bulk_create_responsibilities
ChatGPTCreates responsibilities from rows the client pasted (spreadsheet, notepad, or chat). Resolves assignor, assignees, groups, programs, and responsibility centers to existing ids. Does not call get_users, programs, or responsibility_centers first. Mandatory on every row: title, a complete frequency object, assignor, and at least one assignee user or group. Optional names must also match an existing id. key is only 0 or 1 (key responsibility or not), never a row number. riskClass is only 1, 2, 3, or 4. assignee.type and responsibilityCenter.type are optional: any or all. Omit either one to default to any. When the user says all, send all and do not rewrite it to any. reviewer.type is optional: sequential or any. Omit it to default to sequential. When the user says any, send any and do not rewrite it to sequential. When a reviewer is selected, reviewer.frequency.completeBy and reviewer.frequency.endAfter are both required integers. When evidence.required is 1, include one or more http(s) links. If links are missing, ask the client to add links or set required to 0. Before confirm, ask the client about every missingOptional field. They can provide a value or approve leaving that field out. Do not confirm while issues remain. The first call returns confirmation_required and does not post. If a name is missing or ambiguous, ask the client and call again with the correction. After the client confirms, call again with confirm true and the same jobId. Posts at most 50 responsibilities per request. Every request in the job uses that jobId and expectedCount equal to the full row count. Frequency types: daily, weekly, monthly, quarterly, biannual, yearly, one_time, on_going. The tool builds the nested repeatOptions payload. The 12th of every month is frequency type monthly and day 12. The posted frequency keeps that day on frequency, not inside repeatOptions. Monthly repeatOn can select any months, such as 001100110110. Omit repeatOn to mean every month, stored as 111111111111. Do not send repeatOn "12". every is only 1, 2, or 3: every day, every 2 days, or every 3 days for daily; every week, every other week, or every 3 weeks for weekly; every year, every 2 years, or every 3 years for yearly. Weekly repeatOn is Monday through Sunday, and more than one day may be selected. Month repeatOn is January through December. startFrom and endBy are posted under repeatOptions.lifecycle. endBy is optional on every frequency. Daily always posts startBefore 0. one_time always posts endAfter 1. time, startBefore, and endAfter are optional on quarterly, biannual, and yearly. on_going reminder is weekly, monthly, quarterly, yearly, or null, plus lifecycle.startFrom. Use when: the user explicitly asks to create responsibilities in bulk from supplied rows. Do not use when: listing, updating overseers, commenting, or completing existing work. Safety boundary: write/mutation — no POST until confirm is true and every row is valid.
compliance_performance
ChatGPTFetches compliance performance for a single entity and ID. Set entity to "program" for a program ID or "responsibility_center" for a responsibility center ID. Returns performance as [completedOnTime, completedWithDelay, notCompleted] numeric ratios from V-Comply, or null when no linked responsibilities exist. When no responsibilities are linked to the selected entity, performance is null and a note explains that performance data is unavailable — tell the user explicitly rather than guessing. Use when: the user asks for compliance performance, completion rates, or on-time/delayed/not-completed stats for a program or responsibility center. Do not use when: listing programs or centers, fetching responsibility metadata, or answering due-date questions. Prerequisites: resolve the numeric ID first with programs (entity="program") or responsibility_centers (entity="responsibility_center"). Next step: none for the performance answer itself; use responsibilities if the user then wants individual items. Safety boundary: read-only — never use for completing work or adding comments.
confirm_evidence_upload
ChatGPTConfirms a finished browser upload. Pass sessionId after the user completes uploadPageUrl. Returns a ready fileRef for mark_responsibility_complete (evidenceFileRefs) or add_responsibility_comment (attachmentFileRefs). Does not accept file content or Base64. Fails with UPLOAD_NOT_READY if the page has not finished uploading. Use when: the upload page reported success and you need a fileRef for complete/comment. Do not use when: the user has not finished the browser upload yet (poll get_evidence_upload_status instead).
current_user
ChatGPTReturns the authenticated user profile, including orgUserId for mapping assignee and userRole fields across compliance entities. Use when: the user asks who they are, needs their org user ID, or an assignee/userRole field must be mapped to a person. Do not use when: searching or listing responsibilities, programs, responsibility centers, performance, due dates, or other compliance records. Prerequisites: none. Next step: use responsibilities, programs, or responsibility_centers for compliance discovery. Safety boundary: read-only identity helper — never treat this as compliance search.
