Ansvar Gateway

Approve or reject a pending proposal. Org-admin only (permission_denied otherwise); the assenter is the injected caller identity and may not be the proposer. Approve runs the signed-evidence apply, fail-closed on a stale proposal (the live row moved since it was proposed). Comment is captured verbatim.

arch_review_proposal

Substring search across all resource kinds (or the given subset). Returns kind, id, name, and a matching snippet. Cursor-paginated with returned/total counts.

arch_search

Breadth-first subgraph walk from a start node across every edge family (adr_link, adr_supersession, control_anchor, data_flow, dependency, obligation_link, threat_mitigation, threat_target, vuln_mitigation, vuln_target, zone_membership). depth is honored, capped at 3; direction filters out|in|both; edges restricts to a subset of families. Returns reached nodes (with hop) and the traversed edges.

arch_traverse

Get details for multiple CVEs in one query (max 100). Efficient for bulk vulnerability assessment.

batch_search

Cancel an active workflow by id. Cancelled workflows cannot be resumed and are excluded from resume_workflow's active listing; their record stays visible in list_workflows. Idempotent — cancelling an already-cancelled workflow returns the same result.

cancel_workflow

Determine which EU regulations apply to an entity based on its sector and optional subsector. Returns applicable regulations with confidence levels (definite / likely / possible), the basis article, and contextual notes. detail_level=summary adds counts + priority deadlines.

check_applicability

Check if a CVE is in the CISA Known Exploited Vulnerabilities (KEV) catalog. Returns KEV details including required remediation actions and due dates.

check_kev_status

Compare how 2+ EU regulations treat the same compliance topic. Uses concept-synonym expansion (incident reporting → breach notification, ICT risk → risk management, etc.) and full-text search over the EU corpus. Returns per-regulation requirement snippets, article numbers, and extracted timelines.

compare_requirements

Validate a DFD artifact and render it as styled Mermaid. Returns {mermaid, validation_errors, structural_warnings}. Use after the DFD specialist (/threat-modeler-dfd) has finished extraction so the graph integrity (valid node types, declared trust_zones, reachable edge endpoints, recognised regulatory tokens) is checked before the artifact is submitted via submit_response on scoping.component_identification. artifact = {nodes, edges, trust_zones, assets}, each a list. node: {id, type, trust_zone, name?} where type is one of process|data_store|external_entity|actor and trust_zone references a trust_zones[].id. edge: {src_node, dst_node, id?, protocol?, authentication?, encrypted?, crosses_boundary?} where src_node/dst_node reference node ids (from/to accepted as aliases). trust_zone: {id, name?}. asset: {owner_node, id?, regulatory_relevance?} where owner_node references a node id and regulatory_relevance tokens are one of GDPR|PCI_DSS|DORA|NIS2|EU_AI_Act|HIPAA|ePrivacy|EBA|EIOPA. Bad input returns validation_errors with mermaid=null; it never raises.

create_dfd

Decrypt an audit receipt server-side using the tenant's KMS key. Identify the receipt by the query_id that list_receipts and get_receipt return (this is the id you will normally have), or by the canonical receipt_id from those same responses — pass exactly one of the two. If a query_id matches more than one receipt, the error lists candidate seqs; pass seq alongside query_id to select one. Use this when someone asks 'show me what was returned for this query', 'decrypt the audit record', or 'read the plaintext of this receipt'. Returns the decrypted query, response, and metadata. Writes a decrypt event to the chain for auditability.

decrypt_receipt

Permanently remove a document from the user's library. Idempotent: returns success even if the document was already deleted or never existed. Use when the user says 'delete that doc', 'remove the old policy', or 'clean up the drafts'. Cannot be undone. Team and Company tier only.

