filegrc 0.16.3 → 0.16.5

package/src/program-path.js

@@ -1,53 +1,103 @@
 import { ACTIVE_MODEL_VERSION, modelSupports } from "../model/index.js";
 
 export const RESOURCE_INSTRUCTIONS = {
-  program: "Define one management compliance or assurance Program with its goal, bounded Systems, selected Frameworks, Requirement applicability decisions, Controls, owners, risk method, and candidate period.",
-  person: "Record each person’s actual organizational job title. Keep named program authority, such as CISO, DPO, Policy Owner, or team chair, in dated Appointment records.",
-  appointment: "Record one person’s dated appointment to a named organizational or program responsibility. Scope it to the workspace, a team, or the records governed by that appointment.",
-  team: "Review the starter Security and Risk Oversight team, including its members and chair. Membership and chairs are authoritative on the Team record.",
-  system: "Start with the complete bounded System management governs or the auditor will examine. Record its purpose, services, boundary, exclusions, Information Types, owners, and any applicable continuity objectives.",
-  component: "Add a Component only when it materially delivers a selected System, supports a Control, produces authoritative Evidence, or supports relevant operations. Give every System use a role and rationale.",
-  vendor: "Catalog material external provider relationships. Link a supplied Component when it meets the Component inclusion rules, but do not mirror every Vendor into a Component.",
-  classification: "Review the starter information-handling categories and ordering against management's actual protection decisions, then use the approved Classifications on inventory and Evidence Artifacts.",
-  "information-type": "Define a stable category of information and its default Classification, then link it from Systems, Components, and Vendors.",
-  framework: "Confirm the criteria framework and version used for the program.",
-  requirement: "Keep the published criterion as catalog content. Record management applicability and rationale on the selected Program.",
-  commitment: "Record supplemental customer promises and service requirements that shape the scope or control design. The Commitment’s systemIds and controlIds are authoritative for what fulfills it.",
-  "requirement-mapping": "Use a Requirement Mapping when supplemental policies, contracts, privacy promises, frameworks, or other sources need explicit coverage semantics. Choose the comparison method and relationship, explain the rationale, and bind the review to every mapped source revision.",
-  "reporting-route-set": "Prepare the normal and fallback ways people will send each report required by proposed program content, including where each channel goes and the role that keeps it usable. Commit the proposal in Step 1, approve it before cutover, use separate approval and ongoing authority Appointments, and create a successor when either channel changes.",
-  policy: "Tailor each Policy to match what the company is committing to. Clear placeholders, assign an owner and separate approver, then bind approval to the reviewed content. Approval does not prove implementation. Activate the Policy during the Step 3 cutover after reviewing its implementation gaps.",
-  document: "Complete required program Documents in Step 2, assign an owner and separate approver, and bind approval to the intended values and exact Markdown. Implement the linked requirements and activate that approved revision in Step 3. Prepare Audit Documents in Step 5.",
-  control: "Finish each applicable starter Control with the procedure people follow, its owner, bounded System scope, operating Components, authoritative evidence-source Components, governing Policy and Requirement mappings, and implementation date. Put calendar and event schedules in Obligations.",
-  "complementary-control": "Review whether any in-scope Control depends on a customer or carved-out provider action. Record each real dependency, or confirm that the current scope has none.",
-  evidence: "Create an Evidence Artifact when a real export, report, screenshot, signed file, or approved external reference exists. Select its authoritative source Component, link the Controls and operating records it supports, retain the fixed artifact or reference, and have another person verify it before audit use.",