get_evidence_upload_status
ChatGPTReturns pending/ready/expired/failed for an evidence upload session. Poll with sessionId until ready after the user finishes uploadPageUrl. Metadata only — no file bytes. Use when: waiting for the browser upload page to complete before confirm_evidence_upload. Do not use when: listing responsibilities or other non-upload questions.
get_policies
ChatGPTLists policies with status, owner, review date, and linked controls count. Does not return policy body content. Use when: the user is exploring the policy library, filtering by workflow status (published, draft, in review, in approval, approved, rejected), category, RC, owner, or author. Do not use when: the user provides a keyword/topic to search (use search_policies), or needs full content for a known policy (use get_policy_detail). Prerequisites: none. Prefer this as the first call for browsing. Resolve owner/author names with get_users when needed. Next step: call get_policy_detail with a policy id/slug, get_policy_workroom_url for a portal link, or get_policy_acknowledgment_status for attestation stats. Safety boundary: read-only discovery — never use for mutations.
get_policy_acknowledgment_status
ChatGPTReturns attestation completion status for a policy — acknowledged, pending, overdue, and totals. Optionally includes a user list for privileged callers. Use when: compliance managers ask how many people acknowledged a policy, who is pending, or who is overdue. Do not use when: listing or searching policies (use get_policies / search_policies) or reading policy content (use get_policy_detail). Prerequisites: policyId from get_policies or search_policies (numeric id or slug). Next step: none for the attestation answer itself. Safety boundary: read-only — never use for mutations. User lists are role-gated.
get_policy_answer
ChatGPTReturns plain-text policy section content for Q&A. Does not load the entire document into the model in one shot — use section crawl. Section crawl (preferred for thorough answers): (1) get_policy_sections (2) get_policy_answer with sectionIds for relevant headings (up to 8) and the user question (3) if truncated, repeat with the next sectionIds until enough context. Keyword shortcut: pass question only to auto-pick top matching sections (weaker for cross-section questions like leave calendars). Use when: the user asks what a policy says about a topic, leave entitlements, dates, or any body content. Do not use when: only listing section titles (use get_policy_sections) or opening the workroom (use get_policy_workroom_url). Prerequisites: policyId from get_policies or search_policies. Next step: synthesize an answer from matchedSectionContent and ALWAYS append sectionDeepLinkUrl (or portalUrl). If truncated is true, fetch more sectionIds. If error is NO_CONTENT_INDEXED, redirect the user to portalUrl. Safety boundary: read-only — never use for mutations.
get_policy_detail
ChatGPTFetches a full policy record including content summary (plain text), linked controls, attestation stats, and optional version history. Use when: the user asks about a specific policy by name/id after it was identified via get_policies or search_policies. Do not use when: browsing the library (use get_policies) or keyword search (use search_policies). Prerequisites: policyId (numeric id or slug) from get_policies or search_policies. Next step: get_policy_acknowledgment_status for attestation completion; get_policy_workroom_url for a portal link; if contentSummary is null, tell the user content is not indexed and share portalUrl. Safety boundary: read-only — never use for mutations.
get_policy_sections
ChatGPTFetches the section structure (titles/levels/previews) of a policy body without returning the full document. This is step 1 of section-crawl Q&A. Use when: the user asks what sections a policy has, or before reading body content for a thorough answer (leave rules, entitlements, multi-section topics). Do not use when: only needing a workroom link (use get_policy_workroom_url). Prerequisites: policyId from get_policies or search_policies. Next step: call get_policy_answer with sectionId or sectionIds from this list (batch up to 8). If truncated, call again with the next section ids. If error is NO_CONTENT_INDEXED, share portalUrl. Safety boundary: read-only — never use for mutations.
get_policy_workroom_url
ChatGPTBuilds a Policy Workroom deep-link URL for a policy (LOGIN_URL origin + /policyops/register/policies/{polid}?v={versionId}). Use when: the user asks to open, go to, or get a link to a policy workroom after identifying it via get_policies or search_policies. Do not use when: answering what the policy says (content Q&A is not available yet) or listing/searching policies. Prerequisites: policyId (numeric id or slug) from get_policies or search_policies. Next step: share workroomUrl with the user so they can open it in the browser. Safety boundary: read-only URL composition — never use for mutations.