delete_my_document

Discover what Ansvar can do for your agent. Default (detail='summary') is a compact orientation view: one-line about, your tier summary, counts, a per-category index (id, name, available_to_caller, min_tier, entry_hint, tools/workflows counts, caveats for gated families), meta tool names, next_steps, the paid add-ons directory, and a sources count with a drill-down pointer. detail='full' returns the complete catalog (large — over 100k chars): category prose, the intent-keyed `common_use_cases` map, `anti_patterns`, guidance, the tour, and the full sources directory. section='sources' | 'addons' | 'tour' | <category id> returns that one section alone; an unknown section is an error listing the valid ids. section='sources' honors detail: the default 'summary' returns a compact directory (per-source id, name, aliases, premium, availability + a one-line coverage summary), while detail='full' returns every source's full coverage prose and example queries. detail is validated before section: an invalid detail is an error even when section= is passed. Every view is tier-aware: `available_to_caller` flags and caveat text reflect the caller, and gated families are shown with caveats, never silently omitted. The workflow lists are reconciled at read time against a TTL-cached snapshot of the live workflow registry (background-refreshed, 15 min): `workflow_types_index` carries the snapshot status (live / stale / unavailable) and `fetched_at`, plus registry types the curated catalog does not list yet; `catalog_drift` lists catalog ids the registry no longer serves (dropped from the payload). `service_notices` names subsystems in a known degraded state and the exact tools affected. Companion to get_my_capabilities (live tier / quota only). Backed by this repo's data/capabilities-catalog.yml (mirrored for documentation as infrastructure/gateway/capabilities-catalog.yml in arch-docs).

describe_capabilities

Compare two versions of a legal provision to see what changed. Use this when someone asks 'what changed in the latest DORA amendment', 'how did this article change between versions', or 'show me the differences in GDPR Article 17 after the update'. Returns a structured diff with added, removed, and modified text. The response ends with a 'Sources used' markdown table listing every gateway row. Render a curated version in your answer with these rules: (I1) every row whose content you used, whether marked with a citation number or paraphrased, MUST appear in your table; (I2) the Reference and Server columns MUST appear verbatim for any row you render; (I3) rows you did not use MAY be dropped; (I4) the table MAY be renumbered from 1; (I5) if rows are dropped, the rendered table header MUST show 'Sources used (X of N rows from M servers)' so the user sees the completeness loss. Curation removes noise; it never trims for brevity. If every row was used, render every row.

diff

EXPERIMENTAL — results must be verified by qualified security and safety experts before use; do not act on them blindly. Score the operational impact of a CVE against a specific asset using context-aware CVSS adjustment rules. Call this when someone asks 'what is the real risk of CVE-2024-1234 on our payment gateway', 'does this CVE actually affect us given our network controls', or 'adjust the CVSS score for our environment'. Returns a full EffectiveRiskResult with the adjusted score, metric-by-metric provenance, and the policy rules that triggered each modification. Requires a scoring_context_id (the asset configuration; operator-managed — use list_scoring_contexts to enumerate) and a scoring_policy_id (the rule set to apply; use list_scoring_policies to enumerate). cvss_version is '3.1' (4.0 falls through to its own micro-plan). mode is 'contextual_severity' (rescore CVSS metrics only) or 'operational_risk' (also apply ignored-control filters). By default only rules that fired are returned, with a rule_evaluation_summary count; pass verbose=true for the full rule library (every did_not_fire evaluation and its reason). An experimental robot/OT safety rule pack fires only when the caller attests robot or OT asset context, scoring on the CVSS 4.0 safety metrics (MSI/MSA); its output is flagged experimental. Team and Company tier only.

