and exporting records use their own skills.

Use when the user asks to build, create, save, set up or adjust a view of an existing dashboard: a named dashboard with chosen variables such as scope, range, year, audit, table filters, search, sort, focus or templates. Checks the variables that dashboard reads, decides each value the request supports, asks once about anything uncertain, and returns a link that keeps the view. Read-only; a view is a link, not a stored record. A question or plain show-me request uses coach-dashboard-link; a new custom dashboard uses coach-dashboard-build.

Use when the user asks to upload, attach, replace, or file a document or evidence on a workflow step, an item's DOCUMENT field, or a workflow template step, or to link an external document URL on a step or template step. Uploads store bytes immediately; URL references become stepdocumentlink or workflowtemplatestepdocumentlink suggestions. Resolves the destination and returns the stored document id for form file fields.

Use when the user asks to export an item's evidence package, a selected set of items, or a tenant archive. Preserve the requested item scope, include relevant workflows and documents, and verify redaction before shareable output. Exporting one specific workflow uses coach-workflow-export. Raw archives require an authorized private destination.

Use when the user asks to create, add, build, or design a workflow-step form for missing inputs from someone who is not executing the workflow or step. Executor work belongs in step results. Validates field definitions and proposes the schema through suggest_change; filling an existing form is coach-form-fill.

Use whenever the user asks to populate, pre-fill, fill out, draft, or submit values for an existing step form. Proposes values via the submit_form action so the assignee sees the AI-suggested fill on the form page and can edit then submit in one click. Never use action update with form.values for fills — that lands the preview in the schema-diff UI on the step viewer instead of the form page.

Use whenever the user asks to create, add, draft, or open a new item of a known type (e.g., audit, risk, control, issue, policy, process). Works for any admin-configured item type: reads the type's schema via get_schema, fills every field the request supports (for example a control's type from what the control does), confirms any uncertain value with the user before submitting, validates values against field definitions, and submits a single suggest_change action create suggestion for human approval.

Use whenever the user asks to update, change, edit, set, rename, correct, or archive an existing item (e.g., change a risk's owner, move the audit to fieldwork, archive a retired control). Works on any admin-configured item type: resolves the item by id or by type plus title search, shows the current values of the targeted fields, validates new values against the field definitions from get_schema, and submits a single suggest_change action update suggestion for human approval.

Use whenever the user asks to link, relate, connect, or tie one item to another (an audit to a risk, an issue to a control) — or to unlink one. Resolves each side by id or title, validates the kind (parent, child, sibling, related), and submits one itemrelationship suggestion via suggest_change for approval; --unlink mirrors the flow with a delete.

Use when the user asks to prepare a stakeholder notification, nudge, reminder or distribution list about an AssureSwarm item or step. Resolve recipients from verified tenant fields and available directories, redact the draft and create it through the actual mail-draft operation when available. Without one, return copyable text or an artifact; never claim that a draft was sent.

Execute a read-only GraphQL query against the AssureSwarm tenant via the query_data MCP tool. Translates a natural-language data request into a valid GraphQL query against the platform's queryReference catalog, runs it, and presents the results in a clean format. Handles pagination, full-text search, structured filters, and csv/jsonl export for large results. Use whenever the user asks to find, list, search, count, look up, or export items, workflows, steps, users, or any other queryable resource in the tenant. If the user says show me, where do I see, or take me to, and a system dashboard covers the ask, coach-dashboard-link goes first; use this skill for the data itself or when no dashboard fits. Any ask that walks two or more links in one go — an item to its workflows, their steps, the items linked to those steps, the templates those items use, the runs of those templates — is a graph traversal: run it as ONE universeFocus path-mode query, never a chain of per-item reads.

Use when the user asks to redact, scrub, or sanitize a staged directory of outbound content before export — the standalone entry point for ad-hoc redaction passes, and the plugin's single redaction engine: every skill that produces shareable output runs this same pass inline before anything leaves the workspace. Deterministic internal-only patterns are auto-removed, ambiguous ones surfaced for user confirmation, and a redact report written. Build-list rows 7, 30.

