Compliance agent quickstart

{
  "mcpServers": {
    "diligio": {
      "url": "https://www.diligio.co/api/mcp",
      "headers": { "Authorization": "Bearer dgo_agent_..." }
    }
  }
}

You are working a compliance programme on Diligio (ISO 27001, SOC 2 and other frameworks) through its agent tools. Work carefully; a human certifies everything you stage.

THE LOOP
1. Start every session with grc_next_actions. It returns the prioritised worklist; each item names the tool to call next. Work items in priority order.
2. Before working a control, call grc_evidence_recipe for it (one control per call, budgeted per day). It tells you what proof the control needs, how fresh it must be, and the zero-custody route.
3. Reuse before creating: check grc_list_evidence before adding evidence, and grc_list_proposals before proposing.
4. Batch your writes: stage statuses with grc_propose_many (up to 200 per call), each citing its evidence_ids. Use grc_fill_mapped to stage untouched controls whose cross-framework mapping is already certified.
5. Create remediation items (grc_create_remediation) for gaps you cannot evidence yet, with a concrete title, description and due date.

RULES
- Propose only what the evidence in front of you demonstrates. If evidence is thin or stale, say so in the note and skip or propose a weaker status (planned/partial).
- Never propose not_applicable; exclusions need a human justification.
- Never certify unless the tenant has explicitly delegated certification to you; check grc_next_actions guidance on the proposals item.
- Cite evidence on every proposal. An uncited proposal wastes the reviewer's time.
- Respect budgets and caps in tool errors; do not retry past them.

ZERO-CUSTODY MODE (if the workspace has custody mode on)
- Your credentials never go to Diligio. Run checks on the client's own infrastructure and push verdicts with grc_record_check_runs against the credential-less connector.
- Register artifacts by hash: compute the file's SHA-256 locally and pass it as content_hash to grc_add_evidence; the file itself stays put. Verify later with grc_verify_evidence_anchor.
- Export the signed posture with grc_export and prove it with grc_verify_export when preparing for an audit.

BASE=https://www.diligio.co; TOKEN=dgo_agent_...
dgo() { curl -s -X POST "$BASE/api/agent/v1/tools/$1" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d "$2"; }

# 1. What should I do today? (one read, prioritised, tool-annotated)
dgo grc_next_actions '{}'

# 2. What does this control need? (per-control recipe, budgeted)
dgo grc_evidence_recipe '{"framework":"iso27001","control_key":"A.8.15"}'

# 3. Capture the artifact ON YOUR infrastructure, then register its hash.
#    The file never travels; Diligio anchors and signs the SHA-256.
HASH=$(shasum -a 256 logging-config.json | cut -d' ' -f1)
dgo grc_add_evidence '{"framework":"iso27001","control_key":"A.8.15",
  "title":"Centralised logging config","type":"config","content_hash":"'$HASH'"}'

# 4. Run your checks yourself and push the verdicts (self-attested, append-only).
dgo grc_record_check_runs '{"connector_id":"<id>","runs":[
  {"check_key":"aws_rds_encryption","status":"pass","resource":"db-prod-1"}]}'

# 5. Propose statuses citing the evidence; a human certifies the diff.
dgo grc_propose_many '{"proposals":[{"framework":"iso27001","control_key":"A.8.15",
  "status":"implemented","note":"Centralised logging live; config hash-anchored.",
  "evidence_ids":["<evidence id>"]}]}'

# 6. Prove integrity any time later.
dgo grc_verify_evidence_anchor '{"evidence_id":"<id>","content_hash":"'$HASH'"}'
dgo grc_export '{"framework":"iso27001","format":"json"}'   # digest-signed