-  "risk-assessment": "Complete and approve an assessment of the risks to the in-scope service, systems, vendors, and commitments.",
-  risk: "Record each risk identified by an assessment or operating activity. Assign an owner, rate it, document the chosen response, and link the Controls that treat it from the Risk record.",
-  obligation: "Review the recurring work proposed by effective policies. Confirm who owns it, when it is due, and what proof completion requires.",
-  "retention-schedule-item": "Use one structured row for each reviewed retention rule. Name its Information Types, scope, cutoff, period, disposition, sources, owner, and approval. Keep unknown organization values planned for management review.",
-  "obligation-event": "When a policy-triggering event occurs, record it here and complete the actions filegrc creates for it.",
-  "policy-review": "Record scheduled and change-driven reviews of policies and governed documents, including the decision and any follow-up.",
-  meeting: "Record required oversight meetings, including attendees, decisions, minutes, and follow-up work.",
-  exception: "Record and approve any time-limited departure from a policy or control before the departure begins.",
-  asset: "Keep the inventory of important devices, software, media, and records current, including ownership, custody, and status.",
-  "vendor-review": "Document due diligence before relying on a provider, then repeat the review on schedule or after a material change.",
-  "access-grant": "Record each person’s or service account’s access to a Component, including approval, provisioning, changes, and removal.",
-  "access-review": "Review access on schedule, record each decision, and assign any access changes that result.",
-  "service-account": "Catalog non-human accounts that need separate tracking, including their owner, purpose, System, privilege, and expiry.",
-  training: "Review and approve the exact Training content in Step 2, then activate the unchanged revision during Step 3 after its linked Controls and assignment Obligations are ready.",
-  attestation: "Record each person’s completion or acknowledgement against the exact policy or training revision.",
-  "vulnerability-scan": "Record each required scan, including its scope, timing, result, and evidence.",
-  vulnerability: "Track confirmed weaknesses that need separate remediation, acceptance, or closure.",
-  "penetration-test": "Record each penetration test, including its provider, scope, period, result, and evidence.",
-  incident: "Record qualifying security or privacy events and manage their response and follow-up.",
-  "backup-test": "Record each restore test, including the Systems tested, result, timing, evidence, and follow-up.",
-  exercise: "Record each incident or continuity exercise, including its objective, participants, result, and follow-up.",
-  finding: "Create a Finding only for a confirmed gap that needs separate remediation tracking. Keep the report details in the source record’s Markdown, then assign the Finding, set its due date, and verify closure.",
-  "action-item": "Create an Action Item only when follow-up needs its own assignee, deadline, and completion proof. Point it to the record that created the work, then work it from Work Queue.",
-  audit: "Create this record after engaging the CPA firm, then select the Program and record the agreed scope, criteria, Systems, subservice treatments, and report period. Control Tests and Evidence Artifacts link back with auditId or auditIds.",
-  "audit-request": "When FileGRC is the approved request tracker, record each request from the audit team, assign an owner and due date, and link the approved response and evidence.",
-  "data-request": "Record privacy or contractual requests when they apply to the audit scope or the organization’s commitments.",
-  "control-test": "Record a management Control Test only when management performs and reviews one. The CPA firm records its own independent testing separately.",
-  "audit-population": "Record each complete Type 2 population with its source Component, fixed export, query, count, and reconciliation."