effective_risk

EXPERIMENTAL — results must be verified by qualified security and safety experts before use; do not act on them blindly. Score one CVE against an asset described inline — no pre-registered scoring_context_id needed. Use this during workflows (threat_model, linddun, dpia, tender_review, gap_analysis) where you have an asset description in the workflow frame. Builds an ephemeral ScoringContext from the call args, runs the same scoring pipeline as effective_risk, returns the same EffectiveRiskResult shape. No DB write — context lives only for this call. controls is a list of {control_ref: str, attested: bool=true, evidence_refs?: [doc-segment URIs]} entries. A control with evidence_refs is graded 'evidenced' once the gateway resolves each ref against YOUR registered tamper-evident document segment (only resolved refs are forwarded; an unresolvable, malformed, or whole-document ref fails the call — no self-asserted evidenced). This is how an evidenced-class rule (e.g. RULE-MVC-0003, which needs scf_NET-12 at evidence_class='evidenced') fires from inline; without evidence_refs a control is 'attested'. Whether a control fires a rule depends on TWO independent gates: (1) the rule's evidence_class must be satisfied (an 'evidenced' rule needs a control with resolved evidence_refs; an attested-only control will not satisfy it), and (2) the scoring policy's compensating_control_evidence_requirement must allow it (policy_v1_audit='evidenced_only' blocks attested-tier evidence entirely; policy_v1_engineering='evidenced_or_attested' accepts it). Rules also have CWE / exposure / attack_vector preconditions independent of evidence — a control may be properly attested AND policy may permit it, but if the CVE's CWE isn't in the rule's cwe_includes_any list, the rule won't fire. Alternatively — do NOT combine with controls in one call (a mixed call is rejected) — use the unified evidence surface: evidence[] = a deployed control SHAPE on the vulnerable path, each {claim, evidence_refs?} where claim is an SCF provision ref (scf_<id>) OR a registered observed-control token; attributes{} = deployment-scope / platform QUALIFIERS of the asset (e.g. target_platform_linux: true). The gateway resolves each evidence_ref against YOUR registered tamper-evident documents (only resolved refs forwarded; an unresolvable, malformed, or whole-document ref fails the call — no self-asserted evidenced path); refs on a token claim are resolved but do not upgrade the shape to SCF grade. Optionally assert asset fail-safe attestations — asset_end_to_end_tls_not_decrypted_at_control, asset_no_forwarding_tier_relay, asset_replay_resistant_authentication — analyst affirmations that let the matching transport / forwarding-relay / replay reduction rules apply; omit them to leave unasserted (no reduction). product_identifier (purl/CPE) makes the result OpenVEX-exportable. Disposition semantics: disposition.status stays 'under_investigation' (review_required=true) unless a disposition rule fires or a human review is recorded — KEV listing / high EPSS never auto-assert a disposition. In-the-wild exploitation signals are CVE-level, not asset-level: they surface in operational_signals (kev_listed, epss_score, exploit_evidence) and act only as a brake on not_affected, by design. By default only rules that fired are returned, with a rule_evaluation_summary count; pass verbose=true for the full rule library. Team and Company tier only.

effective_risk_inline

EXPERIMENTAL — results must be verified by qualified security and safety experts before use; do not act on them blindly. Score multiple CVEs against the same inline asset description. Same semantics as effective_risk_inline but accepts cve_ids[] (1-100) and returns one EffectiveRiskResult per CVE. The asset, controls, and policy are described once and reused. Suited for 'given these N CVEs, what's the real risk against this server' questions during a threat model or gap analysis. Like effective_risk_inline you may instead use the unified evidence surface — evidence[] ({claim, evidence_refs?}: an SCF provision ref or an observed-control token, a deployed control SHAPE) and attributes{} (deployment-scope / platform QUALIFIERS, e.g. target_platform_linux). These are asset-global: described once and applied to every CVE. The gateway resolves each evidence_ref against YOUR tamper-evident documents (an unresolvable, malformed, or whole-document ref fails the call — no self-asserted evidenced path). Do NOT combine controls with evidence/attributes in one call (a mixed call is rejected). By default only rules that fired are returned per result, with a rule_evaluation_summary count; pass verbose=true for the full rule library. When emit_vex is true the response gains top-level vex and vex_meta keys beside results (which stays a list); vex is a standalone CycloneDX 1.6 VEX document for Dependency-Track 'Apply VEX', keyed to caller-supplied SBOM bom-refs via component_identifiers (cve_id -> bom-ref). vex_scope 'adjusted_only' (default) includes only context-adjusted findings, 'all' includes every scored finding; nothing is ever suppressed (no not_affected). Team and Company tier only.

effective_risk_inline_batch

Export a complete, offline-verifiable audit bundle for a date range. Use this when someone asks 'export the audit trail for the regulator', 'create an evidence package for the audit', or 'give me a standalone verification bundle'. Returns receipts, anchors, TSA timestamps, and cryptographic signatures — verifiable without Ansvar API access. scope selects 'message', 'chat', or 'range'.

export_audit_package

EXPERIMENTAL — results must be verified by qualified security and safety experts before use; do not act on them blindly. Serialize one or more accepted VEX dispositions (from effective_risk / record_review_decision results) into an OpenVEX document, so a customer can publish SBOM-matchable not_affected / affected / fixed / under_investigation statements. Fail-closed: refuses statements that are not OpenVEX-conformant (e.g. a disposition whose subject lacks a product_identifier). Pass dispositions[] and an ISO-8601 timestamp; author and doc_id are optional. Team and Company tier only.

