@uipath/skills 1.196.0 → 1.197.0

package/skills/uipath-governance/references/compliance-pack/disable/impl.md

@@ -0,0 +1,39 @@
+# Disable — Remove Recommended Settings
+
+**Preview gate:** Compliance Standards is a preview feature. Append the disclaimer to user-facing output; on any compliance-packs **403**, stop (org not enrolled). See [preview-gate.md](../preview-gate.md).
+
+Removes all policy deployments configured by the compliance standard.
+
+## Check current state first
+
+```bash
+TENANT_ID=$(grep '^UIPATH_TENANT_ID=' ~/.uipath/.auth | cut -d'=' -f2-)
+uip gov compliance-packs state get tenant $TENANT_ID <packId> --output json
+```
+
+Decide from the `state get` result:
+- **Confirmed inactive** — a successful response with `Data.active == false`, or a 404: reply "ISO 42001 recommended settings are not currently configured on this tenant." and stop (nothing to remove).
+- **State could not be read** — `state get` failed with an auth/connection error (401 / 5xx) so `active` is unknown: do NOT claim "not configured." Proceed to the disable step and report whatever error that call surfaces. (A **403** → preview gate: see [preview-gate.md](../preview-gate.md).)
+
+## Confirmation
+
+```
+This will remove all ISO 42001 recommended settings from <tenantName>.
+
+Policies that will be removed:
+  <list Data.policies[].policyType: Data.policies[].externalPolicyId>
+
+Are you sure? (y/n)
+```
+
+Require `y`. Halt on anything else.
+
+## Disable
+
+```bash
+uip gov compliance-packs state disable tenant $TENANT_ID <packId> --output json
+```
+
+## Report
+
+"ISO 42001 recommended settings removed from `<tenantName>`. All associated policy deployments have been deleted."

package/skills/uipath-governance/references/compliance-pack/full-apply/impl.md

@@ -0,0 +1,164 @@
+# Full Apply — Configure All Recommended Settings
+
+**Preview gate:** Compliance Standards is a preview feature. Append the disclaimer to user-facing output; on any compliance-packs **403**, stop (org not enrolled). See [preview-gate.md](../preview-gate.md).
+
+Applies the entire compliance standard in one command. Backend creates and deploys all recommended settings.
+
+**Note:** This configures settings recommended by ISO 42001. Your organization's auditor determines compliance status — UiPath does not certify compliance.
+
+## Pre-condition
+
+Coverage (posture analysis) has been run and presented. At least one policy has `status: "new"`.
+
+## Confirmation
+
+Build this table from `catalog.clauses[].editorialPolicies[].controls[]` filtered to products where `coverage.deploymentPolicies[].status == "new"`. Group settings by impact. For settings needing user-supplied values (flagged by `synthesize-formdata` notEmpty warnings), list them with a plain-English prompt.
+
+```
+Configure ISO 42001 settings on <tenantName>?
+
+┌──────────┬─────────────────────────────────────────────────────┐
+│ Impact   │ Settings                                            │
+├──────────┼─────────────────────────────────────────────────────┤
+│ High     │ <comma-separated displayNames of High settings,     │
+│ (<N>)    │ truncated to first 3 + "N more">                    │
+├──────────┼─────────────────────────────────────────────────────┤
+│ Medium   │ <comma-separated displayNames, first 3 + "N more">  │
+│ (<N>)    │                                                     │
+├──────────┼─────────────────────────────────────────────────────┤
+│ Low (<N>)│ <comma-separated displayNames>                      │
+└──────────┴─────────────────────────────────────────────────────┘
+
+⚠ <N> settings need values from you:
+  • <controlDisplayName>  — <plain-English prompt for the value>
+  • ...
+(omit the ⚠ section if no settings need user-supplied values)
+
+Proceed? (y/n)
+```
+
+Require `y`. Halt on anything else.
+
+## Apply
+
+```bash
+TENANT_ID=$(grep '^UIPATH_TENANT_ID=' ~/.uipath/.auth | cut -d'=' -f2-)
+uip gov compliance-packs state enable tenant $TENANT_ID <packId> --output json
+```
+
+`state enable` is idempotent — safe to call even if partially applied.
