GUARD GRC

Report where a hand-off to a GUARD page stands (an approval, a rejection or a document upload the person finishes in GUARD): pending, checking, done, rejected, cancelled, expired or stale. An upload link stays pending after a refused file while tries_left > 0.

get_handoff_status

Re-run GUARD's classification of one AI system from its latest completed AI-system assessment: risk class, user impact, autonomy, deployer role, data categories, extraterritorial reach, regulatory scope and the per-regime classifications, each with its reasoning. Company overrides stay in force. Input: id, the AI system's id from list_ai_systems. Refused when the system has no completed AI-system assessment or is retired. Needs the owner, editor or consultant role and is counted against the organisation's AI budget. Starts a GUARD job that takes 1–3 minutes and returns its job_id; the new classification replaces the previous one.

classify_ai_system

Mark the plan of a policy or of an attestation document in the current organisation as complete, as the website's "Mark plan complete" does. Give exactly one of policy_id (a policy's implementation plan) or artefact_id (an attestation document's action plan). Needs at least one action item and every item done or dismissed; refused while the plan awaits approval or is already completed. Completing locks every action item, and when the plan has a designated approver it is submitted to that approver for completion approval unless its sign-off has expired (the answer says whether it was). Reopening a completed plan is done in GUARD. Needs the owner, editor or consultant role.

complete_plan

Read the current organisation's AI governance register in GUARD as data, from the records the register PDF export reads: the active AI systems (details, classification, regime classifications, last assessment), the completed assessments, the policies and the current regulator documents of the organisation and its systems in use, each with its sign-off state and GUARD link; retired systems are counted, not listed. In parts under 20,000 characters: part (default 1), and as_of from the first answer for the other parts of the same reading (kept 10 minutes). Any member may read it. The PDF stays a download in GUARD. Text users or GUARD's model wrote comes inside untrusted-input fences.

export_register

Search ONE regulation for the clauses that exclude a type of entity from its scope (exemptions, carve-outs, scope exclusions). Inputs: regulation, a document_id from search_regulations or a short name such as UAE_PDPL, EU_AI_ACT, GDPR, DIFC_REG10 or SAUDI_PDPL (up to 200 characters); entity_attributes, a factual description of the entity such as "DIFC-registered financial services firm", "government entity" or "fewer than 10 employees" (3–500 characters). Returns the candidate exclusion passages; an empty result means no exclusion was found, not that the regulation applies.

find_carveouts

Finish a guided assessment in GUARD. company_setup: saves the answers to the business profile and starts the rewrite of the profile summary. Assessments: checks that every key question is confirmed and the last question answered, closes the conversation and starts the GUARD job that writes the report (with its gaps, duty coverage and, for an AI system, classification); it takes 1–3 minutes and counts against the organisation's AI budget. Returns the job_id, session_id, any prohibited-practice flag and the key answers with the assistant that relayed each. Finishing twice gives one report. Input: conversation_id from start_assessment or list_assessments. Needs the owner, editor or consultant role.

finish_assessment

Prepare a GUARD link where the person uploads one PDF to the current organisation's business profile. The link needs the person's own GUARD sign-in, files one document (a refused file can be replaced on the same page, up to 3 tries) and expires after 15 minutes; the file never passes through the assistant. Input: purpose (optional, up to 200 characters), what the document is, repeated in the reply. Returns the link and a handoff_id for following the upload. Limits: PDF only, up to 20 MB, at most 10 documents per organisation and 10 links per person per hour. Needs the role owner, editor or consultant.

start_document_upload

List the AI systems in the current organisation's AI inventory in GUARD, newest first: id, name, vendor, type, risk class, lifecycle state, the date of the last completed assessment and the sign-off state (given once a system has been assessed). Retired systems are left out unless include_retired is true; the answer says how many were left out. Up to 25 systems per part (fewer when names are long; each answer stays under 20,000 characters): part (default 1) picks one, and the answer gives part and parts. Text written by users comes inside untrusted-input fences.

list_ai_systems

List the gaps GUARD found in one assessment of the current organisation, ordered by GUARD pillar (G Governance, U Unauthorized Data Access, A Attrition of Skills, R Reputation, D Dollar Drain): id, pillar, title, description, regulatory basis, remediation, remediation type (policy, operational or both), risk (red, yellow or green), status, and whether a policy already covers it (how many, and up to 5 of them). Inputs: session_id from list_assessments; category, one pillar letter (optional); part (up to 25 gaps per part, each answer under 20,000 characters). Text written by users or by GUARD's model comes inside untrusted-input fences.

