Every agent is trained by a named auditor.
This is specialist accountability, surfaced as a product feature. Each framework agent has a designated Trained by field — the credentialed SME whose review methodology, finding language, and evidence standards the agent absorbs through the redline loop. Prompt traces, source references, and approval gates stay visible so the auditor can see where AI helped and where a human signed off.
Role-plays a senior AICPA SOC practitioner. Challenges weak evidence, cites 2017 TSC with 2022 Points of Focus, and raises the concerns a real practitioner raises in fieldwork.
Role-plays a HITRUST CCSFP performing a pre-assessment walkthrough. Preserves native references and flags assessor evidence gaps without copying proprietary requirement text.
Role-plays a CMS EDE third-party auditor performing a Year 9 Operational Readiness Review. Cites guidance by name and date.
Reviews ePHI safeguards against 45 CFR § 164 Subpart C. Flags risk-analysis gaps per 164.308(a)(1)(ii)(A) and HHS OCR enforcement patterns.
Writes findings to the v4.0.1 Report on Compliance template. Tracks future-dated requirements (effective 2025-03-31).
Reviews AI Management System clauses against ISO/IEC 42001:2023. Integrates NIST AI RMF (AI 100-1) and Generative AI Profile (AI 600-1) references.
Reads one evidence artifact and produces structured cross-framework control mappings with calibrated confidence, evidence type, and auditor-grade rationale.
Classifies, dedupes, and extracts requirements from a client's local source folder. Metadata-only (filenames, sizes, timestamps) — contents never leave the browser.
Drafts policies, procedures, SSP sections, POA&M entries, and control narratives grounded in the client corpus. Inline citation chips. Refuses to generate without source anchor.
Identifies missing, stale, or weak evidence per framework. Proposes a prioritized remediation plan that maximizes cross-framework reuse.
Executes auditor-style test procedures against the client's evidence — identifies exactly where the flow fails with cited artifacts and user-level specificity.
Objective, dispassionate summary of the evidence state per framework. Feeds the Auditor agents for the pre-audit simulation.
Each ControlFrame agent runs the redline loop: Propose → Act → Evaluate → Reflect → Refine. The named SME reviews a draft, marks their changes, and the agent captures the pattern into a firm-tunable retrieval corpus. Over time, the agent's drafts approach the SME's auditor-accept threshold — without ever replacing the SME's signature. Judgment, sign-off, and accountability stay human.