get_responsibility_overseers
ChatGPTReturns Always Notify (success) and Notify on Failure (fail) overseer userId and userGroupId lists for one responsibility. Use when: the user asks who oversees one known responsibility. Do not use when: listing responsibilities, due dates, completing work, or preparing a program or responsibility-center overseer change. Those update tools load current overseers themselves. Prerequisites: numeric responsibilityId from responsibilities when only a title was given. Next step: update_always_notify_oversight or update_notify_on_failure_oversight. Those tools preview replace, add, and remove and write only after confirm. Safety boundary: read-only.
get_users
ChatGPTLists organization users with optional status (active/inactive), license (power/light), and searchTerm filters (paginated recipe=aud). Use when: the user explicitly asks to list, search, or browse the org directory (e.g. "find Mark", "show Power users", "list active users"). Do not use when: only asking who the current signed-in user is (use current_user). Do not use when: adding a responsibility comment with @mentions — add_responsibility_comment resolves @tags itself via recipe=aumd; calling get_users first is unnecessary and wrong for that flow. Prerequisites: none. Next step: use returned user ids with get_policies ownerId/authorId filters or overseer update tools. Safety boundary: read-only directory lookup — never use for mutations.
mark_responsibility_complete
ChatGPTMarks an open due date as completed for a responsibility assigned to the authenticated user. When only one open due date exists it is completed automatically. When multiple open due dates exist, returns them for confirmation — call again with dueDateId. Optional comment is plain text; include URLs inline (e.g. "Reviewed https://example.com") or pass links [{ href }] to append them. No HTML hyperlinks. @mentions are not supported on complete. Optional evidenceFileRefs attach confirmed uploads via the evidence upload side-channel (request_evidence_upload → confirm_evidence_upload). Do not pass file content or Base64. Use when: the user explicitly asks to complete, mark done, close, or finish a responsibility / due date. Do not use when: the user is searching, listing, reviewing details, checking due dates, or asking about performance — those are read-only flows. Prerequisites: numeric responsibilityId (from responsibilities if only a name was given). Optional dueDateId, comment, links, evidenceFileRefs. Next step: if confirmation_required is returned, call again with the selected dueDateId. If evidence is needed first, call request_evidence_upload then confirm before completing. Safety boundary: write/mutation tool — never select for search or read-only prompts.
programs
ChatGPTLists compliance programs available to the authenticated user, including each program ID, name, type, active status, and owners. Use when: the user asks for available programs, program names, or a program ID (for example "find program X" or "which programs do I have"). Do not use when: listing responsibilities, responsibility centers, due dates, or performance stats. Prerequisites: none. Next step: after selecting a program ID, call compliance_performance with entity="program", or responsibilities with programId to list linked responsibilities. Safety boundary: read-only discovery — never use for completing work or adding comments.
request_evidence_upload
ChatGPTRequests a short-lived browser upload session for responsibility evidence or comment attachments. Returns hostAction=open_upload_page with uploadPageUrl and sessionId — the user opens the link in a browser and uploads the file there. Never pass Base64 or file content. After the page shows success, call get_evidence_upload_status or confirm_evidence_upload with sessionId. purpose=evidence (default): after confirm, pass evidenceFileRefs to mark_responsibility_complete. purpose=attachment: after confirm, pass attachmentFileRefs to add_responsibility_comment. Use when: the user needs to attach a file before completing a responsibility or adding a comment. Do not use when: listing or reading responsibilities without an explicit upload request.
responsibilities
ChatGPTLists compliance responsibilities for the authenticated user, including linked program IDs/names on each item. Use type to filter: active (all active), not_completed (failed assignee work status), upcoming (pending), or overdue (delayed). Optional programId narrows to responsibilities under one program — resolve the program name with programs first (e.g. "all ISO 27001 responsibilities"). Use when: the user asks to find, search, list, or look up responsibilities, including by program. Do not use when: the numeric responsibility ID is already known and the question is only about metadata (use responsibility_details) or only about deadlines (use responsibility_due_dates). Prerequisites: none for general list; call programs first when filtering by program name. Prefer this as the first step whenever the user gives a title/name instead of an ID. Next step: call responsibility_details for general metadata, responsibility_due_dates for schedule questions, or overseer update tools after collecting ids. Safety boundary: read-only discovery — never use for completing work or adding comments.
responsibility_centers
ChatGPTLists responsibility centers available to the authenticated user, including each center ID, rcid, name, status, origin, and parent. Use when: the user asks for available responsibility centers, center names, org units, or a responsibility center ID. Do not use when: listing responsibilities, programs, due dates, or performance stats. Prerequisites: none. Next step: after selecting a responsibility center ID, call compliance_performance with entity="responsibility_center" for performance questions. Safety boundary: read-only discovery — never use for completing work or adding comments.