list_gaps

List the current organisation's assessments in GUARD, most recently updated first: session_id, title, started_by_you, scope (company or ai_system) with the AI system, status, whether it was done as a guided conversation or a form, the conversation_id of an unfinished guided one, created, updated and completed dates, whether a report exists, and the sign-off state; and company_setup, your own company setup in progress (its conversation_id; null when none, or with an AI-system filter). Filters: scope, ai_system_id (the id from list_ai_systems). Up to 25 per part (fewer when titles are long; each answer stays under 20,000 characters): part (default 1) picks one, and the answer gives part and parts. Text written by users comes inside untrusted-input fences.

list_assessments

List the team comments on one item of the current organisation in GUARD (an assessment, policy, AI system or attestation), oldest first as GUARD shows them: for each comment its id, the author (the member's name in GUARD), the date and time, the text, and the assistant it was added through when it came from one. Removed comments are left out. Inputs: subject_type and subject_id (the item's id). Up to 25 comments per part (fewer when they are long; each answer stays under 20,000 characters): part (default 1) picks one, and the answer gives part and parts. Comment text and names come inside untrusted-input fences.

list_comments

List the PDF documents on the current organisation's business profile in GUARD (at most 10): file name, when it was uploaded and its size. Storage paths are not shown. GUARD reads these documents when it writes the profile summary.

list_company_documents

List the industry news of GUARD's daily AI-governance briefing, as the Regulatory Radar shows it: the stories of the newest published editions (limit: 1–14 editions, default 14), newest edition first, in the briefing's order. Each story: its date, section (spotlight, governance or signal), title, source address, summary and source. The news is the same for every organisation. Up to 25 stories per part. Texts are inside untrusted-input fences.

list_industry_news

List the GUARD organisations you can use here, with your role, the plan, and which one is current.

list_organisations

What waits on the person in the current organisation, as GUARD's My Action Items page shows it: sign-offs waiting for their approval or review, plan action items assigned to them that are open or in progress, and regulatory updates affecting the organisation that they have not acknowledged; each with ids, state, dates and its GUARD link. Long lists come in parts of under 20,000 characters (part, default 1). Text written by users comes inside untrusted-input fences.

list_my_todos

List the policies of the current organisation in GUARD, as the Policies page groups them: company-wide policies first, then the policies for each AI system (by system name), newest first in each. Per policy: id, title, scope, the AI system (id and name), the assessment it came from (session_id), GUARD categories, how many gaps it addresses, the sign-off state, the implementation plan (actions done of total, dismissed ones counted as done as in GUARD; open, completed or completed and awaiting approval) and dates. Inputs (optional): scope (company or ai_system) or ai_system_id from list_ai_systems; part, up to 25 policies per part, each answer under 20,000 characters. Text written by users or by GUARD's model comes inside untrusted-input fences.

list_policies

List the regulator documents (attestations) of the current organisation in GUARD, grouped as its Attestations page: company-wide first, then per AI system, newest version first. Per version: id, type, version number, whether it is the current one or replaced, the AI system (id, name, retired), sign-off state and dates. Removed documents are left out. Inputs (optional): type (dpia, fria and difc_reg_10_2_2 (per AI system); privacy_notice and ai_transparency_statement (company-wide)); ai_system_id from list_ai_systems; part, up to 25 documents per part. Names come inside untrusted-input fences.

list_regulator_documents

List the regulator response packs of the current organisation in GUARD, newest first: id, template, when it was built and whether a newer pack of the same template superseded it; up to 25 per part (part, default 1). Also lists the six pack templates with their item keys and use_for (the regulators or requests each serves), and the template GUARD suggests for this organisation, as the Hub's Regulator Response Pack section does. The PDFs, their downloads and share links stay in GUARD. For "what could we hand a regulator today?", name the template that fits (use_for) next to what the register shows ready (approved) and thin; ask for the regulator's letter only if it would change that answer.

list_regulator_packs

List the regulatory changes GUARD has published (new AI laws, amendments, consultations), as the Regulatory Radar shows them: the newest 50 (optionally only those published since a date). Each: type, stage (enacted, or consultation = proposed), title, regime, jurisdiction, summary, the GUARD pillars it stresses most, dates, whether it affects the current organisation and why (an AI system not retired is classified under its regime, or the regime is a designated code in force), the affected AI systems (up to 10 named) and whether you acknowledged it. relevant_only (default true) keeps the changes that affect the organisation. Up to 25 per part. Texts are inside untrusted-input fences.

