Control questions, answered with sources
Whether it's an auditor or an account exec with a security questionnaire, answers come from your control library with citations — consistent, current, and fast.
AI for Risk & Compliance teams
Evidence on demand — for the controls you already run.
The Risk & Compliance pack answers control and policy questions with citations, assembles audit evidence from your systems, and tracks regulatory change — turning compliance from a scramble into a query.
Connects to Archer · ServiceNow GRC · Snowflake — plus anything with an API
audit/verify
ok: true
verifyChain ▸ chained SHA-256 · signed receipts
Day one
What risk & compliance teams see when they log in.
Not a blank canvas — a working role with default goals, allowed tools, and the guardrails already on.
Evidence that assembles itself
Audit requests trigger evidence gathering across connected systems — access reviews, change logs, policy attestations — packaged with provenance on every artifact.
Regulatory change, watched
Changes in the frameworks you track surface with an impact read: which controls are touched, which policies need review, who owns the gap.
Skills invoked · governed by policy & licensing
knowledge.searchcompliance.check_policyrisk.assessdata.summarize
Systems
ArcherServiceNow GRCSnowflake
In the pack
The Risk & Compliance Agent ships ready to work.
Searches approved policy, assesses supplied risk context, and summarizes evidence provided for review. Installed from the library, wired to your systems, and run through the same 8-gate chain as everything on Cortex.
- Search approved policy knowledge
- Check supplied context against policy
- Assess supplied risk context
- Summarize evidence provided
Governed for this role
The compliance function, running on provable rails itself.
Your GRC agents run on the same governed runtime they help you attest to — every evidence pull cited, every answer traceable, every run sealed in the same tamper-evident ledger you show the auditor.
- Evidence artifacts carry 10-hop provenance to their source
- Control answers cite the control library version used
- Agent access to systems scoped read-only by default
- The ledger the auditors inspect includes the agents' own work
audit/verify
ok: true
verifyChain ▸ chained SHA-256 · signed receipts
FAQ
What risk & compliance leaders ask.
Will auditors accept agent-assembled evidence?
The evidence carries what auditors ask for: source, timestamp, chain of custody — 10-hop provenance sealed in a tamper-evident ledger they can verify. The agent assembles; the artifacts prove themselves.
How does regulatory change tracking work?
You name the frameworks; the agent watches for changes and maps them to your control library — surfacing which controls and policies are affected and routing the review to the named owner.
What GRC systems does it connect to?
Archer and ServiceNow GRC drivers ship in the catalog, plus Snowflake for evidence data — with the generic REST driver covering the rest.
Keep exploring
Where to go next.
Agent Library
Every Risk & Compliance agent and skill, filterable across the 21,500+ item catalog.
All roles
Ten more enterprise role packs — from Service to Field Operations.
Agent Studio
Extend the pack or build your own role — no code, full governance.
Pricing
Individual, Team, and Business — governance included on every plan.
Put a governed Risk & Compliance to work this week.
Start a free trial, install the pack, and connect your systems — or bring us one workflow and we'll demo it end to end.