Scribe
Maps controls to evidence, drafts cited audit responses, and translates requirements into draft policy.
What changes for the organisation
Audit responses stop being a six-week fire drill.
How it works
Retrieval over approved regulations, policies, controls and evidence maps controls to artifacts, identifies missing evidence, and drafts cited responses and jurisdiction-specific reports. A policy copilot turns natural-language requirements into draft rules with conflict detection and impact simulation.
What it watches
- Approved regulations, policies, standards and control catalogs, indexed locally as signed knowledge packs
- Your own evidence artifacts and configuration snapshots
- The M0 policy engine — for draft rules, conflict detection and dry-run impact
How it actually works
The mechanism, not the marketing. If a step below would not survive an engineer's scrutiny, it should not be on this page.
1
Regulations arrive as signed, dated knowledge packs
Versioned like every other pack, imported by offline bundle, with a documented watch-list process behind them so an instrument in motion is tracked rather than assumed.
2
Retrieval is permission-filtered, and citations inherit the boundary
A control that maps to evidence the requester cannot access is reported as inaccessible. It is not summarised around, and it is not silently omitted.
3
Mapping is a join first, an explanation second
Where artifacts carry identifiers, control-to-evidence mapping is deterministic. The model explains the gaps and drafts the prose — it does not invent the linkage.
4
Freshness is part of every answer
Source, version and freshness accompany each factual claim. An instrument superseded since the last pack renders as stale rather than being quoted with confidence.
5
Policy drafting runs through the existing engine
Natural language becomes candidate rules; conflicts are detected deterministically; the dry-run replays the change against a recent traffic window before anyone is affected.
6
Publication is a human act
An authorised administrator publishes through the versioned workflow, with rollback. The copilot drafts and simulates; it never ships a policy.
7
The output is reviewable gaps, never a compliance assertion
Control-state review compares approved configuration snapshots against policy requirements and produces gaps. It does not certify, and legal conclusions require qualified human review.
Operating path
From signal to auditable evidence
01Observed inputs
- Approved regulations, policies, standards and control catalogs, indexed locally as signed knowledge packs
- Your own evidence artifacts and configuration snapshots
- The M0 policy engine — for draft rules, conflict detection and dry-run impact
02Deterministic workflow
- 1 Regulations arrive as signed, dated knowledge packs Versioned like every other pack, imported by offline bundle, with a documented watch-list process behind them so an instrument in motion is tracked rather than assumed.
- 2 Retrieval is permission-filtered, and citations inherit the boundary A control that maps to evidence the requester cannot access is reported as inaccessible. It is not summarised around, and it is not silently omitted.
- 3 Mapping is a join first, an explanation second Where artifacts carry identifiers, control-to-evidence mapping is deterministic. The model explains the gaps and drafts the prose — it does not invent the linkage.
- 4 Freshness is part of every answer Source, version and freshness accompany each factual claim. An instrument superseded since the last pack renders as stale rather than being quoted with confidence.
- 5 Policy drafting runs through the existing engine Natural language becomes candidate rules; conflicts are detected deterministically; the dry-run replays the change against a recent traffic window before anyone is affected.
- 6 Publication is a human act An authorised administrator publishes through the versioned workflow, with rollback. The copilot drafts and simulates; it never ships a policy.
- 7 The output is reviewable gaps, never a compliance assertion Control-state review compares approved configuration snapshots against policy requirements and produces gaps. It does not certify, and legal conclusions require qualified human review.
03Evidence outputs
- Cited audit responses traceable to source document and version
- Control-to-evidence maps with named gaps
- Draft policy versions, their dry-run impact, and the administrator who published or rejected them
A case
Thirty-four controls, two days instead of six weeks
The value is not the writing. It is knowing which twenty-nine you can answer and which five you cannot.
Request
The regulator asks for evidence against 34 controls, with a response window that assumes the organisation already knows where everything is.
Mapping
29 controls map cleanly to artifacts by identifier, each with a citation to the source document and version.
Stale
3 map to artifacts older than the control's own review cycle. They render as stale rather than being submitted as current — which is the difference between a weak answer and a false one.
Gaps
2 have no supporting evidence at all. The copilot drafts nothing for them and states plainly that nothing exists. Inventing a plausible artifact here is the one failure mode that would be unrecoverable.
Drafting
Cited responses are drafted for the 29, each traceable to its source and version.
Review
The compliance officer reads every line, corrects two, and submits under their own name.
What it came to
What the tool produced was a first draft with citations and an honest inventory of what was missing. What it did not produce — and structurally cannot — is a claim that the organisation is compliant.
How a decision gets made
The authority ladder. Green rungs are authoritative — a rule, a scanner, a sandbox, or a person. Blue is where the model contributes. Amber is where a human decides.
02
Bounded context
Permission-filtered retrieval. Citations, caches and derived results inherit the same boundary as the source.
03
Model contribution
Control-to-evidence mapping, gap identification, drafted cited responses, draft policy rules, and impact simulation against a recent traffic window.
04
Human control
Authorised administrators publish policy through the existing versioned workflow. Legal and regulatory conclusions require qualified human review.
What the model adds
The first draft of the thing nobody wants to write — with every claim carrying its source and version.
What it cannot claim
It cannot assert that you are compliant. It creates reviewable gaps; it does not certify.
What it will never do
- Never asserts you are compliant. Control-state review produces reviewable gaps, not a compliance verdict.
- Never publishes a policy change. Authorised administrators do, through the versioned workflow with rollback and dry-run.
- Never answers from retrieval without identifying the source, its version and its freshness.
- Never substitutes for qualified human legal review.
What evidence it leaves
- Cited audit responses traceable to source document and version
- Control-to-evidence maps with named gaps
- Draft policy versions, their dry-run impact, and the administrator who published or rejected them
See it work
Run it yourself
Real logic, in your browser, with no network requests.
Status and what promotion requires
Roadmap discovery. Promotion requires named document sources plus RAG citation-correctness, permission-correctness and stale-source behaviour targets.
Roles that touch it
Auditor / CompliancePolicy AdminExecutive Sponsor / CISO