+  program: "Set the Program goal, owners, Systems, Frameworks, criteria decisions, and risk method.",
+  person: "Record the person’s actual job title and current status.",
+  appointment: "Assign a named authority to one Person with its start date and scope.",
+  team: "Confirm the Team’s members and chair.",
+  system: "Define the service boundary, exclusions, owners, and information it handles.",
+  component: "Record a material service or evidence source and its role in each linked System.",
+  vendor: "Record each material external provider and the Components it supplies.",
+  classification: "Confirm the handling categories and apply them to information and evidence.",
+  "information-type": "Name a stable category of information, set its default Classification, and link its uses.",
+  framework: "Select the criteria Framework and version used by the Program.",
+  requirement: "Review whether this criterion applies to the Program and record the decision and rationale.",
+  commitment: "Record a real customer or service promise and link the Systems and Controls that fulfill it.",
+  "requirement-mapping": "Compare the supplemental source with the Requirement or Control, record the relationship and rationale, then review the source revisions.",
+  "reporting-route-set": "Replace the reporting-route placeholders with real normal and fallback channels, name the responsible role, and commit the proposal.",
+  policy: "Replace Policy placeholders with actual commitments, then have a separate approver approve the exact Markdown revision.",
+  document: "Complete the Document Markdown and intended values, assign an owner, and have a separate approver approve the exact revision.",
+  control: "Open this Control’s current next steps. Set up the activity, record how it works, and mark it Implemented when it works.",
+  "complementary-control": "Record each real customer or carved-out provider dependency, or confirm that the current scope has none.",
+  evidence: "Record a real artifact or approved reference, link its source and supported work, then have another person verify it.",
+  "risk-assessment": "Assess the in-scope service, record conclusions, and obtain an independent review.",
+  risk: "Name the threat and impact, assign an owner, rate the risk, and record its response.",
+  obligation: "Confirm the owner, cadence or trigger, deadline, and proof, then enable the rule when its Control is ready.",
+  "retention-schedule-item": "Set the Information Types, scope, cutoff, period, disposition, and sources for one retention rule.",
+  "obligation-event": "Record the actual event date and subject, then complete its linked Work Queue actions.",
+  "policy-review": "Record the review date, reviewer, decision, and any required follow-up.",
+  meeting: "Record attendees, decisions, minutes, and assigned follow-up for the meeting.",
+  exception: "Record the scope, owner, approval, and expiry before the departure begins.",
+  asset: "Record an important Asset’s owner, custody, location, and status.",
+  "vendor-review": "Review one Vendor’s current risk and evidence, then record the decision and follow-up.",
+  "access-grant": "Record the approved privilege, recipient, Component, and provisioning or removal dates.",
+  "access-review": "Review the current access list, record each decision, and assign the required changes.",
+  "service-account": "Record a non-human account’s owner, purpose, System, privilege, and expiry.",
+  training: "Complete the content and audience, then have a separate approver approve the exact revision.",
+  attestation: "Record the person’s dated acknowledgement of the exact active content revision.",
+  "vulnerability-scan": "Record the scan scope, date, result, and supporting evidence.",
+  vulnerability: "Track a confirmed weakness through its owner, response, and closure proof.",
+  "penetration-test": "Record the test provider, scope, period, results, evidence, and follow-up.",
+  incident: "Record the event, response decisions, dates, evidence, and follow-up.",
+  "backup-test": "Record the restore target, date, result, evidence, and follow-up.",
+  exercise: "Record the scenario, participants, date, result, and follow-up.",
+  finding: "Record a confirmed gap that needs its own owner, due date, remediation, and verified closure.",
+  "action-item": "Assign separate follow-up with an owner, deadline, source record, and completion proof.",
+  audit: "After engaging the CPA firm, record the agreed type, scope, Systems, criteria, and period.",
+  "audit-request": "Record the auditor’s request, owner, due date, and approved response.",
+  "data-request": "Record the request scope, decision, response, and supporting evidence.",
+  "control-test": "Record a management test only when it was performed and reviewed; link its result and evidence.",
+  "audit-population": "Record the complete Type 2 population, source query, count, fixed export, and reconciliation."