list_regulatory_changes

Prepare a regulator document as a draft in GUARD, as the Attestations page does. Inputs: type (dpia, fria and difc_reg_10_2_2 (per AI system); privacy_notice and ai_transparency_statement (company-wide)); ai_system_id from list_ai_systems (per-system types; not retired); source_assessment_id from list_assessments (optional; default the latest completed one); parent_artefact_id, the current version from list_regulator_documents, to replace it with a new version (needed once one exists). Refused when GUARD does not offer that type for the subject now. Owner, editor or consultant role; counted against the organisation's AI budget. Starts a GUARD job of 1–3 minutes; returns its job_id.

generate_regulator_document

Prepare a one-time GUARD link where the person approves or rejects an item waiting for their decision; the assistant cannot decide. The link needs the person's own GUARD sign-in and a fresh authenticator code, works once and expires after 15 minutes; nothing changes until they confirm. Inputs: subject_type; subject_id; decision, approve or reject; comment (up to 2,000 characters, required to reject). Only for the named approver, or the reviewer while it waits for review; at most 10 links per person per hour.

prepare_signoff_decision

Read where a guided assessment in GUARD stands, without changing it: status, the current question with its options (none when finished), GUARD's suggested answer awaiting the person's confirmation, progress (0–100), whether it is ready to finish, read_only for a role that cannot answer, and version. Input: conversation_id from start_assessment or list_assessments (an assessment or a company setup in progress); include_answers true adds the answered questions, each with the assistant that relayed it, in parts under 20,000 characters (part, default 1). Text from people, documents or GUARD's model comes inside untrusted-input fences.

get_assessment_question

Read one policy of the current organisation in GUARD: title, scope, the AI system it is for, the assessment it came from, created and last-edited dates, the version, the sign-off state and when the implementation plan was completed, and the policy text in parts of up to 18,000 characters (a part ends at a line break, outside code blocks where it can). Inputs: policy_id, the policy's id from list_policies or get_guard_job; part (default 1; the answer gives part and parts). The title and the text come inside untrusted-input fences. The text is changed only in GUARD.

get_policy

Read one regulator document of the current organisation in GUARD: title, type, version, whether it is current, the AI system and source assessment, dates, sign-off state, section warnings, and its text in parts of up to 18,000 characters (a part ends at a line break, outside code blocks where it can). Inputs: id from list_regulator_documents or get_guard_job; part (default 1). The title and text come inside untrusted-input fences. The text is changed only in GUARD.

get_regulator_document

Read what one regulator response pack of the current organisation contains, as recorded when it was built: template, build time, whether it is superseded, the PDF's SHA-256 and sections, the checklist (each item included, partial, not available, provided separately or omitted, with GUARD's detail), counts per status and the embedded documents (kind and title). Inputs: pack_id from list_regulator_packs or get_guard_job; part (default 1) when the answer comes in parts under 20,000 characters. The PDF, its download and share links stay in GUARD. Titles and details come inside untrusted-input fences.

get_regulator_pack

Read one item's sign-off in the current organisation, as its sign-off panel in GUARD shows it: state, approver, reviewer, their title, dates, the approval mode, the steps the person can take now (and why a request is blocked), the active members who can be named (member_id, name, role; 25 per part, by name) and the history, newest first (up to 30 entries: who acted, through which assistant, states, comments; part, default 1). Inputs: subject_type; subject_id. Text written by users comes inside untrusted-input fences.

get_signoff

Read one AI system of the current organisation's inventory: its details (name, vendor, type, version, lifecycle state, description, deployment footprint), GUARD's classification (risk class, user impact, autonomy, deployer role, data categories, prohibited-use screen, extraterritorial reach, regulatory scope, the reasoning per field and which fields carry a company override), the per-regime classifications, the sign-off state and the linked assessments and policies (ids and titles, newest 8 each). Input: id, the AI system's id from list_ai_systems or add_ai_system. Text written by users or by GUARD's model comes inside untrusted-input fences.

get_ai_system

Read the report GUARD wrote for one assessment of the current organisation, as GUARD shows it: title, scope, generated and last-edited dates, version, sign-off state and the report text. Long reports come in parts of up to 18,000 characters, each ending at a line break: part (default 1) picks one, and the answer gives part and parts. Input: session_id from list_assessments. A missing id, or another organisation's, reads as not found; an assessment without a report says so. The report text comes inside an untrusted-input fence.

get_assessment_report

Read the plan of action items of one policy (its implementation plan) or of one attestation document (its action plan) in the current organisation: each item's id, text, owner, deadline, status (open, in_progress, done, dismissed), assignee, the gap it closes and when it was done; the progress counts; whether the plan is completed or awaiting approval (both lock changes); the plan sign-off state and approver; and the organisation members who can be assigned (member_id, name, role; 25 per part, by name). Give exactly one of policy_id (a policy's implementation plan) or artefact_id (an attestation document's action plan). Long plans come in parts (each answer stays under 20,000 characters): part (default 1) picks one. Text written by users or by GUARD's model comes inside untrusted-input fences.

