VComply

Fetches the responsibility record and metadata for a specific responsibility by ID, including fields like title, notes, objective, assignees, risk class, linked entities, and configuration. Use when: the user asks for details, metadata, notes, objective, assignees, risk class, or configuration of a known responsibility. Do not use when: answering due-date, deadline, or schedule questions (use responsibility_due_dates), or when the responsibility ID is unknown (call responsibilities first). Prerequisites: numeric responsibilityId from responsibilities when the user only provided a name/title. Next step: call responsibility_due_dates if the user then asks about deadlines. Safety boundary: read-only — never use for completing work or adding comments.

responsibility_details

Fetches due dates, deadlines, and open due-date items for a specific responsibility, resolved to the authenticated user as assignee. Use when: the user asks when a responsibility is due, for deadlines, schedules, open due dates, or overdue timing for a known responsibility. Do not use when: answering general metadata questions (use responsibility_details), or when the responsibility ID is unknown (call responsibilities first). Prerequisites: numeric responsibilityId from responsibilities when the user only provided a name/title. Next step: none for schedule answers; only call mutation tools if the user explicitly asks to complete or comment. Safety boundary: read-only schedule lookup — never use for completing work or adding comments.

responsibility_due_dates

Returns Always Notify (success) and Notify on Failure (fail) overseer userId and userGroupId lists for a responsibility. Use when: the user asks who oversees a responsibility, who gets notified on complete/fail, or before replacing overseer lists. Do not use when: listing responsibilities, due dates, or completing work. Prerequisites: numeric responsibilityId from responsibilities when only a title was given. Next step: update_always_notify_oversight or update_notify_on_failure_oversight with the full desired lists (replace semantics). Safety boundary: read-only.

get_responsibility_overseers

Lists organization users with optional status (active/inactive), license (power/light), and searchTerm filters (paginated recipe=aud). Use when: the user explicitly asks to list, search, or browse the org directory (e.g. "find Mark", "show Power users", "list active users"). Do not use when: only asking who the current signed-in user is (use current_user). Do not use when: adding a responsibility comment with @mentions — add_responsibility_comment resolves @tags itself via recipe=aumd; calling get_users first is unnecessary and wrong for that flow. Prerequisites: none. Next step: use returned user ids with get_policies ownerId/authorId filters or overseer update tools. Safety boundary: read-only directory lookup — never use for mutations.

get_users

Lists policies with status, owner, review date, and linked controls count. Does not return policy body content. Use when: the user is exploring the policy library, filtering by workflow status (published, draft, in review, in approval, approved, rejected), category, RC, owner, or author. Do not use when: the user provides a keyword/topic to search (use search_policies), or needs full content for a known policy (use get_policy_detail). Prerequisites: none. Prefer this as the first call for browsing. Resolve owner/author names with get_users when needed. Next step: call get_policy_detail with a policy id/slug, get_policy_workroom_url for a portal link, or get_policy_acknowledgment_status for attestation stats. Safety boundary: read-only discovery — never use for mutations.

get_policies

Lists compliance programs available to the authenticated user, including each program ID, name, type, active status, and owners. Use when: the user asks for available programs, program names, or a program ID (for example "find program X" or "which programs do I have"). Do not use when: listing responsibilities, responsibility centers, due dates, or performance stats. Prerequisites: none. Next step: after selecting a program ID, call compliance_performance with entity="program", or responsibilities with programId to list linked responsibilities. Safety boundary: read-only discovery — never use for completing work or adding comments.

programs

Lists compliance responsibilities for the authenticated user, including linked program IDs/names on each item. Use type to filter: active (all active), not_completed (failed assignee work status), upcoming (pending), or overdue (delayed). Optional programId narrows to responsibilities under one program — resolve the program name with programs first (e.g. "all ISO 27001 responsibilities"). Use when: the user asks to find, search, list, or look up responsibilities, including by program. Do not use when: the numeric responsibility ID is already known and the question is only about metadata (use responsibility_details) or only about deadlines (use responsibility_due_dates). Prerequisites: none for general list; call programs first when filtering by program name. Prefer this as the first step whenever the user gives a title/name instead of an ID. Next step: call responsibility_details for general metadata, responsibility_due_dates for schedule questions, or overseer update tools after collecting ids. Safety boundary: read-only discovery — never use for completing work or adding comments.