+};
+
+export const RESOURCE_OUTPUTS = {
+  program: "A Program record with the selected goal, scope, owners, criteria decisions, and risk method.",
+  person: "A Person record with their actual job title and current status.",
+  appointment: "A dated Appointment that names the holder, authority, and scope.",
+  team: "A Team record with its current members and chair.",
+  system: "A bounded System record with its services, data, owners, and exclusions.",
+  component: "A Component record linked to each System it supports, with a role and rationale.",
+  vendor: "A Vendor record for each material provider relationship.",
+  classification: "Reviewed handling categories used by the program's records.",
+  "information-type": "An Information Type with its default Classification and actual uses.",
+  framework: "The Framework and version selected for the Program.",
+  requirement: "A reviewed applicability decision on the Program for each selected Requirement.",
+  commitment: "A Commitment linked to the Systems and Controls that fulfill it.",
+  "requirement-mapping": "A reviewed mapping with its comparison, rationale, and source revisions.",
+  "reporting-route-set": "A proposed set of normal and fallback reporting routes with an owner and approval path.",
+  policy: "An independently approved Policy bound to its exact Markdown revision.",
+  document: "A governed Document with reviewed Markdown, an owner, and a separate approver.",
+  control: "An implemented Control with its actual procedure, scope, owner, source, and start date.",
+  "complementary-control": "A recorded customer or provider dependency, or a current review confirming none.",
+  evidence: "A verified Evidence Artifact linked to its source and supported work.",
+  "risk-assessment": "A completed, independently reviewed Risk Assessment with its conclusions.",
+  risk: "A rated Risk with an owner, response, and linked treatment Controls.",
+  obligation: "An enabled schedule or event rule with an owner, deadline, and required proof.",
+  "retention-schedule-item": "A reviewed retention row with its scope, cutoff, period, disposition, and sources.",
+  "obligation-event": "A dated Policy Event with its linked Work Queue actions.",
+  "policy-review": "A dated review with its decision, reviewer, and follow-up.",
+  meeting: "Meeting minutes with attendees, decisions, and assigned follow-up.",
+  exception: "A time-limited Exception with approval, scope, and expiry.",
+  asset: "An inventory record with the Asset's owner, custody, and status.",
+  "vendor-review": "A dated Vendor Review with a decision, evidence, and follow-up.",
+  "access-grant": "A current Access Grant showing approval, privilege, and lifecycle dates.",
+  "access-review": "A dated Access Review with decisions and assigned changes.",
+  "service-account": "A Service Account record with its owner, purpose, privilege, and expiry.",
+  training: "Approved Training content bound to its exact revision.",
+  attestation: "A person's dated acknowledgement bound to the exact content revision.",
+  "vulnerability-scan": "A dated scan record with scope, results, and linked evidence.",
+  vulnerability: "A tracked weakness with its owner, response, and closure proof.",
+  "penetration-test": "A test record with scope, provider, results, and follow-up.",
+  incident: "An Incident record with response decisions, dates, evidence, and follow-up.",
+  "backup-test": "A dated restore test with its result, evidence, and follow-up.",
+  exercise: "A dated exercise with participants, result, and follow-up.",
+  finding: "A confirmed Finding with an owner, due date, remediation, and verified closure.",
+  "action-item": "An assigned Action Item with a deadline and completion proof.",
+  audit: "An Audit record with the CPA-agreed type, scope, and period.",
+  "audit-request": "An owned Audit Request with a due date and approved response.",
+  "data-request": "A Data Request record with its scope, decision, and response.",
+  "control-test": "A reviewed management Control Test with results and linked evidence.",
+  "audit-population": "A reconciled Type 2 population linked to its fixed source export."
 };
 
 export const RESOURCE_PAGE_SUMMARIES = {
@@ -68,7 +118,7 @@ export const RESOURCE_PAGE_SUMMARIES = {
   "retention-schedule-item": "Review each structured retention rule.",
   policy: "Tailor the starter Policy and have someone other than its owner approve it.",
   document: "Adapt and approve plans.",
-  control: "Describe each Control and its evidence source.",
+  control: "Put each Control in place and record how it works.",
   "complementary-control": "Record customer or provider responsibilities, or confirm there are none.",
   audit: "Record the CPA engagement and scope.",
   "audit-request": "Track fieldwork requests and responses.",
@@ -82,11 +132,11 @@ export const PROGRAM_PATH = [
     number: 1,
     title: "Define Scope",
     description: "Ownership, criteria, and service boundary",
-    summary: "Name the owners, criteria, service, Systems, and providers in scope.",