+
+## Verify
+
+```bash
+uip gov compliance-packs state get tenant $TENANT_ID <packId> --output json
+```
+
+Parse `Data.active` (must be `true`) and `Data.policies[]` (policy UUIDs created).
+
+## Report
+
+```
+ISO 42001 settings configured on <tenantName> ✓
+
+SUMMARY
+┌───────────────────────────────────┬───────────┐
+│ Settings before                   │ <N> / <T> │
+│ Settings after                    │ <T> / <T> │
+│ High impact settings configured   │ <N>       │
+└───────────────────────────────────┴───────────┘
+
+⚠ Manual configuration needed:
+┌──────────────────────┬──────────────────────────────────────────────┐
+│ Control              │ Where                                        │
+├──────────────────────┼──────────────────────────────────────────────┤
+│ <controlDisplayName> │ <configLocation from catalog>                │
+└──────────────────────┴──────────────────────────────────────────────┘
+(omit the ⚠ table if no SKIPped controls)
+
+Applied by: <UIPATH_USER from ~/.uipath/.auth>  ·  <tenantName>  ·  <date>
+Note: compliance status is determined by your auditor, not this tool.
+```
+
+## Org-scope deployment (all tenants)
+
+When the user says "apply to all tenants", "organization-wide", or "entire org", configure each tenant individually.
+
+> **Note:** `state enable organization` is exposed by the CLI but is not implemented on the backend — calling it has no effect. The correct approach is to iterate over all tenants in the org and call `state enable tenant` for each one.
+
+### Step 1 — Discover all tenants in the org
+
+```bash
+uip login tenant list --output json > "$SESSION_TEMP/tenants.json"
+```
+
+Parse `Data[].TenantName` and `Data[].TenantId` for the list of tenants.
+
+### Step 2 — Run posture analysis per tenant
+
+For each tenant, run coverage to understand current state:
+
+```bash
+uip gov compliance-packs state coverage tenant <tenantId> <packId> --output json
+```
+
+Aggregate results: note how many tenants have gaps vs are already fully Applied.
+
+### Step 3 — Confirmation
+
+```
+Configure ISO 42001 settings across all tenants in <UIPATH_ORGANIZATION_NAME>?
+
+Tenants to configure:
+  <tenantName1> — <N> settings Not Applied
+  <tenantName2> — <N> settings Not Applied
+  <tenantName3> — already fully Applied (will skip)
+
+<totalTenantsToConfig> tenants will be configured. Your auditor determines compliance status.
+Continue? (y/n)
+```
+
+Require `y`. Halt on anything else. Skip tenants where `NewCount == 0` (all settings already Applied).
+
+### Step 4 — Enable per tenant
+
+For each tenant with gaps, call enable individually:
+
+```bash
+for each tenant with NewCount > 0:
+  uip gov compliance-packs state enable tenant <tenantId> <packId> --output json
+```
+
+### Step 5 — Verify
+
+```bash
+for each configured tenant:
+  uip gov compliance-packs state get tenant <tenantId> <packId> --output json
+```
+
+### Report
+
+```
+ISO 42001 settings configured across <N> tenants in <UIPATH_ORGANIZATION_NAME> ✓
+
+┌──────────────────┬──────────────────┐
+│ Tenant           │ Status           │
+├──────────────────┼──────────────────┤
+│ <tenantName1>    │ Applied ✓        │
+│ <tenantName2>    │ Applied ✓        │
+│ <tenantName3>    │ Already Applied  │
+└──────────────────┴──────────────────┘
+
+Applied by: <user>  ·  <date>
+Note: compliance status is determined by your auditor, not this tool.