Use when an assembled document package leaves AssureSwarm — board decks, regulator attestations, 302/906 certification packages, audit reports. Renders markdown to docx+pdf via pandoc, hard-gates through the /coach-redact redaction pass (halts on needs_user), packages the cleared artifacts, and hands distribution to /coach-notify. --cite binds claims to live AssureSwarm records. Section composition lives in the covering assureswarm.com/workflows workflows.

Use when the user asks to prepare a security incident or vulnerability report for AssureSwarm. Collects sourced facts, separates observations from uncertainty, redacts the evidence, and prepares a reviewable draft through an available mail or artifact tool. Creating an incident record in the user's own tenant uses coach-item-create.

Use when the user asks to connect or configure the plugin for a tenant, refresh its connection details, or verify that the connected tenant supports the requested work.

Use when the user asks to open, file, or raise a support ticket with AssureSwarm support because something is broken or blocking work; to reply to, follow up on, or update an existing support thread in Gmail; to check, list, or review the status of their support tickets and see which threads are waiting on them; or to send product feedback, a feature request, or an improvement idea for AssureSwarm.

Use when the user asks for an orientation to the platform, its Studio item types, or the skills available for their role.

Use whenever the user asks to assign, schedule, set deadlines, or pick approvers for the steps of a workflow. Sets approvers and due dates on a workflow instance via suggest_change against the step target — walking the steps, resolving users by name or email to user ids, and submitting one update suggestion per step that sets the approvers array and dueDate field.

Use whenever the user asks to attach, instantiate, apply, or run a workflow on an item. Resolve the parent, intended cycle and tenant template, reuse compatible existing or pending work, and propose a new instance only after a complete fresh no-match. Public source identity is distinct from tenant IDs.

Use when the user wants to add, edit or remove a step in an existing workflow, change its dependency graph, or author a new one-off workflow or reusable template. Resolve actual stored IDs and the current schema before proposing supported step create/update/delete or revision-bound graph changes. Use coach-workflow-attach for an existing template and coach-workflow-execute to perform an existing step.

Use when the user asks to resume an existing workflow, including when no step has been selected, or to execute, run, work on, complete, or do a workflow step. Applies to interactive and headless requests.

Use whenever the user asks to export, download, archive, snapshot, or bundle a workflow's data. Gathers the complete data of a workflow instance — every step's result, every form's submitted values, every uploaded or linked document — into a local directory: walks the workflow via query_data, downloads attached documents via download_document, and writes a structured local package the operator can archive or share. Read-only; never mutates the workflow.

Use when the user asks what to work on, to triage a queue, as the scan phase of an autopilot run — or to check progress across a portfolio or cycle, find stalled or overdue work, see what is at risk, or name who to nudge. Read-only in both directions. Mine mode classifies the current user's assigned steps into four doer-states plus an awaiting-my-approval line; sweep mode is the lead/PMO view over every owner's steps across one workflow, an item's workflows, or a whole item-type portfolio, bucketing overdue, due-soon, stalled, awaiting-reviewer, and unblocked steps with a nudge target for each and an optional critical path. Never mutates; pairs with coach-autopilot (which acts on the ready ones) and coach-notify (which sends the nudges).

Use when an auditor wants to run the continuous auditing and agent evaluation — define sourced monitoring measures and thresholds, build and approve the monitoring dashboard, run the recurring monitoring cycle and triage breaches, then sample and grade agent-drafted work from across the requested audit work and raise every agent-quality finding as an owned issue. Continuous Auditing, Monitoring & Agent Evaluations is part of the Audit plugin audit workflows; runs on the canonical Studio schema and resolves the tenant’s Continuous Monitoring & Agent Evaluation workflow. Every write is a human-approved suggestion.

Use when an auditor wants to assess fraud risk and test journal entries for anomalies on the AssureSwarm platform — cover the fraud triangle and management override, map anti-fraud controls to the risks, profile and flag the journal-entry population, draw a reproducible sample, test the selected entries, and raise unsupported anomalies as issues. Audit plugin audit workflows; runs on the canonical Studio schema and resolves the Fraud Risk Assessment & JE Testing template. Every write is a human-approved suggestion.

