AI proposals
Vantage can use AI to suggest governance work — mapping a document to a control, flagging an uncovered domain, proposing a document structure, drafting a body, or revising one.
Nothing an agent produces is applied automatically. Every suggestion arrives as a proposal that a person accepts or rejects. That gate is the whole design: the AI drafts, a human decides, and the decision is recorded against a named person.
Proposal types
| Type | Suggests | Accepting creates |
|---|---|---|
| Control mapping | Attach a document to a framework or risk control | The mapping |
| Coverage gap | "There is no governing document for domain X" | Nothing — it is a worklist item you acknowledge |
| Document scaffold | A governing policy plus its child procedures | The policy, its procedures, and their mappings — all in draft |
| Redline | A revision of an existing body, shown as a diff | A new draft version carrying the revision |
| Policy draft | A full bilingual document draft | — |
Coverage-gap proposals are the odd one out: accepting one writes nothing. It is a worklist item, and accepting it means "seen, and acted on".
Deciding
Each proposal is pending until somebody acts. Accept and Reject need
a manager role or above — ratifying the record of truth is not an analyst's
call. Dismiss (withdraw) is available to analysts, for triaging noise out of
the queue.
| Decision | Result |
|---|---|
| Accept | Applied to the record, recorded as your decision. Terminal |
| Reject | Dismissed, with the reasoning kept. Terminal |
| Needs info | Sent back for more context; a reply re-queues it |
| Withdraw | Retracted by whoever raised it. Terminal |
Accepted, rejected and withdrawn are terminal. Re-opening a decided proposal is not supported, by design: the trail should show what was decided and when, so a changed mind creates a new proposal rather than rewriting the old one.
Accepting the same mapping twice is harmless — the write is idempotent, so a mapping that already exists is not duplicated.
Comments and needs-info
Every proposal carries a comment thread (analyst or above to post). A comment
on a proposal in needs_info can re-queue it — moving it back to pending
so it returns to the reviewer's list with the answer attached.
That is the round trip: a reviewer who cannot decide asks a question instead of guessing, and the exchange stays attached to the proposal rather than disappearing into email.
Where proposals appear
| Surface | Shows |
|---|---|
| Coverage & AI | Every pending proposal for the selected framework |
| Document → Mappings | Mapping proposals for that document |
| Document → Content | The pending redline for that document, as a diff |
Each shows the proposal type, its rationale, the model's confidence where it gave one, and whether it came from an agent or a person.
The run record
Every agent run is recorded: the model provider and name, the intent, the steps it took, token counts, how long it took, and whether it succeeded or failed — and each proposal points back at the run that produced it, with a hash of the prompt that generated it.
If a regulator asks how a policy came to be drafted, or why a control was mapped the way it was, that trail is the answer. An accepted proposal is always traceable to what proposed it, and to who ratified it.
Consent, and what leaves your network
No agent in this module runs until an organisation administrator turns AI on for governance in Settings → AI assistance. It is off by default and the choice is audit-logged.
When it is on, these agents send to your configured provider:
- policy titles and full body text, including unpublished drafts;
- the framework and control text documents are mapped against;
- existing mappings and identified coverage gaps.
Two of the agents — the coverage scan and the scaffold generator — are deterministic and use no model at all. They work on an air-gapped installation with no provider configured.
A generated policy has not been reviewed by your legal or compliance function
until somebody does that. Accepting a draft or scaffold proposal creates
documents in draft — they still go through review, approval and
publication like any other.