+    summary: "A reviewed Program scope with owners, criteria, Systems, and material providers.",
     sections: [
-      { id: "ownership", title: "Program Ownership", description: "Confirm who owns the program, plus the normal security reporting channel and its fallback.", steps: ["Confirm the initial program lead’s actual job title and the separate Policy Owner Appointment.", "Add the organization’s real appointments, reviewers, and operators.", "Review the starter Security and Risk Oversight team, its members, and its chair.", "Replace the starter reporting-channel placeholders, propose the set, and commit that proposal before Step 1 is complete. Approve it before the later implementation cutover.", "Add other teams only when the organization assigns shared responsibility to them."], types: ["person", "appointment", "team", "reporting-route-set"], defaultOpen: true },
-      { id: "criteria", title: "Program and Criteria", description: "Define the Program, confirm its Frameworks, record Program-scoped Requirement applicability, and connect customer commitments that shape the System or Control design.", steps: ["Confirm the Program goal, owners, risk method, and candidate period.", "Review the included Security criteria references and record each applicability decision on the Program.", "Replace each planned service-commitment prompt with the actual promise or requirement. Use Requirement Mappings only when a supplemental source needs an explicit coverage comparison. Keep optional criteria out until the company chooses to add them."], types: ["program", "framework", "requirement", "commitment", "requirement-mapping"], defaultOpen: true },
-      { id: "boundary", title: "System Boundary", description: "Start with the bounded System. Add Components that materially deliver the service, support Controls, produce authoritative Evidence, or support relevant operations. Keep Vendor relationships and specific Assets separate.", steps: ["Create the complete bounded System and select it on the Program.", "Add only relevant Components, with a role and rationale for each System use.", "Create Vendors for material external provider relationships and link supplied Components when factual.", "Normalize Information Types and Classifications used by the System, Components, Vendors, Risks, and Evidence Artifacts."], types: ["system", "component", "vendor", "classification", "information-type"], defaultOpen: false }
+      { id: "ownership", title: "Program Ownership", description: "Confirm who owns the program, plus the normal security reporting channel and its fallback.", steps: ["Confirm the program lead, policy owner, independent reviewer, and oversight team.", "Replace the reporting-channel placeholders with real normal and fallback routes, then commit the proposal."], types: ["person", "appointment", "team", "reporting-route-set"], defaultOpen: true },
+      { id: "criteria", title: "Program and Criteria", description: "Define the Program, confirm its Frameworks, record Program-scoped Requirement applicability, and connect customer commitments that shape the System or Control design.", steps: ["Set the Program goal, owners, risk method, and tentative timing.", "Review each selected criterion for this service and record its applicability decision.", "Replace the starter Commitment prompt with the real promise; add only needed supplemental mappings."], types: ["program", "framework", "requirement", "commitment", "requirement-mapping"], defaultOpen: true },
+      { id: "boundary", title: "System Boundary", description: "Start with the bounded System. Add Components that materially deliver the service, support Controls, produce authoritative Evidence, or support relevant operations. Keep Vendor relationships and specific Assets separate.", steps: ["Define the service and exclusions in a bounded System selected by the Program.", "Add material Components and Vendors with their actual System relationships.", "Record the Information Types and Classifications the service uses."], types: ["system", "component", "vendor", "classification", "information-type"], defaultOpen: false }
     ],
     resourceTypes: ["person", "appointment", "team", "reporting-route-set", "program", "framework", "requirement", "commitment", "requirement-mapping", "system", "component", "vendor", "classification", "information-type"],
     commands: [
@@ -108,10 +158,10 @@ export const PROGRAM_PATH = [
     number: 2,
     title: "Approve Policies",
     description: "Approve governed content and retention decisions",
-    summary: "Review and independently approve Policies, program Documents, Training content, and the Data Retention Schedule.",
+    summary: "Approved Policies, program Documents, Training content, and retention decisions.",
     sections: [
