HR plugin

Use when the user asks how the platform works, requests a task walkthrough, wants a term defined, or needs a sourced explanation of an error.

Use when the user asks to run or dry-run an autopilot pass over their assigned-step queue. A headless driver uses the verified tenant/user privileges, bounded scan and dependency-ready execution procedures to draft suggestions, report missing inputs and retain pending work. It never approves or repeats already handled steps. Scheduling requires a verified host scheduler; a manual pass does not.

Use when the user asks to offboard an owner, reassign work across a person's records or steps, or prepare a cross-record handoff report. Resolve the live tenant schema and exact scope; propose changes through native suggestions. Reassigning one issue or item uses coach-item-update.

Use when the user asks to build, create, design or make a new custom dashboard, report page or live chart that no existing dashboard or view provides. Builds a live artifact dashboard: a page the host publishes with access to the AssureSwarm connector, whose sections read the tenant through the MCP's query_data whenever someone opens it, with that viewer's own permissions. Needs a host that can publish such a page. Setting the variables of an existing dashboard uses coach-dashboard-view; a question or show-me request uses coach-dashboard-link.

Use when the user asks to view or link a dashboard, discover available dashboards, show a filtered dashboard, or answer a question about overdue issues, workflow progress, owner workload, project coverage, template usage, vendor reassessments, risk treatment, policies or requirements. A view with chosen variables uses coach-dashboard-view; a new custom dashboard uses coach-dashboard-build. Creating an item, starting a workflow and exporting records use their own skills.

Use when the user asks to build, create, save, set up or adjust a view of an existing dashboard: a named dashboard with chosen variables such as scope, range, year, project, table filters, search, sort, focus or templates. Checks the variables that dashboard reads, decides each value the request supports, asks once about anything uncertain, and returns a link that keeps the view. Read-only; a view is a link, not a stored record. A question or plain show-me request uses coach-dashboard-link; a new custom dashboard uses coach-dashboard-build.

Use when the user asks to upload, attach, replace, or file a document or evidence on a workflow step, an item's DOCUMENT field, or a workflow template step, or to link an external document URL on a step or template step. Uploads store bytes immediately; URL references become stepdocumentlink or workflowtemplatestepdocumentlink suggestions. Resolves the destination and returns the stored document id for form file fields.

Use when the user asks to export an item's evidence package, a selected set of items, or a tenant archive. Preserve the requested item scope, include relevant workflows and documents, and verify redaction before shareable output. Exporting one specific workflow uses coach-workflow-export. Raw archives require an authorized private destination.

Use when the user asks to create, add, build, or design a workflow-step form for missing inputs from someone who is not executing the workflow or step. Executor work belongs in step results. Validates field definitions and proposes the schema through suggest_change; filling an existing form is coach-form-fill.

Use whenever the user asks to populate, pre-fill, fill out, draft, or submit values for an existing step form. Proposes values via the submit_form action so the assignee sees the AI-suggested fill on the form page and can edit then submit in one click. Never use action update with form.values for fills — that lands the preview in the schema-diff UI on the step viewer instead of the form page.

Use whenever the user asks to create, add, draft, or open a new item of a known type (e.g., audit, risk, control, issue, policy, process). Works for any admin-configured item type: reads the type's schema via get_schema, fills every field the request supports (for example a control's type from what the control does), confirms any uncertain value with the user before submitting, validates values against field definitions, and submits a single suggest_change action create suggestion for human approval.

Use whenever the user asks to update, change, edit, set, rename, correct, or archive an existing item (e.g., change a risk's owner, move the project to execution, archive a retired control). Works on any admin-configured item type: resolves the item by id or by type plus title search, shows the current values of the targeted fields, validates new values against the field definitions from get_schema, and submits a single suggest_change action update suggestion for human approval.

Use whenever the user asks to link, relate, connect, or tie one item to another (an audit to a risk, an issue to a control) — or to unlink one. Resolves each side by id or title, validates the kind (parent, child, sibling, related), and submits one itemrelationship suggestion via suggest_change for approval; --unlink mirrors the flow with a delete.

Use when the user asks to prepare a stakeholder notification, nudge, reminder or distribution list about an AssureSwarm item or step. Resolve recipients from verified tenant fields and available directories, redact the draft and create it through the actual mail-draft operation when available. Without one, return copyable text or an artifact; never claim that a draft was sent.

Execute a read-only GraphQL query against the AssureSwarm tenant via the query_data MCP tool. Translates a natural-language data request into a valid GraphQL query against the platform's queryReference catalog, runs it, and presents the results in a clean format. Handles pagination, full-text search, structured filters, and csv/jsonl export for large results. Use whenever the user asks to find, list, search, count, look up, or export items, workflows, steps, users, or any other queryable resource in the tenant. If the user says show me, where do I see, or take me to, and a system dashboard covers the ask, coach-dashboard-link goes first; use this skill for the data itself or when no dashboard fits. Any ask that walks two or more links in one go — an item to its workflows, their steps, the items linked to those steps, the templates those items use, the runs of those templates — is a graph traversal: run it as ONE universeFocus path-mode query, never a chain of per-item reads.