get_implementation_plan

Return the regulation text just before and after one passage, in document order. Regulation text is stored in passages of about 1,200 characters, so one provision can run across several passages. Inputs: the passage's document_id and chunk_index, and range, the number of passages on each side (1–5, default 2).

get_chunk_neighbours

Read how one assessment of the current organisation covers the duties of each regime GUARD keeps an obligation register for (only registers switched on in GUARD): per regime the number of duties addressed, not addressed and not applicable, and each duty not addressed with its article, summary, GUARD pillars and the gap made for it. Inputs: session_id from list_assessments; part (the duties not addressed come in parts, each answer under 20,000 characters). Read only: GUARD works the coverage out with the report. Duty texts come inside untrusted-input fences.

get_duty_coverage

Read the current organisation's business profile in GUARD (description, website, sector, regulator, jurisdictions and GUARD's profile summary). On Foundation it returns only the name and the summary, and says so: the other fields are not shown, not empty.

get_company_profile

Ask for a sign-off in GUARD, as the sign-off panel's Designate approver and Submit for approval do: names the approver (with dual approval also a reviewer) and submits the item to the approver's My Action Items. Inputs: subject_type; subject_id; approver, reviewer (left out: the draft's current ones); title of the approver (up to 120 characters). Only for an item with no sign-off or a draft one; an AI system needs a completed assessment, an assessment its report. Needs the owner, editor or consultant role.

request_signoff

Search the AI regulations GUARD holds (semantic search). Returns the most relevant regulation text passages with their document title, document_id and chunk_index; passages past 20,000 characters in all are left out and counted.

search_regulations

Start a guided assessment in GUARD for the current organisation. kind: company_setup (the business profile fields), company_assessment (the company-wide AI governance questions) or ai_system_assessment (one AI system: ai_system_id from list_ai_systems, retired ones too); title (optional) names it. Your company setup already in progress in this organisation is resumed with its answers, and so is your assessment of the same kind and subject in progress (start_new true starts another), not a new one. When company setups are started at the same moment, GUARD keeps one in progress and marks the others abandoned. GUARD pre-fills later answers from what it knows (up to about 20 seconds), which counts against the organisation's AI budget. Returns conversation_id, session_id, the current question with its options, the pre-filled answers and progress. Needs the owner, editor or consultant role.

start_assessment

Choose which of your GUARD organisations later answers come from. Input: organisation, its name or its id (the id comes from list_organisations).

switch_organisation

Change the current organisation's business profile in GUARD (Business details). Inputs, each optional, at least one: company_name (1–200 characters), website_url (an http:// or https:// address, up to 500 characters), sector and primary_regulator (plain text, up to 200 characters each), jurisdictions (GUARD jurisdiction codes; replaces the whole list) and free_text_description (up to 5,000 characters). An empty string clears a field (not company_name). Only fields that differ are written, and their earlier values are not kept. Needs the role owner, editor or consultant. Returns the changed fields. The profile summary is not rewritten.

update_company_profile

Return an item's sign-off to draft in GUARD: withdraws a request waiting for approval or review, or reopens a rejected or expired sign-off; the approver and reviewer stay named. Inputs: subject_type; subject_id; comment (optional, up to 2,000 characters, kept in the history). Needs the owner, editor or consultant role, or being the item's approver (or reviewer while it waits for review); reopening a rejected one needs one of those roles. An approval is revoked in GUARD, not here.

withdraw_signoff

Write a new GUARD policy for the current organisation from gaps of one of its assessments, as the website's Generate policy does. Inputs: session_id, the assessment's id from list_assessments (its report must be ready); gap_ids, 1 to 50 gap ids of that assessment from list_gaps whose remediation is policy or both (operational gaps are refused); scope (optional): company or ai_system, by default the assessment's own; ai_system_id from list_ai_systems (optional), for a policy about one AI system. Refused while GUARD is already writing a policy for that assessment. Needs the owner, editor or consultant role; counted against the organisation's AI budget. Starts a GUARD job of 1–3 minutes and returns its job_id. The new policy and its implementation plan are added as a draft; the chosen gaps are linked to it and marked in progress.

generate_policy

Write a new GUARD profile summary of the current organisation from its business profile and its PDF documents. An AI job: it uses part of the organisation's AI allowance and replaces the current summary. Returns a job_id at once; the job usually takes 1–3 minutes. One summary job runs per organisation at a time, so a repeated request returns the same job. Needs the role owner, editor or consultant.

generate_profile_summary