Organizational Context

Build me a compliance obligations register in Tracecat. Create a table of every legal, regulatory, and contractual security requirement we carry, each with its source, owner, and the controls that satisfy it. Seed it from our Vanta frameworks and the security commitments written into customer contracts in Notion. When a mapped control starts failing, open a Linear issue for the owner with the obligation at stake. First help me understand how this maps to GV.OC-03 and why obligations need a register separate from the controls themselves. Ask me which regulations and contract types apply to us. Talk me through whether new-regulation intake should be a scheduled review or an agent that reads compliance news and proposes register entries.

Build me a dependency map in Tracecat. Inventory the services customers depend on us for, and the external services we depend on to deliver them. Pull the SaaS estate from Okta, infrastructure services from AWS, and keep both directions in one table with owner and criticality. Have an agent draft the dependency overview in Notion and refresh it when the table changes. First help me understand how this maps to GV.OC-04 and GV.OC-05, and why both directions of dependency matter for risk decisions. Ask me which customer-facing services count as critical. Talk me through how often the map should refresh and what should trigger a review instead of a silent update.

Build me a commitments tracker in Tracecat. Collect the security promises we make in customer questionnaires and contracts, record each commitment in a table with the customer, the wording, and the control behind it. When a backing control regresses in Vanta, flag every affected commitment and draft the heads-up email for the account owner in Gmail, held for my approval. First help me understand how this maps to GV.OC-02 and why stakeholder expectations should be tracked as concrete commitments rather than a static document. Ask me where our questionnaire answers live today. Talk me through what the agent should extract automatically versus what needs human reading.