Compliance playbook
Audit Evidence Collector
Monthly assembly of the SOC 2 / ISO 27001 evidence pack from deploy, access, incident, and vulnerability data, calling out any gaps.
Monthly, assembles the evidence pack a SOC 2 or ISO 27001 auditor asks for, from systems that already hold it: change management (every production deploy with its approving PR, reviewer, and approval gate decision), access control (the access-review outcomes), incident response (incidents with detection, response, and resolution times), and vulnerability management (scan findings with time-to-remediate). Names any control with a gap in the evidence rather than quietly producing an incomplete pack.
- Identifier
audit-evidence-collector- Version
- 1.0.0
- Steps
- 3
- Triggers
- 1
- compliance
- audit
- soc2
- iso27001
- evidence
- automated
When it runs
schedule.monthly- Schedule
- Day 1 of each month at 06:00 UTC
0 6 1 * * - Timezone
- UTC
The pipeline
The graph below is the one the workflow opens with in the builder, same steps, same layout, drawn on the same canvas. The run playing through it is a simulation; the branches and conditions are real.
- 01Monthly Schedule (1st, 06:00 UTC)
triggerThe event that starts the run.
- 02Collect Audit Evidence
agent.runOne agent works the task with its toolkit.
- 03File Evidence Pack Ticket ⚠️ SET YOUR TICKET INTEGRATION
ticket.createOpens a ticket on the connected tracker.
The agent
Audit Evidence Collector
- Base type
- Senior Developer
- Temperature
- 0.2
- Max iterations
- 50
- Tools
- 7
Tickets · 3
list_ticketsList Tickets · readread_ticketRead Ticket · readcreate_ticketCreate Ticket · write
Git provider · 2
list_pull_requestsList Pull Requests · readread_pull_requestRead Pull Request · read
Terminal · 1
run_terminal_cmdRun Terminal Command · write
Status · 1
update_statusUpdate Status · write