+```
+
+## Error handling
+
+| Error | Action |
+|---|---|
+| Any compliance-packs call → **403 / Forbidden** | Org not enrolled in the Compliance Standards preview — stop, do not retry, run no further compliance commands. Show the opt-in message. See [preview-gate.md](../preview-gate.md). |
+| `state enable` → 4xx (non-403) | Halt. Report error verbatim. Do NOT retry. |
+| `state enable` → 5xx AND `"Retry": "RetryWillNotFix"` | Halt. Report error verbatim. Do NOT retry — the server explicitly flagged retrying as futile. |
+| `state enable` → 5xx (transient, no `RetryWillNotFix`) | Retry once after a short pause. If it fails again, halt and report. |
+| `Data.active != true` after enable | Unexpected — ask user to run `state get` manually and report the output. |

package/skills/uipath-governance/references/compliance-pack/partial-apply/impl.md

@@ -0,0 +1,266 @@
+# Partial Apply — Implementation
+
+**Preview gate:** Compliance Standards is a preview feature. Append the disclaimer to user-facing output; on any compliance-packs **403**, stop (org not enrolled). See [preview-gate.md](../preview-gate.md).
+
+Synthesizes and deploys AOPS policies for the NLP-matched clause/product subset only. Used when the user asked for specific settings rather than the full standard.
+
+**Note:** This configures a subset of ISO 42001 recommended settings. Your organization's auditor determines compliance status.
+
+## Inputs from planning.md
+
+- `targetClauseIds` — comma-separated ISO clauseIds matched from catalog
+- `targetProducts` — list of productIdentifiers matched from catalog
+
+## Step 1: Synthesize formData overrides per product
+
+Run the shipped [`synthesize-formdata`](synthesize-formdata-guide.md) script (args, exit codes, and warning handling are in that guide). For each `productIdentifier` in `targetProducts`:
+
+```bash
+# Read the session dir written by catalog get — same unique dir across all tool calls.
+SESSION_TEMP=$(cat "$HOME/.uipath-compliance-current-session")
+```
+```powershell
+# Windows PowerShell
+$tmpDir = (Get-Content "$env:TEMP\uipath-compliance-current-session.txt" -Raw).Trim()
+```
+
+```bash
+# Run the shipped script in place (do NOT recreate it). See synthesize-formdata-guide.md.
+# <SKILL_DIR> = the folder containing this skill's SKILL.md.
+node "<SKILL_DIR>/scripts/synthesize-formdata.mjs" \
+  --catalog    "$SESSION_TEMP/catalog.json" \
+  --product    "<productIdentifier>" \
+  --clause-ids "<clauseId1,clauseId2,...>" \
+  --out        "$SESSION_TEMP/overrides/<product>.json"
+```
+
+Exit 3 = no contributions for this product in these clauses → skip it, continue.
+
+## Step 1b: Collect user-specific values (if any)
+
+After running `synthesize-formdata.mjs`, check **stderr** for `⚠` warning lines indicating settings that need org-specific values. (The script uses `console.warn` which writes to stderr, not stdout.)
+
+For each warned key, ask the user before proceeding:
+
+```
+Some recommended settings require values specific to your organization.
+
+⚠ allowed-urls (UIAutomation Allowed URLs):
+  Which URLs should UIAutomation be allowed to access?
+  Enter as comma-separated list, or SKIP to configure manually in the Admin console later.
+  → 
+```
+
+Accept responses:
+- Non-empty list → write the parsed array into `$SESSION_TEMP/overrides/<product>.json` at the warned key path before moving to Step 2
+- `SKIP` → leave the key absent from overrides; surface it in the AOps review gate (Step 4) as a setting that needs manual configuration, with the setting's `configLocation` from catalog
+
+**Writing collected values into overrides (example for URL list):**
+
+```bash
+node -e "
+  const fs = require('fs');
+  const p = '$SESSION_TEMP/overrides/Robot.json';
+  const o = JSON.parse(fs.readFileSync(p, 'utf8'));
+  o['allowed-urls'] = ['https://example.com', 'https://api.example.com'];
+  fs.writeFileSync(p, JSON.stringify(o, null, 2));
+"
+```
+
+## Step 2: Bootstrap template defaults (one call per targetProduct)
+
+Use `products/` as the output dir — this matches the AOps plugin's `$SESSION_DIR/products/` layout so `$SESSION_TEMP` doubles as `SESSION_DIR` for the handoff in Step 4.
+
+Fetch only the products being configured — **do NOT use `template list`** (that fetches all 14 products; partial apply touches 1–2).
