VComply

Builds a Policy Workroom deep-link URL for a policy (LOGIN_URL origin + /policyops/register/policies/{polid}?v={versionId}). Use when: the user asks to open, go to, or get a link to a policy workroom after identifying it via get_policies or search_policies. Do not use when: answering what the policy says (content Q&A is not available yet) or listing/searching policies. Prerequisites: policyId (numeric id or slug) from get_policies or search_policies. Next step: share workroomUrl with the user so they can open it in the browser. Safety boundary: read-only URL composition — never use for mutations.

get_policy_workroom_url

Fetches the responsibility record and metadata for a specific responsibility by ID, including fields like title, notes, objective, assignees, risk class, linked entities, and configuration. Use when: the user asks for details, metadata, notes, objective, assignees, risk class, or configuration of a known responsibility. Do not use when: answering due-date, deadline, or schedule questions (use responsibility_due_dates), or when the responsibility ID is unknown (call responsibilities first). Prerequisites: numeric responsibilityId from responsibilities when the user only provided a name/title. Next step: call responsibility_due_dates if the user then asks about deadlines. Safety boundary: read-only — never use for completing work or adding comments.

responsibility_details

Fetches due dates, deadlines, and open due-date items for a specific responsibility, resolved to the authenticated user as assignee. Use when: the user asks when a responsibility is due, for deadlines, schedules, open due dates, or overdue timing for a known responsibility. Do not use when: answering general metadata questions (use responsibility_details), or when the responsibility ID is unknown (call responsibilities first). Prerequisites: numeric responsibilityId from responsibilities when the user only provided a name/title. Next step: none for schedule answers; only call mutation tools if the user explicitly asks to complete or comment. Safety boundary: read-only schedule lookup — never use for completing work or adding comments.

responsibility_due_dates

Returns Always Notify (success) and Notify on Failure (fail) overseer userId and userGroupId lists for one responsibility. Use when: the user asks who oversees one known responsibility. Do not use when: listing responsibilities, due dates, completing work, or preparing a program or responsibility-center overseer change. Those update tools load current overseers themselves. Prerequisites: numeric responsibilityId from responsibilities when only a title was given. Next step: update_always_notify_oversight or update_notify_on_failure_oversight. Those tools preview replace, add, and remove and write only after confirm. Safety boundary: read-only.

get_responsibility_overseers

Lists organization users with optional status (active/inactive), license (power/light), and searchTerm filters (paginated recipe=aud). Use when: the user explicitly asks to list, search, or browse the org directory (e.g. "find Mark", "show Power users", "list active users"). Do not use when: only asking who the current signed-in user is (use current_user). Do not use when: adding a responsibility comment with @mentions — add_responsibility_comment resolves @tags itself via recipe=aumd; calling get_users first is unnecessary and wrong for that flow. Prerequisites: none. Next step: use returned user ids with get_policies ownerId/authorId filters or overseer update tools. Safety boundary: read-only directory lookup — never use for mutations.

get_users

Lists policies with status, owner, review date, and linked controls count. Does not return policy body content. Use when: the user is exploring the policy library, filtering by workflow status (published, draft, in review, in approval, approved, rejected), category, RC, owner, or author. Do not use when: the user provides a keyword/topic to search (use search_policies), or needs full content for a known policy (use get_policy_detail). Prerequisites: none. Prefer this as the first call for browsing. Resolve owner/author names with get_users when needed. Next step: call get_policy_detail with a policy id/slug, get_policy_workroom_url for a portal link, or get_policy_acknowledgment_status for attestation stats. Safety boundary: read-only discovery — never use for mutations.

get_policies

Lists compliance programs available to the authenticated user, including each program ID, name, type, active status, and owners. Use when: the user asks for available programs, program names, or a program ID (for example "find program X" or "which programs do I have"). Do not use when: listing responsibilities, responsibility centers, due dates, or performance stats. Prerequisites: none. Next step: after selecting a program ID, call compliance_performance with entity="program", or responsibilities with programId to list linked responsibilities. Safety boundary: read-only discovery — never use for completing work or adding comments.

programs

Lists compliance responsibilities for the authenticated user, including linked program IDs/names on each item. Use type to filter: active (all active), not_completed (failed assignee work status), upcoming (pending), or overdue (delayed). Optional programId narrows to responsibilities under one program — resolve the program name with programs first (e.g. "all ISO 27001 responsibilities"). Use when: the user asks to find, search, list, or look up responsibilities, including by program. Do not use when: the numeric responsibility ID is already known and the question is only about metadata (use responsibility_details) or only about deadlines (use responsibility_due_dates). Prerequisites: none for general list; call programs first when filtering by program name. Prefer this as the first step whenever the user gives a title/name instead of an ID. Next step: call responsibility_details for general metadata, responsibility_due_dates for schedule questions, or overseer update tools after collecting ids. Safety boundary: read-only discovery — never use for completing work or adding comments.