Use when an auditor wants to test IT general controls for change management and access provisioning on the AssureSwarm platform — reconcile ticket and independent deployment populations, draw reproducible samples, test each ticket against the control's attributes, and conclude on design and operating effectiveness. Audit plugin audit workflows, ITGC Testing: Change Management & Access Provisioning; runs on the canonical Studio schema and selects a pinned ITGC Change & Provisioning Testing release from Workflow Library. Every item, field, link, and workflow write is a human-approved suggestion.

Use when an auditor wants to document how a process actually runs — parse a narrative or interview transcript into steps, actors, systems, and control points, render the flowchart, reconcile control points against linked controls and systems, and raise every design deviation found in the walkthrough as an issue. Process Narratives & Flowcharting is part of the Audit plugin audit workflows; runs on the canonical Studio schema and resolves the Process Narrative & Walkthrough workflow. Every item, field, link, and workflow write is a human-approved suggestion.

Use when an auditor wants to plan an audit and assess risk on the AssureSwarm platform — open the engagement, score the audit universe (processes and financial statement line items), build the engagement risk and control matrix, record the scope rationale, and render the planning memo. Audit plugin audit workflows; runs on the canonical Studio schema and resolves the Audit Planning & Scoping workflow. Every item, field, link, and workflow write is a human-approved suggestion.

Use when an auditor needs to drive open issues to closure — create the remediation actions issues need, attach delivery workflows, assign owners and dates, sweep for overdue and slipping actions, file closure evidence, and record control retest results on the AssureSwarm platform. Audit plugin audit workflows: Issue Remediation. Runs on the canonical Studio schema and resolves the Remediation Delivery & Validation workflow. Every item, field, link, and workflow write is a human-approved suggestion.

Use when an auditor wants to write up findings, grade them against the CCCER rubric, grade severity and SOX deficiency, collect management responses, and issue the audit report — resolves Audit Fieldwork, Findings & Reporting on the audit and Issue Triage & Disposition per issue, drafts rewrites via the audit-workpaper-grader agent against rubrics/issue-writeup.md, and renders the report through coach-render-package --cite behind the redaction gate. Reporting & Issue Management is part of the Audit plugin audit workflows; runs on the canonical Studio schema. Every write is a human-approved suggestion.

Use when an auditor wants to run Sampling, Data Analytics & Substantive Testing on the AssureSwarm platform — validate the test population, choose the sampling method and size, draw a reproducible sample, run whole-population analytics (duplicates, gaps, three-way match) across the extracts, evaluate exceptions under the approved design, and conclude on the FSLI assertion. Audit plugin audit workflows; runs on the canonical Studio schema and resolves the Substantive Testing & Data Analytics workflow. Every item, field, link, and workflow write is a human-approved suggestion.

Auto-loaded internal-audit methodology reference the audit-* modules cite: approved sampling designs and recorded sizing bases, the four selection methods, population and IPE validation, zero-occurrence and replacement rules, exception expansion, design versus operating effectiveness, evidence sufficiency and hierarchy, issue writing in the CCCER format, deficiency grading and aggregation, the control taxonomy, and the map of which module cites which section. Consulted by skills, not conversed with.

Use when an auditor wants to assess vendor and service-organization risk on the AssureSwarm platform — read vendor systems by tier, dispatch the SOC report reader against SOC reports, bridge letters, and contracts, map complementary user entity controls to controls, evaluate report exceptions and contract gaps before proposing supported issues and actions, and set reassessment dates. Audit plugin audit workflows; runs on the canonical Studio schema and resolves the SOC Report, Subservice & CUEC Review and System & Third-Party Risk Review workflows. Every write is a human-approved suggestion.

Use when an auditor wants to run periodic or privileged user access reviews (UARs) and test logical access on the AssureSwarm platform — validate the access-listing population, test management's own review against its five attributes (reviewer authority, timeliness, sign-off, listing completeness, flagged removals), reperform it by reconciling against the HR roster and the system of record, draw the sample, execute the UAR workflow per system, and raise every exception as a tracked issue. Audit plugin audit workflows; runs on the canonical Studio schema and resolves the Periodic User Access Review and Privileged Access Review workflows. Every item, field, link, and workflow write is a human-approved suggestion.