+
+```bash
+# Bash — one call per product
+for product in "${targetProducts[@]}"; do
+  mkdir -p "$SESSION_TEMP/products/$product"
+  uip gov aops-policy template get "$product" \
+    --output-form-data "$SESSION_TEMP/products/$product/form-data.json" \
+    --output json
+done
+```
+```powershell
+# Windows PowerShell
+foreach ($product in $targetProducts) {
+  New-Item -ItemType Directory -Force "$tmpDir\products\$product" | Out-Null
+  uip gov aops-policy template get $product `
+    --output-form-data "$tmpDir\products\$product\form-data.json" `
+    --output json
+}
+```
+
+## Step 3: Merge overrides onto template defaults
+
+Run the shipped [`merge-overrides`](merge-overrides-guide.md) script (merge rules and exit codes are in that guide).
+
+```bash
+# Run the shipped script in place (do NOT recreate it). See merge-overrides-guide.md.
+# <SKILL_DIR> = the folder containing this skill's SKILL.md.
+node "<SKILL_DIR>/scripts/merge-overrides.mjs" \
+  --base      "$SESSION_TEMP/products/<product>/form-data.json" \
+  --overrides "$SESSION_TEMP/overrides/<product>.json" \
+  --out       "$SESSION_TEMP/merged/<product>.json" \
+  --summary
+```
+
+## Step 4: Hand off to AOps for policy creation (one product at a time)
+
+The compliance pack is the source of what values to set. The AOps plugin is the create mechanic. For each product where merge succeeded:
+
+**Pre-conditions already satisfied:**
+- Bootstrap is done — `$SESSION_TEMP/products/<ProductName>/` holds the templates (AOps `SESSION_DIR` = `$SESSION_TEMP`)
+- Policy data is already fully composed at `$SESSION_TEMP/merged/<product>.json`
+
+**Handoff instruction to AOps (`aops-policy-manage-guide.md` — Create flow):**
+
+1. **Skip bootstrap** (already done). Set `SESSION_DIR = $SESSION_TEMP`.
+2. **Case A** — product already known. Skip intent inference.
+3. **Skip form.io traversal** — policy data is already composed. Copy `$SESSION_TEMP/merged/<product>.json` to `$SESSION_TEMP/aops-policy-data.json`.
+4. **Policy name:** `iso-42001-2023-<scopeToken>-<product-kebab>` — see Internal policy naming note below.
+5. **Proceed to review gate** (AOps Critical Rules #15/#16):
+   - AOps compares `aops-policy-data.json` against `products/<product>/form-data.json` defaults — the diff is exactly the compliance standard-recommended settings for the targeted clauses, nothing more.
+   - Show the confirmation gate using this template:
+
+```
+Configure ISO 42001 settings on <tenantName>?
+
+<clauseName>  (<clauseId>)
+┌───────────────────────────────────┬─────────────────────┬────────┐
+│ Setting                           │ Recommendation      │ Impact │
+├───────────────────────────────────┼─────────────────────┼────────┤
+│ <controlDisplayName>              │ <recommendedSetting>│ High   │
+│ <controlDisplayName>              │ <recommendedSetting>│ Medium │
+└───────────────────────────────────┴─────────────────────┴────────┘
+[repeat table per clause if multiple clauses matched]
+
+<N> settings  ·  <productDisplayName> only
+Other products will NOT be affected.
+
+⚠ Some settings need manual configuration after apply:
+  • <controlDisplayName>  →  <configLocation from catalog>
+(omit ⚠ block if no SKIPped settings)
+
+These settings improve your posture towards ISO 42001 requirements.
+Proceed? (y/n)
+```
+
+Build setting rows from: `catalog.clauses[].editorialPolicies[].controls[]` filtered to `targetClauseIds` and `targetProducts`. Use `controls[].displayName` as setting name, `controls[].recommendedSetting` as recommendation, `controls[].impact` as impact.
+
+Require y. Halt on anything else.