responsibilities

Lists responsibility centers available to the authenticated user, including each center ID, rcid, name, status, origin, and parent. Use when: the user asks for available responsibility centers, center names, org units, or a responsibility center ID. Do not use when: listing responsibilities, programs, due dates, or performance stats. Prerequisites: none. Next step: after selecting a responsibility center ID, call compliance_performance with entity="responsibility_center" for performance questions. Safety boundary: read-only discovery — never use for completing work or adding comments.

responsibility_centers

Marks an open due date as completed for a responsibility assigned to the authenticated user. When only one open due date exists it is completed automatically. When multiple open due dates exist, returns them for confirmation — call again with dueDateId. Optional comment is plain text; include URLs inline (e.g. "Reviewed https://example.com") or pass links [{ href }] to append them. No HTML hyperlinks. @mentions are not supported on complete. Optional evidenceFileRefs attach confirmed uploads via the evidence upload side-channel (request_evidence_upload → confirm_evidence_upload). Do not pass file content or Base64. Use when: the user explicitly asks to complete, mark done, close, or finish a responsibility / due date. Do not use when: the user is searching, listing, reviewing details, checking due dates, or asking about performance — those are read-only flows. Prerequisites: numeric responsibilityId (from responsibilities if only a name was given). Optional dueDateId, comment, links, evidenceFileRefs. Next step: if confirmation_required is returned, call again with the selected dueDateId. If evidence is needed first, call request_evidence_upload then confirm before completing. Safety boundary: write/mutation tool — never select for search or read-only prompts.

mark_responsibility_complete

Requests a short-lived browser upload session for responsibility evidence or comment attachments. Returns hostAction=open_upload_page with uploadPageUrl and sessionId — the user opens the link in a browser and uploads the file there. Never pass Base64 or file content. After the page shows success, call get_evidence_upload_status or confirm_evidence_upload with sessionId. purpose=evidence (default): after confirm, pass evidenceFileRefs to mark_responsibility_complete. purpose=attachment: after confirm, pass attachmentFileRefs to add_responsibility_comment. Use when: the user needs to attach a file before completing a responsibility or adding a comment. Do not use when: listing or reading responsibilities without an explicit upload request.

request_evidence_upload

Full-text keyword search across the policy library. Returns a relevance-ranked list of matching policies. Use when: the user provides a keyword or topic rather than a specific policy name (e.g. password security, data residency). Do not use when: browsing/filtering by workflow status without keywords (use get_policies instead). Prerequisites: non-empty query string. Next step: call get_policy_detail for a selected result id/slug, or get_policy_workroom_url to open it in Policy Workroom. Safety boundary: read-only discovery — never use for mutations.

search_policies

Replaces the Always Notify (success) overseer slot on one or many responsibilities with the exact userId and userGroupId lists provided. Same lists are applied to every responsibilityId in the request. Empty arrays clear that side. Does not change Notify on Failure. Use when: the user explicitly asks to set, replace, or clear Always Notify / success overseers. Do not use when: reading who oversees (use get_responsibility_overseers), or changing Notify on Failure (use update_notify_on_failure_oversight). Prerequisites: numeric responsibilityIds; numeric user/group IDs from get_users when names were given. Call get_responsibility_overseers first if merging/add/remove is intended — this tool does not merge. Safety boundary: write/mutation — full-slot replace via internal bulk API; never select for read-only prompts.

update_always_notify_oversight

Replaces the Notify on Failure (fail) overseer slot on one or many responsibilities with the exact userId and userGroupId lists provided. Same lists are applied to every responsibilityId in the request. Empty arrays clear that side. Does not change Always Notify. Use when: the user explicitly asks to set, replace, or clear Notify on Failure / fail overseers. Do not use when: reading who oversees (use get_responsibility_overseers), or changing Always Notify (use update_always_notify_oversight). Prerequisites: numeric responsibilityIds; numeric user/group IDs from get_users when names were given. Call get_responsibility_overseers first if merging/add/remove is intended — this tool does not merge. Safety boundary: write/mutation — full-slot replace via internal bulk API; never select for read-only prompts.

update_notify_on_failure_oversight