From the first drift detection to sealing the report — see what the agent does, in which framework, and how fast, with two illustrative example workflows.
The autonomous-remediation loop
Every signal is compared against the desired per-check baseline and flagged as drift — triggering the loop the moment the scan surfaces it.
For every drift the agent automatically gathers supporting artifacts — permissions, settings, log files — and organises them into a per-check evidence folder. See how evidence maps to each framework on the compliance frameworks page.
For each drift the agent proposes a remediation and either applies it automatically (when the surrounding policy permits it) or queues it for explicit human approval — the agent never writes production changes without one of those paths being satisfied. Once applied, the agent verifies the baseline is restored before closing the incident.
The incident is sealed with an audit-ready package — timestamps, proof-traces, and a mapping to the relevant clause of the framework.
Illustrative scenarios
Two fictional walkthroughs — one based on an expired TLS certificate on the made-up domain portal.example.gr, one on a missing ROPA entry. They are NOT real production incidents and the example domain is fictional. Every event still maps to the four-step diagram: detect, evidence, remediate, close.
01 · Detect drift
At 03:00 the TLS scanner flagged the certificate as drift against the 30-day renewal baseline.
02 · Collect evidence
Within <60s the agent gathered the CSR, ACME account, SNI chain and the latest health-check result — all archived per check.
03 · Remediate
Where policy permitted, the agent submitted a renewal to the ACME provider, replaced the certificate on the reverse proxy, and verified that the chain was accepted — any action that would have changed production data outside the agent's allowed scope was queued for human approval instead.
04 · Close ticket
The ticket auto-closed at 03:04 — audit-ready package with timestamps, screenshots, and a mapping to the relevant clause of the framework.
01 · Detect drift
Comparison against the per-framework flow catalog flagged the vendor as unregistered in the GDPR processing stream.
02 · Collect evidence
The agent gathered a screenshot of the vendor's console, the list of processed fields, and the sub-processor settings — all into a per-check folder.
03 · Remediate
The agent drafted a ROPA entry with the scan's details, notified the DPO, and proposed the relevant GDPR obligations.
04 · Close ticket
Once the DPO accepted, the ticket closed and the entry was promoted to the production ROPA — with a full audit-ready package for the supervisory authority if needed.
Next step
Create an account to see the agent in action, or start with the autonomous 10-question GDPR self-assessment.