-      { id: "policy-content", title: "Policies", description: "Review every program Policy, Document, and Training record in one table, then bind independent approval to each exact revision.", steps: ["Review each governed Markdown artifact and replace every organization placeholder.", "Confirm the owner, separate approver, linked Controls, audience, and intended values that apply to each artifact.", "Record approval and its date against the exact revision. Leave approved content inactive until its Step 3 implementation cutover."], types: [], relatedLinks: [{ type: "policy", label: "Policies", href: "#/policies" }], defaultOpen: true },
-      { id: "retention", title: "Data Retention Schedule", description: "Complete each row proposal, then approve the document and all proposed rows once.", steps: ["Review the schedule policy, legal holds, exceptions, and disposal requirements.", "Have the owner finish each row for the Information Types and operational sources the organization actually uses.", "Trigger one independent approval only after the document and every row proposal are complete."], types: [], utility: "retention-schedule", defaultOpen: true }
+      { id: "policy-content", title: "Policies", description: "Approve the program's governing content.", instructions: "Open each Policy, program Document, and Training record. Replace placeholders, confirm the owner and intended values, then have a separate person approve the exact Markdown revision.", output: "Approved content bound to the reviewed revisions.", steps: ["Replace placeholders with the company's real rules, plans, and training material.", "Confirm the owner, separate approver, linked Controls, audience, and intended values.", "Record the independent approval and date against each exact Markdown revision."], types: [], relatedLinks: [{ type: "policy", label: "Policies", href: "#/policies" }], defaultOpen: true },
+      { id: "retention", title: "Data Retention Schedule", description: "Approve the schedule document and its completed rows together.", steps: ["Review the governing schedule and any legal hold or exception rules.", "Complete a row for each distinct information use, cutoff, retention period, and disposition.", "Have a separate reviewer approve the complete document and row set."], types: [], utility: "retention-schedule", defaultOpen: true }
     ],
     resourceTypes: [],
     supportingResourceTypes: ["policy", "document", "training", "retention-schedule-item"],
@@ -132,12 +182,12 @@ export const PROGRAM_PATH = [
     number: 3,
     title: "Implement Controls",
     description: "Implement and prepare to operate",
-    summary: "Implement Controls, configure their operating schedules and evidence sources, then activate the approved program.",
+    summary: "Implemented Controls with ready evidence sources and enabled work schedules.",
     sections: [
-      { id: "controls", title: "Controls", description: "Implement the selected Controls and connect their scope, procedures, mappings, and operation patterns.", steps: ["Open every planned Control and confirm its mappings and operation pattern.", "Write the real procedure in Record Markdown, add bounded System scope, and map the operating and authoritative evidence-source Components."], types: ["control"], defaultOpen: true },
-      { id: "complementary-controls", title: "Complementary Controls", description: "Record customer or provider responsibilities that form part of the implementation boundary, or confirm there are none.", steps: ["Review whether an in-scope Control depends on a customer or carved-out provider action."], types: ["complementary-control"], defaultOpen: true },
-      { id: "evidence-sources", title: "Evidence Sources", description: "Check that every Control points to an authoritative source that can produce its expected evidence.", steps: ["Confirm each source Component is active, has the right evidence-source role, names current access owners, and includes repeatable retrieval instructions."], types: [], utility: "evidence-sources", defaultOpen: true },
-      { id: "obligations", title: "Obligations", description: "Configure the calendar and event schedules that operate the Controls.", steps: ["Review and enable every required calendar and event schedule."], types: ["obligation"], defaultOpen: true }
+      { id: "controls", title: "Controls", description: "Put each selected Control into use and record what is actually in place.", steps: ["Open each Control for its specific setup action and current missing checks.", "Configure the activity and record its procedure, Systems, owner, and evidence sources.", "Mark it Implemented with its real start date after its sources and schedules are ready."], types: ["control"], defaultOpen: true },
+      { id: "complementary-controls", title: "Complementary Controls", description: "Record customer or provider responsibilities that form part of the implementation boundary, or confirm there are none.", steps: ["Identify any customer or carved-out provider action an in-scope Control depends on.", "Record each dependency, or confirm that the current scope has none."], types: ["complementary-control"], defaultOpen: true },
+      { id: "evidence-sources", title: "Evidence Sources", description: "Check that every Control points to an authoritative source that can produce its expected evidence.", steps: ["For each Control family, link an active Component with the required source kind, access owners, and retrieval instructions."], types: [], utility: "evidence-sources", defaultOpen: true },