responsibility_details
ChatGPTFetches the responsibility record and metadata for a specific responsibility by ID, including fields like title, notes, objective, assignees, risk class, linked entities, and configuration. Use when: the user asks for details, metadata, notes, objective, assignees, risk class, or configuration of a known responsibility. Do not use when: answering due-date, deadline, or schedule questions (use responsibility_due_dates), or when the responsibility ID is unknown (call responsibilities first). Prerequisites: numeric responsibilityId from responsibilities when the user only provided a name/title. Next step: call responsibility_due_dates if the user then asks about deadlines. Safety boundary: read-only — never use for completing work or adding comments.
responsibility_due_dates
ChatGPTFetches due dates, deadlines, and open due-date items for a specific responsibility, resolved to the authenticated user as assignee. Use when: the user asks when a responsibility is due, for deadlines, schedules, open due dates, or overdue timing for a known responsibility. Do not use when: answering general metadata questions (use responsibility_details), or when the responsibility ID is unknown (call responsibilities first). Prerequisites: numeric responsibilityId from responsibilities when the user only provided a name/title. Next step: none for schedule answers; only call mutation tools if the user explicitly asks to complete or comment. Safety boundary: read-only schedule lookup — never use for completing work or adding comments.
search_policies
ChatGPTFull-text keyword search across the policy library. Returns a relevance-ranked list of matching policies. Use when: the user provides a keyword or topic rather than a specific policy name (e.g. password security, data residency). Do not use when: browsing/filtering by workflow status without keywords (use get_policies instead). Prerequisites: non-empty query string. Next step: call get_policy_detail for a selected result id/slug, or get_policy_workroom_url to open it in Policy Workroom. Safety boundary: read-only discovery — never use for mutations.
update_always_notify_oversight
ChatGPTPreviews and then updates the Always Notify (success) overseer slot. The first call returns confirmation_required and does not write. Call again with confirm true and mode replace, add, or remove. Or pass decisions [{ responsibilityId, mode }] so each responsibility can differ. Ids omitted from decisions are not written. replace writes the given userId and userGroupId lists. add unions those ids onto the current slot. remove subtracts them. Empty replace clears that side. Empty add or remove leaves that side unchanged. Notify on Failure is returned as otherSlot and is left unchanged. Pass programId and/or responsibilityCenterId to load current overseers from the internal responsibilities report. Resolve names with programs or responsibility_centers first. When those ids are omitted, pass responsibilityIds. Current overseers are read from each responsibility record. Use get_responsibility_overseers only to answer who oversees one known responsibility. Use when: the user explicitly asks to set, add, remove, or clear Always Notify overseers. Do not use when: reading one responsibility (use get_responsibility_overseers) or changing Notify on Failure (use update_notify_on_failure_oversight). Safety boundary: write/mutation — no write until confirm is true.
update_notify_on_failure_oversight
ChatGPTPreviews and then updates the Notify on Failure (fail) overseer slot. The first call returns confirmation_required and does not write. Call again with confirm true and mode replace, add, or remove. Or pass decisions [{ responsibilityId, mode }] so each responsibility can differ. Ids omitted from decisions are not written. replace writes the given userId and userGroupId lists. add unions those ids onto the current slot. remove subtracts them. Empty replace clears that side. Empty add or remove leaves that side unchanged. Always Notify is returned as otherSlot and is left unchanged. Pass programId and/or responsibilityCenterId to load current overseers from the internal responsibilities report. Resolve names with programs or responsibility_centers first. When those ids are omitted, pass responsibilityIds. Current overseers are read from each responsibility record. Use get_responsibility_overseers only to answer who oversees one known responsibility. Use when: the user explicitly asks to set, add, remove, or clear Notify on Failure overseers. Do not use when: reading one responsibility (use get_responsibility_overseers) or changing Always Notify (use update_always_notify_oversight). Safety boundary: write/mutation — no write until confirm is true.
compliance_performance
Claudeconfirm_evidence_upload
Claudecurrent_user
Claudeget_evidence_upload_status
Claudemark_responsibility_complete
Claudeprograms
Clauderequest_evidence_upload
Clauderesponsibilities
Clauderesponsibility_centers
Clauderesponsibility_details
Clauderesponsibility_due_dates
Claude