export_vex

Produce the final compliance report from a completed workflow. Use this when someone says 'generate the gap analysis report', 'I need the DPIA report as a document', or 'create the threat model output'. Refuses until every quality gate passes, returning the failing check and a hint. Returns a structured report with findings, citations, and recommendations. Pass format html, pdf, docx, or all to additionally receive branded rendered artifacts as short-lived download URLs in a sibling render key; render failures attach render_error and never drop the report JSON.

generate_report

Find observed rows from legislative change feeds in a jurisdiction or framework, or from an explicit source. Use this for questions such as 'what laws changed in Sweden this month' only when the requested scope is listed as amendment-capable. If since is omitted, the gateway defaults to the last 90 days. Coverage is per corpus. The EU Regulations source is baseline-only during the current interim: it is excluded from amendment-capable dispatch, and a framework it owns is advertised only if another reachable feed supports that framework. A successful empty response is not evidence that no amendments occurred. On a capability miss, the response names supported source, framework, and jurisdiction scopes — or, when no corpus advertises change feeds at all, says so explicitly with supported_scopes empty on every axis. Every dispatched response reports whether baseline rows were actually withheld and whether the producer supplied typed event metadata. Legacy rows without typed event metadata remain visible with event_kind unknown. Use diff for a known provision. The response ends with a 'Sources used' markdown table listing every gateway row. Render a curated version in your answer with these rules: (I1) every row whose content you used, whether marked with a citation number or paraphrased, MUST appear in your table; (I2) the Reference and Server columns MUST appear verbatim for any row you render; (I3) rows you did not use MAY be dropped; (I4) the table MAY be renumbered from 1; (I5) if rows are dropped, the rendered table header MUST show 'Sources used (X of N rows from M servers)' so the user sees the completeness loss. Curation removes noise; it never trims for brevity. If every row was used, render every row.

get_changes

Check which step a compliance workflow is currently on and what input is needed next. Use this when someone asks 'where are we in the gap analysis', 'what's the next step', or 'what do I need to provide now'. Returns the current step description and expected input format. questions_for_user is advisory — answerable from context or uploaded documents; requires_user_input=true is the server-enforced human-input gate, and the step then lists user_provided_fields that must be filled before calling submit_response.

get_current_step

Get complete details for a specific CVE including CVSS scores, references, CPE mappings, KEV status, EPSS score, exploit references, and any CISA ICS/OT advisories (ICSA/ICSMA/ICSV) referencing it with their affected industrial products — use this to enrich an OT/ICS or robot-cell TARA with live advisory context.

get_cve_details

Check the freshness and sync status of all data sources. Returns last sync time, data age in hours, record counts, and health status (current/stale/critical) for each source: NVD, CISA KEV, EPSS, ExploitDB. Use this to verify data is up-to-date before making security assessments.

get_data_freshness

Look up a specific court decision (case) by its citation and return the decision plus its cross-references: the legislation it interprets or cites and the prior cases it cites. Use this after a `search` whose results include case-law rows (premium tiers receive case law inside `search` automatically — there is no separate case-law search tool), with the jurisdiction and the case's canonical reference (ECLI such as ECLI:EU:C:2020:559, or the corpus's neutral citation), to expand which regulations a judgment interprets and which provisions it cross-links to. The case-law counterpart of get_provision. Premium tiers and above. The response ends with a 'Sources used' markdown table listing every gateway row. Render a curated version in your answer with these rules: (I1) every row whose content you used, whether marked with a citation number or paraphrased, MUST appear in your table; (I2) the Reference and Server columns MUST appear verbatim for any row you render; (I3) rows you did not use MAY be dropped; (I4) the table MAY be renumbered from 1; (I5) if rows are dropped, the rendered table header MUST show 'Sources used (X of N rows from M servers)' so the user sees the completeness loss. Curation removes noise; it never trims for brevity. If every row was used, render every row.