+
+> **Internal policy naming:** `iso-42001-2023-<scopeToken>-<product-kebab>` — scopeToken per product: `aitl` (AITrustLayer), `dev` (Development), `robot` (Robot), `asst` (Assistant), `stw` (StudioWeb), `is` (IntegrationService); per clause subset: `a628` (A.6.2.8), `a92` (A.9.2); per impact subset: `high`.
+6. On `yes` → AOps runs `aops-policy create` → **return the policy UUID to partial apply**.
+7. On failure or skip → log product as `skipped`, continue to next product.
+
+**Collect all policy UUIDs** from successful creates before proceeding to Step 5.
+
+## Step 5: Deploy to tenant — single consolidated call
+
+`deployment tenant configure` is a FULL REPLACE. Always read current state first.
+
+```bash
+uip gov aops-policy deployment tenant get $TENANT_ID --output json \
+  > "$SESSION_TEMP/current-assignments-raw.json"
+```
+
+**Windows (PowerShell):** Read the session dir from the sentinel file written by `catalog get` — never use a fixed hardcoded path (that causes cross-session contamination). `$tmpDir = (Get-Content "$env:TEMP\uipath-compliance-current-session.txt" -Raw).Trim()`
+
+Build the new assignments array using Node.js to handle PascalCase CLI output and correct JSON serialization. Write a script `$SESSION_TEMP/merge-assignments.mjs`:
+
+```js
+import fs from 'node:fs';
+const tmpDir = process.argv[2];
+// Read from file — avoids PowerShell inline-JSON quoting issues (see Fix 2 below)
+const policyEntries = JSON.parse(fs.readFileSync(`${tmpDir}/policy-entries.json`, 'utf8'));
+const raw = JSON.parse(fs.readFileSync(`${tmpDir}/current-assignments-raw.json`, 'utf8'));
+// CLI returns PascalCase — dual-case handles both PascalCase and camelCase variants.
+// TenantPolicies must be resolved before mapping, otherwise existing resolves to []
+// and deployment configure silently wipes all current tenant pins (full replace!).
+const policies = raw.Data?.TenantPolicies ?? raw.Data?.tenantPolicies ?? [];
+const existing = policies
+  .map(p => ({
+    productIdentifier:     p.ProductIdentifier     ?? p.productIdentifier,
+    licenseTypeIdentifier: p.LicenseTypeIdentifier ?? p.licenseTypeIdentifier,
+    // Preserve null ("No Policy" pin) — dropping the key causes the API to reject with "must be string or null"
+    policyIdentifier: p.PolicyIdentifier !== undefined ? p.PolicyIdentifier : (p.policyIdentifier ?? null),
+  }))
+  .filter(p => !policyEntries.some(e => e.product === p.productIdentifier));
+for (const e of policyEntries) {
+  existing.push({ productIdentifier: e.product, licenseTypeIdentifier: e.licenseType, policyIdentifier: e.policyId });
+}
+fs.writeFileSync(`${tmpDir}/new-assignments.json`, JSON.stringify(existing, null, 2));
+console.log(`Written ${existing.length} entries`);
+```
+
+Write `policy-entries.json` first (avoids PowerShell inline-JSON quoting issues):
+```bash
+# Bash
+printf '%s' '[{"product":"AITrustLayer","licenseType":"NoLicense","policyId":"<uuid>"}]' \
+  > "$SESSION_TEMP/policy-entries.json"
+```
+```powershell
+# Windows PowerShell
+'[{"product":"AITrustLayer","licenseType":"NoLicense","policyId":"<uuid>"}]' |
+  Set-Content "$tmpDir\policy-entries.json" -NoNewline
+```
+
+Then run:
+```bash
+node "$SESSION_TEMP/merge-assignments.mjs" "$SESSION_TEMP"
+```
+```powershell
+# Windows PowerShell
+node "$tmpDir\merge-assignments.mjs" $tmpDir
+```
+
+licenseType per product: `AITrustLayer→NoLicense`, `Development→Development`, `StudioWeb→Development`, `Robot→Attended`, `Assistant→NoLicense`, `Integration Service→NoLicense`
+
+**Input file format** — only 3 fields; `tenantIdentifier` and `tenantName` are added by the CLI from its own arguments, not from the file:
+```json
+[
+  { "productIdentifier": "<p>", "licenseTypeIdentifier": "<l>", "policyIdentifier": "<uuid-or-null>" }
+]
+```
+
+```bash
+uip gov aops-policy deployment tenant configure $TENANT_ID \
+  --tenant-name "$TENANT_NAME" \
+  --input       "$SESSION_TEMP/new-assignments.json" \
+  --output json
+```
+
+## Report (after successful apply)
+
+```
+ISO 42001 settings configured on <tenantName>.
