Policy Gap Analyst
Maps what your policies actually say to what the framework asks for
- 7hard rules
- Things it must never do, enforced in every run
- 5handover rules
- Conditions where it stops and gives the work to a person
- 8output fields
- A structured result, not a paragraph you have to re-read
- ≤6steps per run
- Bounded work: at most 5 tool calls, enforced by the runtime
Read-only by design. This agent has no path to sending, spending, publishing or committing anything. Where that limit is the product, removing it would remove the reason to trust the output.
Overview
Framework readiness is mostly document comparison: what do our policies already say, what does the standard require, and what is genuinely missing. It is clerical work that consumes weeks of expensive time.
This agent does the comparison against your real policies, read from your knowledge base and quoted. For each requirement it reports whether your documents address it, partially address it, or say nothing — with the passage that does, and the document it came from.
The distinction it holds firmly is between what is written, what was asserted, and what is absent. A control someone described in a meeting is not a documented control, and an auditor will say so. It reports gaps and the wording that would close them; it does not certify anything, and it does not tell you that you are compliant, because nobody can conclude that from documents alone.
Benefits
Weeks of comparison, done
The clerical majority of readiness work.
Know your real position
Before an auditor tells you, and while it is cheap to fix.
Traceable
Every claim of coverage points at the passage behind it.
What it does
Reads your actual policies
Quotes the passage covering each requirement, with the document and section it came from.
Written, asserted, absent
Three different states. A control described in a meeting is not a documented control, and an auditor will say so.
Lists what nothing addresses
The real output of a gap analysis is the gap list, and it is specific.
Suggests closing wording
Draft policy language for each gap, for a person to adapt and adopt.
Flags contradictions
Where two of your own policies say different things — a finding auditors reliably catch.
Certifies nothing
It reports coverage. Compliance is not concludable from documents.
What this changes
What this changes about your week
- It takes over
- Mapping your written policies to a framework's requirements, clause by clause.
- Done today by
- A consultant, at consultant rates.
- How often
- Every certification, and every customer security review.
- Typical manual effort
- A full gap analysis is weeks of document comparison.
Why Compliance & Risk in particular. It distinguishes what is written from what someone asserted in a meeting — which is precisely the finding an auditor raises.
Runs unattended
Started by you or by an event, and it finishes on its own. Nothing waits for someone to be at a desk.
The same standard every time
The two-hundredth item is held to the bar the first one was. Consistency is the part people cannot sustain.
It cannot act on its own
Policy Gap Analyst has no path to sending, spending or committing. That limit is why its output is safe to act on.
How it runs
This agent runs server-side through the PROMIVO runtime. Each run is logged step by step and every tool call is permission-checked before it executes.
- 1InputValidated against the agent input schema
- 2Modelclaude-opus-5 with automatic fallback
- 3Toolssearch_knowledge, extract_structured_data
- 4PermissionsRuns READ actions automatically; anything higher waits for approval
- 5OutputStructured result matching the output schema
- 6LoggingTokens, duration and every step recorded
Demo
Demo dataIllustrative sample output, abridged.
Input
{
"framework": "Customer security requirements",
"requirements": [
{
"text": "Access is reviewed periodically.",
"reference": "A.8"
}
]
}Output
{
"coverage": [
{
"status": "partial",
"reference": "A.8",
"draftWording": "Draft for adaptation: \"All access rights are reviewed at least quarterly by the system owner, and the review is recorded.\"",
"quotedPolicy": "\"Access rights are reviewed when an employee changes role or leaves.\"",
"whatIsMissing": "The requirement asks for periodic review. Your policy covers event-driven review only, so an account nobody changed is never re-examined.",
"sourceDocument": "Access Control Policy v3 — section 5"
}
],
"escalate": false,
"disclaimer": "A comparison of your written policies against the supplied requirements. Not a compliance opinion, not a readiness assessment, and not evidence that any control operates.",
"policiesFound": true,
"contradictions": [],
"unownedPolicies": [
"Access Control Policy v3 names no owner and no review date."
]
}Requirements
Integrations
No integrations required.
Before you start
- The framework's requirements
- A knowledge base holding your current policies and procedures
- Requires the All-Access plan or higher
Use cases
Preparing for certification
Find the gaps before the audit does.
A customer's security questionnaire
See what you can actually evidence.
After a policy rewrite
Check nothing that was covered has quietly stopped being covered.
Pricing
All-Access
Billed monthly through your PROMIVO subscription. Cancel at any time.
Runs consume your plan allowance for agent executions and tokens. See plan limits
FAQ
Does it make us compliant?
No. It compares documents to requirements. Compliance depends on what you actually do, on evidence of operation, and on an assessor's judgement — none of which is in a policy document.
Which frameworks?
It works from the requirements you supply or load. That is deliberate: framework texts are versioned and change, and an agent quoting a remembered version would be quoting a wrong one.
Can it write our policies?
It drafts wording for gaps, for a person to adapt and adopt. A policy nobody in the organisation has read or agreed to is a document, not a control.
Reviews
Reviews open once customers have run this agent.
Need this agent to work differently?
Tell us what to change and our team will scope a customised version for your business.
Customize this agent