get_decision

Break a registered document into its structural sections and paragraphs. Use this when someone asks 'show me the sections of this document', 'what topics does this policy cover', or 'give me an outline of this uploaded document'. Returns the document's section hierarchy with paragraph-level references for citation in doc:// URI format. Pass section_ref to drill into a node and get its children, including sentence-level segments for the narrowest possible citation. To present the resulting citations, see the `cite-document` prompt (numbered-text or rich-HTML rendering).

get_document_segments

Get the EPSS (Exploit Prediction Scoring System) score for a CVE. Returns the probability of exploitation in the next 30 days and percentile ranking.

get_epss_score

Get audit-evidence requirements for an EU regulation. Returns artifact names, examples, retention periods, auditor questions, and maturity-level expectations. Filter by regulation, article, or evidence_type.

get_evidence_requirements

Get public exploit code references for a CVE from Metasploit, ExploitDB, GitHub PoCs, and other sources.

get_exploits

Tier, capabilities, limits, and live usage for the calling identity. Use this to decide what tools and fan-out paths are available before calling them, or to check remaining quota before issuing more requests — lower-tier agents can avoid wasted retries and decide whether to upgrade mid-conversation rather than discover limits by hitting walls. Visible to all tiers; takes no arguments. Returns a JSON document with: tier (free/premium/team/company), capabilities (workflows, audit_ledger, include_premium_fanout — bool flags from ADR-026 §2 and ADR-032 §1), limits (max_concurrent_jobs, daily_quota — map tool→limit from ADR-028 §4), usage_today (active_concurrent_calls, remaining_quota — map tool→remaining, both read live from the per-worker counters; team/company budgets pool per organisation, so seats of one org see a shared remaining number), upgrade_url (empty for company tier, otherwise the marketing page that explains the next tier up), and service_notices — subsystems currently in a known degraded state, each naming the exact affected tools/add-ons and the reason those tools return, so an advertised capability that is temporarily down is never a surprise (empty list when everything is healthy). Counters reset at UTC midnight; per-worker semantics mean an N-worker gateway has roughly N× the per-worker limits in aggregate.

get_my_capabilities

Official clause text from a security standard your organisation has uploaded — looked up by clause reference (e.g. 'A.5.15', '6.1.2', 'CC6.1'). Returns the clause title, full text, parent section reference, page number, and a doc:// URI for paragraph-level citation. Requires standard_id (e.g. 'iso_27001_2022') and clause_id. If you have uploaded the same standard more than once, supply document_id to disambiguate. v1: scope='company' is not yet supported. Premium, Team, and Company tier only.

get_org_standard_clause

See how far along a compliance workflow is and which steps remain. Use this when someone asks 'how much of the gap analysis is done', 'what percentage is complete', or 'how many steps are left'. Returns completed and remaining steps with a progress percentage and quality score.

get_progress

Look up the exact text of a specific legal provision or standards-catalog control. Three addressing forms: (1) jurisdiction + law + article — use this when someone asks 'show me Article 5 of GDPR', 'what does Section 12 of the Swedish Work Environment Act say', or 'read me the text of DORA Article 11'; (2) canonical_ref — the exact ref a `search` row's `citation.lookup` hint advertises (e.g. get_provision(canonical_ref='loi-2018-07-30:art-64', jurisdiction='BE')): the gateway decomposes it and resolves the same way. Pass jurisdiction alongside canonical_ref when the ref does not embed one (relayed hints already include it). (3) law as a bare corpus/source id + article as the native control/entity id, NO jurisdiction — for non-jurisdictional standards catalogs (e.g. get_provision(law='nist-800-53', article='AC-5') for NIST SP 800-53, and the same shape for nist-csf-2, nist-800-82r3, nist-ai-rmf, nist-ssdf-800-218): a `search` row's `citation.lookup` hint for these corpora already advertises this exact shape — replay it verbatim. Returns the full provision text with citation metadata. The response ends with a 'Sources used' markdown table listing every gateway row. Render a curated version in your answer with these rules: (I1) every row whose content you used, whether marked with a citation number or paraphrased, MUST appear in your table; (I2) the Reference and Server columns MUST appear verbatim for any row you render; (I3) rows you did not use MAY be dropped; (I4) the table MAY be renumbered from 1; (I5) if rows are dropped, the rendered table header MUST show 'Sources used (X of N rows from M servers)' so the user sees the completeness loss. Curation removes noise; it never trims for brevity. If every row was used, render every row.