+
+┌───────────────────────────────────┬───────────┐
+│ Settings configured               │ <N>       │
+│ Clauses addressed                 │ <N>       │
+│ High impact settings              │ <N>       │
+└───────────────────────────────────┴───────────┘
+
+⚠ Manual configuration needed:
+┌──────────────────────┬──────────────────────────────────────────────┐
+│ Control              │ Where                                        │
+├──────────────────────┼──────────────────────────────────────────────┤
+│ <controlDisplayName> │ <configLocation>                             │
+└──────────────────────┴──────────────────────────────────────────────┘
+(omit ⚠ table if no SKIPped settings)
+
+Applied by: <UIPATH_USER from ~/.uipath/.auth>  ·  <tenantName>  ·  <date>
+
+To configure all ISO 42001 settings: 'Apply the full ISO 42001 standard'
+```
+
+## Error handling
+
+| Error | Action |
+|---|---|
+| Any compliance-packs call (e.g. `catalog get`) → **403 / Forbidden** | Org not enrolled in the Compliance Standards preview — stop, do not retry. Show the opt-in message. See [preview-gate.md](../preview-gate.md). |
+| `synthesize-formdata.mjs` exit 3 | Skip that product. Log: "No recommended settings found for <product> in selected clauses." Continue. |
+| `aops-policy create` → 4xx | Halt. Report error verbatim. Do NOT retry. |
+| `deployment tenant configure` → 4xx | Halt. Report error verbatim. |

package/skills/uipath-governance/references/compliance-pack/partial-apply/merge-overrides-guide.md

@@ -0,0 +1,28 @@
+# merge-overrides — usage
+
+Deep-merges compliance pack overrides onto a base formData object (template defaults for new policies, or
+existing deployed policy data for subset updates). Output is ready to pass directly to
+`uip gov aops-policy create|update --input`.
+
+**Script (shipped, executable):** `<SKILL_DIR>/scripts/merge-overrides.mjs`
+(`<SKILL_DIR>` = the folder containing this skill's `SKILL.md`). Run it in place — do NOT recreate it.
+
+```bash
+node "<SKILL_DIR>/scripts/merge-overrides.mjs" \
+  --base      "$SESSION_TEMP/products/<product>/form-data.json" \
+  --overrides "$SESSION_TEMP/overrides/<product>.json" \
+  --out       "$SESSION_TEMP/merged/<product>.json" \
+  --summary
+```
+
+`--summary` prints the list of overridden paths — useful for confirming which compliance pack settings
+were applied.
+
+**Merge rules:**
+- Objects → recursive key-by-key merge
+- Arrays → wholesale replace (override wins; `[]` is a deliberate clear)
+- Scalars → replace
+- Explicit `null` → clear that leaf
+- Paths the override doesn't touch → kept from base
+
+**Exit codes:** `0` = merged file written · `2` = missing or malformed inputs.

package/skills/uipath-governance/references/compliance-pack/partial-apply/planning.md

@@ -0,0 +1,82 @@
+# Partial Apply — When and How to Route Here
+
+Enter this plugin when the user explicitly scoped their request to a subset of the pack's recommended settings.
+
+> **Critical:** Partial apply uses `synthesize-formdata.mjs` + `aops-policy create`. Do NOT call `uip gov compliance-packs state enable` — that applies the full standard and cannot be scoped.
