What problem does it solve? Annual compliance audits fail because controls are tested manually once a year, leaving weeks of unverified operation and producing last-minute evidence scrambles. This Skill turns compliance into a continuously monitored property of the system by automating control checks, evidence collection, and policy enforcement. ## Core Features & Use Cases - Continuous Control Monitoring: Define each control as a monitored object with a cadence matched to its failure mode, persisting dated results and alerting on failure trends. - Evidence Collection as Code: Build versioned, scheduled collectors that pull from authoritative APIs (IdP, HRIS, ticketing) and produce signed, immutable, reproducible audit artifacts with explicit exception lists. - Policy as Code: Encode rules in Rego and Cloud Custodian, enforced pre-merge, at admission, and continuously against deployed state, with graduated warn-to-block rollouts and expiring exemptions. - Access Review Automation: Reconcile grants daily against HR status, deprovision on HR events same-day, execute and verify revocations, and emit review evidence artifacts. - Use Case: A platform team preparing for a SOC 2 audit uses this Skill to automate encryption checks on S3 and RDS, reconcile privileged access daily, and generate a coverage report showing 64% of controls continuously monitored with mean time to correct drift of 4.2 hours. ## Quick Start Ask the assistant to define a continuously monitored control with automated evidence collection and policy-as-code enforcement for a specific compliance requirement such as encryption at rest.