Use when the user asks to redact, scrub, or sanitize a staged directory of outbound content before export — the standalone entry point for ad-hoc redaction passes, and the plugin's single redaction engine: every skill that produces shareable output runs this same pass inline before anything leaves the workspace. Deterministic internal-only patterns are auto-removed, ambiguous ones surfaced for user confirmation, and a redact report written. Build-list rows 7, 30.

Use when an assembled document package leaves AssureSwarm — board decks, regulator attestations, 302/906 certification packages, project reports. Renders markdown to docx+pdf via pandoc, hard-gates through the /coach-redact redaction pass (halts on needs_user), packages the cleared artifacts, and hands distribution to /coach-notify. --cite binds claims to live AssureSwarm records. Section composition lives in the covering assureswarm.com/workflows workflows.

Use when the user asks to design, plan, or draft an AssureSwarm schema — figuring out what item types and fields to set up for their domain; to add fields to an existing item type; to add a single new item type to an existing schema; to build the options for a SELECT or MULTISELECT field — an enum-style option list such as severity, status, frequency, regulators, regions, or audit-phase; or to export, back up, dump, or diff the current tenant's schema, or migrate it to another tenant. Five modes on one skill: the full design interview by default, plus --add-field, --add-type, --options, and --export for incremental changes.

Use when the user asks to validate, lint, or check a schema JSON file before pasting it into the Bulk Import admin page. Lints against the platform's bulk-import format — catching missing data wrapper, slug collisions, invalid field types (including the retired RELATION / RELATIONS), missing required keys, leftover relatedItemTypeSlug keys, and search-flag combinations rejected at import — and reports every issue with file path and field path.

Use when the user asks to prepare a security incident or vulnerability report for AssureSwarm. Collects sourced facts, separates observations from uncertainty, redacts the evidence, and prepares a reviewable draft through an available mail or artifact tool. Creating an incident record in the user's own tenant uses coach-item-create.

Use when the user asks to connect or configure the plugin for a tenant, refresh its connection details, or verify that the connected tenant supports the requested work.

Use when the user requests the current Studio starter schema or a checked bulk-import preview from an explicitly supplied JSON file.

Use when the user asks to open, file, or raise a support ticket with AssureSwarm support because something is broken or blocking work; to reply to, follow up on, or update an existing support thread in Gmail; to check, list, or review the status of their support tickets and see which threads are waiting on them; or to send product feedback, a feature request, or an improvement idea for AssureSwarm.

Use when the user asks for an orientation to the platform, its Studio item types, or the skills available for their role.

Use whenever the user asks to assign, schedule, set deadlines, or pick approvers for the steps of a workflow. Sets approvers and due dates on a workflow instance via suggest_change against the step target — walking the steps, resolving users by name or email to user ids, and submitting one update suggestion per step that sets the approvers array and dueDate field.

Use whenever the user asks to attach, instantiate, apply, or run a workflow on an item. Resolve the parent, intended cycle and tenant template, reuse compatible existing or pending work, and propose a new instance only after a complete fresh no-match. Public source identity is distinct from tenant IDs.

Use when the user wants to add, edit or remove a step in an existing workflow, change its dependency graph, or author a new one-off workflow or reusable template. Resolve actual stored IDs and the current schema before proposing supported step create/update/delete or revision-bound graph changes. Use coach-workflow-attach for an existing template and coach-workflow-execute to perform an existing step.

Use when the user asks to resume an existing workflow, including when no step has been selected, or to execute, run, work on, complete, or do a workflow step. Applies to interactive and headless requests.

Use whenever the user asks to export, download, archive, snapshot, or bundle a workflow's data. Gathers the complete data of a workflow instance — every step's result, every form's submitted values, every uploaded or linked document — into a local directory: walks the workflow via query_data, downloads attached documents via download_document, and writes a structured local package the operator can archive or share. Read-only; never mutates the workflow.

Use when the user asks what to work on, to triage a queue, as the scan phase of an autopilot run — or to check progress across a portfolio or cycle, find stalled or overdue work, see what is at risk, or name who to nudge. Read-only in both directions. Mine mode classifies the current user's assigned steps into four doer-states plus an awaiting-my-approval line; sweep mode is the lead/PMO view over every owner's steps across one workflow, an item's workflows, or a whole item-type portfolio, bucketing overdue, due-soon, stalled, awaiting-reviewer, and unblocked steps with a nudge target for each and an optional critical path. Never mutates; pairs with coach-autopilot (which acts on the ready ones) and coach-notify (which sends the nudges).

Use when HR needs to select or execute recruiting, onboarding or offboarding workflows in the company's AssureSwarm instance, with restricted personnel information, authorized decisions and HR-to-IT handoffs.