+
+## Strong signals → route silently to partial apply
+
+- Named a specific product domain: "AI Trust Layer", "Studio", "Robot", "Assistant", "Studio Web", "Integration Service"
+- Named a specific ISO clause: "A.6.2.8", "clause 6.1.4", "A.9.2"
+- Named a traceable category keyword:
+
+| User phrase | Product(s) | What to look up in catalog |
+|---|---|---|
+| "traceability" / "audit logging" / "trace retention" / "logged and traceable" / "AI usage logged" / "AI activity traceable" / "traceable for audit" | AITrustLayer, Robot | Clauses mentioning trace in controls |
+| "guardrails" / "prompt injection" / "sensitive data" / "PII" | AITrustLayer | Clauses with guardrail controls |
+| "model governance" / "allowed models" / "LLM providers" / "lock down AI model providers" / "which AI providers are approved" / "approved AI providers" / "AI model providers approved for use" | AITrustLayer | Clauses with model toggle controls |
+| "restrict which URLs robots access" / "robot URL allowlist" / "applications our robots are allowed to automate" / "URL and application allowlists" / "robot automation allowlists" | Robot | Clauses with UIAutomation URL/app controls |
+| "publishing controls" / "release notes" / "workflow analyzer" | Development | Clauses with analyzer/publish controls |
+| "healing agent" / "self-healing" | Robot | Clauses with healing agent controls |
+| "connector" / "integration service" | Integration Service | Clauses with connector controls |
+| "high-impact" / "critical controls" | All products | Filter by `impact: "High"` in catalog |
+
+## Identifying clauseIds and products from catalog data
+
+From `catalog.clauses[]`:
+- Match user's content words against `clause.clauseName`, `controls[].displayName`, `controls[].description`, `controls[].configLocation`
+- The matching `clause.clauseId` → use in `synthesize-formdata.mjs --clause-ids`
+- The matching `editorialPolicy.productIdentifier` → use in `synthesize-formdata.mjs --product`
+
+## Controls that require user-supplied values
+
+Some controls have `notEmpty: true` in their required operator — the standard says "this must be configured" but the specific values are org-specific. `synthesize-formdata.mjs` logs a `⚠` warning for these.
+
+Common examples:
+
+| Control | What to ask the user |
+|---|---|
+| Allowed Models List (AITL-003) | "Which AI model providers should be approved for your org?" |
+| BYOM endpoint (AITL-004) | "What is your Azure OpenAI or Bedrock endpoint URL?" |
+| Allowed URLs — UIAutomation (RBT-UIA-001) | "Which URLs should UIAutomation be allowed to access? (comma-separated)" |
+| Forbidden URLs (RBT-UIA-002) | "Which URLs should UIAutomation be blocked from?" |
+| Allowed Applications (RBT-UIA-003) | "Which applications should UIAutomation be allowed to interact with?" |
+| Forbidden Applications (RBT-UIA-004) | "Which applications should be blocked?" |
+
+When `synthesize-formdata.mjs` logs `⚠` warnings, check this table and collect values from the user before merging (see [impl.md](impl.md) Step 1b).
+
+## Ambiguous signals → ask before proceeding
+
+When the user's phrase matches controls across 3+ product domains, present numbered options:
+
+```
+I found settings matching '<phrase>' in:
+  1. <product 1> — <N> controls [<control names>]
+  2. <product 2> — <N> controls [<control names>]
+  3. <product 3> — <N> controls [<control names>]
+Which did you mean? (enter numbers like "1,3" or "all")
+```
+
+Wait for user response. Do NOT guess and proceed. Do NOT silently configure more than the user asked for.
+
+## Scope expansion note
+
+After identifying target clauses and products, always show:
+
+```
+You asked for: <user's phrase>
+I matched: <N> recommended settings across <M> product(s)
+Note: The full ISO 42001 pack covers <total> recommended settings across <total products>.
+Configuring this selection will NOT apply settings for the other products.
+```
+
+## Org-scope partial apply
+
+When the user adds an org-level signal ("apply the traceability settings organization-wide"), partial logic uses the `organization` scope for `synthesize-formdata.mjs` synthesis (note: synthesize operates on catalog data which is org-agnostic), but `aops-policy create` targets the tenant logged into. For true org-scope partial apply, iterate over all tenants: run `synthesize-formdata.mjs` + `aops-policy create` per tenant (the same per-tenant flow). `state enable organization` is NOT implemented on the backend — never call it.