responsibilities

Lists responsibility centers available to the authenticated user, including each center ID, rcid, name, status, origin, and parent. Use when: the user asks for available responsibility centers, center names, org units, or a responsibility center ID. Do not use when: listing responsibilities, programs, due dates, or performance stats. Prerequisites: none. Next step: after selecting a responsibility center ID, call compliance_performance with entity="responsibility_center" for performance questions. Safety boundary: read-only discovery — never use for completing work or adding comments.

responsibility_centers

Marks an open due date as completed for a responsibility assigned to the authenticated user. When only one open due date exists it is completed automatically. When multiple open due dates exist, returns them for confirmation — call again with dueDateId. Optional comment is plain text; include URLs inline (e.g. "Reviewed https://example.com") or pass links [{ href }] to append them. No HTML hyperlinks. @mentions are not supported on complete. Optional evidenceFileRefs attach confirmed uploads via the evidence upload side-channel (request_evidence_upload → confirm_evidence_upload). Do not pass file content or Base64. Use when: the user explicitly asks to complete, mark done, close, or finish a responsibility / due date. Do not use when: the user is searching, listing, reviewing details, checking due dates, or asking about performance — those are read-only flows. Prerequisites: numeric responsibilityId (from responsibilities if only a name was given). Optional dueDateId, comment, links, evidenceFileRefs. Next step: if confirmation_required is returned, call again with the selected dueDateId. If evidence is needed first, call request_evidence_upload then confirm before completing. Safety boundary: write/mutation tool — never select for search or read-only prompts.

mark_responsibility_complete

Requests a short-lived browser upload session for responsibility evidence or comment attachments. Returns hostAction=open_upload_page with uploadPageUrl and sessionId — the user opens the link in a browser and uploads the file there. Never pass Base64 or file content. After the page shows success, call get_evidence_upload_status or confirm_evidence_upload with sessionId. purpose=evidence (default): after confirm, pass evidenceFileRefs to mark_responsibility_complete. purpose=attachment: after confirm, pass attachmentFileRefs to add_responsibility_comment. Use when: the user needs to attach a file before completing a responsibility or adding a comment. Do not use when: listing or reading responsibilities without an explicit upload request.

request_evidence_upload

Full-text keyword search across the policy library. Returns a relevance-ranked list of matching policies. Use when: the user provides a keyword or topic rather than a specific policy name (e.g. password security, data residency). Do not use when: browsing/filtering by workflow status without keywords (use get_policies instead). Prerequisites: non-empty query string. Next step: call get_policy_detail for a selected result id/slug, or get_policy_workroom_url to open it in Policy Workroom. Safety boundary: read-only discovery — never use for mutations.

search_policies

Previews and then updates the Always Notify (success) overseer slot. The first call returns confirmation_required and does not write. Call again with confirm true and mode replace, add, or remove. Or pass decisions [{ responsibilityId, mode }] so each responsibility can differ. Ids omitted from decisions are not written. replace writes the given userId and userGroupId lists. add unions those ids onto the current slot. remove subtracts them. Empty replace clears that side. Empty add or remove leaves that side unchanged. Notify on Failure is returned as otherSlot and is left unchanged. Pass programId and/or responsibilityCenterId to load current overseers from the internal responsibilities report. Resolve names with programs or responsibility_centers first. When those ids are omitted, pass responsibilityIds. Current overseers are read from each responsibility record. Use get_responsibility_overseers only to answer who oversees one known responsibility. Use when: the user explicitly asks to set, add, remove, or clear Always Notify overseers. Do not use when: reading one responsibility (use get_responsibility_overseers) or changing Notify on Failure (use update_notify_on_failure_oversight). Safety boundary: write/mutation — no write until confirm is true.

update_always_notify_oversight

Previews and then updates the Notify on Failure (fail) overseer slot. The first call returns confirmation_required and does not write. Call again with confirm true and mode replace, add, or remove. Or pass decisions [{ responsibilityId, mode }] so each responsibility can differ. Ids omitted from decisions are not written. replace writes the given userId and userGroupId lists. add unions those ids onto the current slot. remove subtracts them. Empty replace clears that side. Empty add or remove leaves that side unchanged. Always Notify is returned as otherSlot and is left unchanged. Pass programId and/or responsibilityCenterId to load current overseers from the internal responsibilities report. Resolve names with programs or responsibility_centers first. When those ids are omitted, pass responsibilityIds. Current overseers are read from each responsibility record. Use get_responsibility_overseers only to answer who oversees one known responsibility. Use when: the user explicitly asks to set, add, remove, or clear Notify on Failure overseers. Do not use when: reading one responsibility (use get_responsibility_overseers) or changing Always Notify (use update_always_notify_oversight). Safety boundary: write/mutation — no write until confirm is true.

update_notify_on_failure_oversight