get_provision

Retrieve a tamper-proof audit receipt for a specific query. Each query to the system generates a cryptographic receipt that proves what was asked, what was returned, and when. Use this when someone asks 'show me the audit trail for query X', 'prove what the system returned', or 'retrieve the evidence record'. Returns the encrypted receipt envelope for client-side decryption with the tenant's KMS key.

get_receipt

Get an analysis guide for an EU regulation: delegated acts, proportionality tiers, top pitfalls, cross-regulation links, key structures, recitals, national implementation patterns, and timelines. detail_level=quick (default) shows the essentials; full adds key structures, recitals, evidence hints, national examples, and citation format.

get_regulation_guide

Fetch the engine-derived review material for a staged-workflow gate. Use this when a workflow step is waiting on human review and you need the context to assess it — 'what am I reviewing at this step', 'show me the review packet for this gate'. Takes the workflow id and the step id of the gate. Returns the review context the workflow engine assembled for that step. Optional scoping: pass steps (a JSON array of step ids, e.g. ["dispatch_stride"] — must be a JSON array, not a bare string) to restrict the accumulated material to those steps, and include_enriched=false to omit the enriched threat material. Note: when enriched material is present, the raw threats under accumulated['stride_analysis.dispatch_stride'] are replaced by an omission marker to avoid duplication — read threats from material.enriched.threats.

get_review_context

Review the threats identified during a threat-modeling workflow. Use this when someone asks 'what threats were found', 'show me the risk assessment results', or 'list the identified vulnerabilities'. Returns threats with severity ratings and recommended mitigations from completed STRIDE analysis steps.

get_workflow_threats

Show which countries, frameworks, and legal domains are available. Use this BEFORE calling `search` when the user's topic doesn't name a jurisdiction (e.g., 'what does the law say about consumer protection'); then present the returned jurisdictions to the user or ask which applies. Examples: • 'Which countries do you cover?' → list_coverage() • 'Do you have German law?' → list_coverage(jurisdiction='DE') • 'What jurisdictions for NIS2?' → list_coverage(domain='cybersecurity') • 'Which countries have drone law?' → list_coverage(domain='aviation') (also accepts 'drone' / 'uas') Returns a `jurisdictions` array (each with `code`, `name`, `region`, `laws`, `provisions`, `domains`) plus framework and source listings. NOTE: `laws`/`provisions` are WHOLE-JURISDICTION corpus totals — the response's `count_scope` is `whole_jurisdiction`. Under a `domain` filter the jurisdiction list is narrowed to that domain but the counts are NOT domain-scoped; do not report them as a per-domain count. The domain-specific signal is the (domain-filtered) `sources`/`frameworks`.

list_coverage

List documents the current tenant has uploaded for deep analysis. Use this when someone asks 'show me my uploaded documents', 'what documents do I have in the library', or 'find the DPIA I uploaded last week'. Returns each document's id, short_code, filename, status, and upload timestamp — not the document contents. Use get_document_segments or resolve_document_segment to read content for a specific id. Team and Company tier only.

list_my_documents

List the security standards your organisation has uploaded. Returns all statuses — ready, processing, and failed — so you can track uploads in progress. Each entry includes the standard identifier (e.g. 'iso_27001_2022'), upload status, number of clauses extracted, and any error detail. Use this before calling search_org_standards or get_org_standard_clause to see which standards are available. Premium, Team, and Company tier only.

list_org_standards

Browse audit receipts for a date range with filtering and pagination. Use this when someone asks 'show me all queries from last week', 'list audit records for this month', or 'find receipts for a specific conversation'. Returns receipt metadata (timestamps, tool names, query IDs) without ciphertext — use get_receipt for full envelopes. Accepts ISO date strings; supports keyset pagination via next_cursor. A DATE RANGE IS REQUIRED: pass date_from AND date_to (ISO dates, e.g. '2026-06-01'; from_date/to_date are accepted aliases). The range is not defaulted — a call with no range returns a bad_request asking you to supply one, so the caller always chooses the audit window explicitly rather than silently seeing a partial slice of the ledger. limit is capped at 500 rows per page (a larger value is clamped, not rejected); page through the full window with next_cursor.

list_receipts