vettly.si
Sign inRequest access

Documentation for GRC

The evidence is produced by the work, not assembled before the audit.

Everything a reviewer does leaves a document behind. Vettly turns the registry, the assessment, the review and the monitoring into artefacts that answer the questions auditors, regulators and boards actually ask, in the vocabulary of the frameworks they use.

Agent Profile · document outlinePDF · Markdown · JSON
  1. 01Identity and ownership: ID, platform, owner, team, business unit, criticality, lifecycle, status
  2. 02Purpose and scope in plain language, as submitted by the owner
  3. 03Specification: instructions, knowledge sources, tools, MCP servers, access, deployment controls, quant inputs
  4. 04Assessment: score, tier, verdict, category scores, every finding with evidence and recommendation
  5. 05Blast radius: systems reachable, write paths, records in reach, audience, exfiltration triad
  6. 06Risk quantification: expected annual loss, percentiles, loss composition, residual after fixes
  7. 07Framework mapping: OWASP LLM and Agentic, NIST AI RMF, MITRE ATLAS, ISO/IEC 42001, EU AI Act, SOC 2, GDPR, HIPAA, PCI DSS
  8. 08Review record: assignments, checklist outcomes with notes, discussion, change requests
  9. 09Decision and attestation: who approved what, when, under which conditions, valid until
  10. 10Conditions register: open, done and waived obligations with due dates
  11. 11Version history: every submitted specification with its hash and change note
  12. 12Drift history: snapshots, severities, what changed, how it was handled
Attestation certificate

A numbered, dated certificate per blessed agent, bound to the configuration hash, with conditions and validity, exportable as PDF and verifiable through the API.

Registry inventory

The complete AI agent inventory as CSV: owner, platform, status, score, tier, expected annual loss, attestation, open conditions and drift state for every agent.

Control-to-framework mapping

Each finding and each fix carries the framework references it satisfies, so control evidence rolls up per framework across the whole registry.

Audit trail

Submissions, assignments, checklist ticks, decisions, condition resolutions, syncs, drift handling, membership changes and sign-ins, per tenant, exportable.

Risk register entries

Expected annual loss and the P90 for every agent and for the portfolio against the stated appetite: the numbers a risk committee can compare with everything else on the register.

EU AI Act

An inventory of AI systems with purpose, risk assessment, human oversight controls, logging, and documentation that is kept current as the system changes: the registry, the assessment and the drift history, per agent.

ISO/IEC 42001 and NIST AI RMF

Map, measure and manage: every agent identified and owned, risk measured with repeatable rules and quantified in monetary terms, managed through review, conditions and recertification.

SOC 2, GDPR, HIPAA, PCI DSS

Which agents reach regulated data, through which tools, with what authentication and approval; who reviewed them, when, and what obligations are still open.

Every finding mapped to

  • OWASP LLM Top 10 · 2025
  • OWASP Agentic Top 10
  • NIST AI RMF
  • MITRE ATLAS
  • ISO/IEC 42001
  • EU AI Act
  • SOC 2
  • GDPR · HIPAA · PCI DSS

Evidence produced by the work, not assembled before the audit.

Tell us about your organisation and the platforms your agents run on. We provision your workspace and you are reviewing your first agent the same day.

Request access