+
+## See also
+
+- [impl.md](impl.md) — the per-step apply implementation.
+- [synthesize-formdata-guide.md](synthesize-formdata-guide.md) — the `synthesize-formdata` script (args, exit codes, warnings).
+- [merge-overrides-guide.md](merge-overrides-guide.md) — the `merge-overrides` script (merge rules, exit codes).
+- `assets/examples/partial-apply-example.md` — worked example of the full flow.

package/skills/uipath-governance/references/compliance-pack/partial-apply/synthesize-formdata-guide.md

@@ -0,0 +1,22 @@
+# synthesize-formdata — usage
+
+Extracts compliance pack catalog contributions for a given product + clause subset and writes them as a
+flat formData overrides object.
+
+**Script (shipped, executable):** `<SKILL_DIR>/scripts/synthesize-formdata.mjs`
+(`<SKILL_DIR>` = the folder containing this skill's `SKILL.md`). Run it in place — do NOT recreate it.
+
+```bash
+node "<SKILL_DIR>/scripts/synthesize-formdata.mjs" \
+  --catalog    "$SESSION_TEMP/catalog.json" \
+  --product    "<productIdentifier>" \
+  --clause-ids "<clauseId1,clauseId2,...>" \
+  --out        "$SESSION_TEMP/overrides/<product>.json"
+```
+
+**Exit codes:** `0` = written · `2` = bad args · `3` = no contributions for product+clauses (skip this
+product, continue).
+
+**Warnings on stderr:** the script uses `console.warn` (→ stderr, not stdout). Lines starting with `⚠`
+indicate controls whose values are org-specific (`notEmpty`) or are access-policy checks (`exists`) —
+collect those values from the user before proceeding (see [impl.md](impl.md) Step 1b).

package/skills/uipath-governance/references/compliance-pack/preview-gate.md

@@ -0,0 +1,43 @@
+# Compliance Standards — Preview Gate & Disclaimer
+
+Compliance Standards (ISO 42001 and any future standard) is a **preview feature**, available only to
+organizations enrolled in the UiPath preview program. This applies to **every** compliance-pack flow —
+catalog, coverage, full-apply, partial-apply, disable, query, state list, diagnose. This file is the
+single source of truth for both behaviors below; other plugins link here rather than restating them.
+
+## 1. Preview disclaimer (on success)
+
+Append this disclaimer as a footer to **user-facing display output** for any compliance-standard
+response — chat replies, the posture plan (`posture_plan.txt`), catalog/query answers, apply/disable
+receipts, and standard-list output:
+
+```
+ⓘ Compliance Standards is a preview feature, available to organizations enrolled in the UiPath
+  preview program. Capabilities and behavior may change before general availability.
+```
+
+- Include it **once per response**, as a footer under the actual result — not after every table.
+- **Do NOT** write it into internal session/JSON files the flow persists for the checker or itself
+  (`coverage.json`, `report.json`, catalog cache). Those hold raw API data only. The disclaimer is
+  display text, not data.
+
+## 2. 403 → preview not enabled (stop the flow)
+
+If **any** `uip gov compliance-packs …` call (`catalog get`, `state coverage|get|list|enable|disable`)
+returns **HTTP 403 / Forbidden**, the organization is not enrolled in the preview. **Stop immediately:**
+do not retry, and run no further compliance commands. Present exactly this, then end the flow:
+
+```
+Compliance Standards isn't enabled for your organization yet.
+
+It's currently a preview feature, and access requires enrolling in the UiPath preview program.
+To request access, contact your UiPath account team or organization administrator, then re-run
+this request.
+```
+
+### 403 is NOT 401
+
+A **403 (Forbidden)** means authenticated-but-not-entitled → the preview gate above.
+A **401 (Unauthorized)** means not logged in → a normal auth failure; handle it per the flow's usual
+auth handling (`uip login`), NOT with the preview message. Never conflate the two — do not tell a
+logged-out user to "enroll in preview," and do not tell an unenrolled user to "log in again."