Skip to content

Audit Copilot

Path: /audit-copilot

The Audit Copilot is a guided, stepper-plus-chat workspace for running a framework audit end-to-end. It builds a plan from the real control catalog, answers questions grounded in your tenant's actual data, drafts remediation and policy text, and — unlike a chat bot — can take agentic actions against the platform's real engines, with every result labelled by source.

Guided plan

POST /api/v1/orgs/{org_id}/copilot/plan builds one step per control theme (e.g. ISO 27001's Organizational / People / Physical / Technological), bookended by a scoping step and a final audit-package step. Progress per step is always recomputed from real control state, never taken from stored session data. Linking an assessment enriches the plan with live verdict-derived progress.

Two experience modes

The mode changes the plan itself, not just its wording:

Mode Who it's for What changes
new First-audit users Guided hand-holding actions on every step, more explanation
seasoned Experienced auditors Agentic engine actions per step, plus a deterministic cross-framework delta computed from the org's existing framework work, and recommended_step_id jumps straight to the first step with real gaps

Persisted sessions

Sessions store the framework, mode, linked assessment, per-step notes and done-markers, accepted drafts, and a bounded action log — so an audit engagement survives the browser tab.

POST   /api/v1/orgs/{org_id}/copilot/sessions                    # create
GET    /api/v1/orgs/{org_id}/copilot/sessions                    # list (newest activity first)
GET    /api/v1/orgs/{org_id}/copilot/sessions/{id}               # resume (stored state + fresh plan)
PATCH  /api/v1/orgs/{org_id}/copilot/sessions/{id}               # change mode / step / assessment
PUT    /api/v1/orgs/{org_id}/copilot/sessions/{id}/steps/{step}  # step notes / done-marker
POST   /api/v1/orgs/{org_id}/copilot/sessions/{id}/drafts        # save an accepted draft
POST   /api/v1/orgs/{org_id}/copilot/sessions/{id}/act           # run an agentic action

Agentic actions

POST .../act runs one action against the real engines — results carry a source label and citation, and the outcome is appended to the session's action log:

  • pull_finding — the tenant's latest real finding/verdict for a control. Deterministic and cited; no LLM involved.
  • draft_and_save_remediation — AI-drafts remediation and saves it to the real finding. Gated on the finding:update permission (same as the findings PATCH endpoint). Offline template drafts are returned but never auto-saved.
  • run_delta — the deterministic cross-framework delta engine against the session's framework (crosswalk layer, no LLM).

Ask & draft

  • POST .../ask — grounded Q&A about the framework and your current state.
  • POST .../draft — iterative remediation/policy drafting with a feedback-and-redraft loop.

Prerequisites & honest fallbacks

AI-generated answers and drafts need a configured LLM provider (see AI Audit for the LLM_PROVIDER options). Without one, the copilot falls back to honest deterministic templates stamped model: "fallback" — clearly offline output, not AI, and never presented as a model's work. The deterministic features (plan, pull_finding, run_delta, sessions) work fully without any LLM.