+      { id: "obligations", title: "Obligations", description: "Configure the calendar and event schedules that operate the Controls.", steps: ["Check the owner, trigger or cadence, due window, and required proof for each Obligation.", "Enable the rules that will run the implemented Controls."], types: ["obligation"], defaultOpen: true }
     ],
     resourceTypes: ["control", "complementary-control", "obligation"],
     commands: [
@@ -160,17 +210,17 @@ export const PROGRAM_PATH = [
     number: 4,
     title: "Operate the Program",
     description: "Run the work and retain dated proof",
-    summary: "Complete scheduled and event work. Keep dated proof.",
+    summary: "Dated operating records and linked proof for work actually performed.",
     sections: [
-      { id: "risk", title: "Risk", description: "Maintain the program’s risk assessments and risk register as the service, threats, suppliers, and control needs change.", steps: ["Complete and approve risk assessments on schedule and after material changes.", "Record risks that need treatment, acceptance, or ongoing tracking.", "Add or update controls when the assessment identifies a new or changed response."], types: ["risk-assessment", "risk"], defaultOpen: true },
-      { id: "queue", title: "Work Queue", description: "Complete recurring occurrences, Policy Event tasks, and assigned follow-up within their required windows.", steps: ["Complete due work within its allowed window and link dated proof.", "Start Policy Events when hiring, departures, incidents, or material changes occur.", "Resolve every other open Action Item from the same queue."], types: ["obligation-event", "data-request"], utility: "obligation-board", defaultOpen: true },
-      { id: "evidence", title: "Evidence Artifacts", description: "Create records only for real exports, reports, screenshots, signed files, or approved external references collected during operation.", steps: ["Create an Evidence Artifact when the artifact exists or an operating record needs fixed supporting proof.", "Select the authoritative source Component, link the Controls and source operating record, and retain the fixed attachment or approved reference.", "Record the collector and Classification, then have another person verify the artifact before audit use."], types: ["evidence"], defaultOpen: true },
-      { id: "governance", title: "Governance", description: "Record formal reviews, oversight meetings, and approved policy or control exceptions.", steps: ["Complete scheduled policy reviews and oversight meetings.", "Record decisions, attendees, follow-up work, and evidence.", "Approve time-bound exceptions before the departure begins."], types: ["policy-review", "meeting", "exception"], defaultOpen: false },
-      { id: "inventories", title: "Assets and Vendors", description: "Maintain the asset inventory and recurring reviews of supplier relationships during operation.", steps: ["Keep ownership, custody, status, and lifecycle current for important assets.", "Perform vendor reviews on schedule and after material supplier changes.", "Link fixed reports and review evidence to the operating records."], types: ["asset", "vendor-review"], defaultOpen: false },
-      { id: "access-training", title: "Access and Training Completion", description: "Inventory service accounts and retain access decisions, Training assignments, and acknowledgements produced during operation.", steps: ["Catalog service accounts that need separate tracking.", "Preserve access approvals and removals as they occur, then complete periodic access reviews and resolve exceptions.", "Retain each Training assignment and Attestation against the exact active content revision."], types: ["service-account", "access-grant", "access-review", "attestation"], defaultOpen: false },
-      { id: "security", title: "Security Operations", description: "Record vulnerability work, applicable penetration testing, and incident response activity for the period.", steps: ["Retain scan scope, results, vulnerabilities, remediation, and exceptions.", "When the approved applicability review requires penetration testing, record the test and follow-up findings.", "Start the incident workflow when a qualifying event occurs."], types: ["vulnerability-scan", "vulnerability", "penetration-test", "incident"], defaultOpen: false },
-      { id: "resilience", title: "Resilience", description: "Preserve proof that backups, restoration, continuity, and incident exercises work as designed.", steps: ["Record backup restoration tests and their results.", "Run continuity and incident exercises on schedule.", "Assign and close follow-up work from failed objectives or lessons learned."], types: ["backup-test", "exercise"], defaultOpen: false },
-      { id: "issues", title: "Issues and Remediation", description: "Keep observations in the source report and track only confirmed gaps that need a separate remediation lifecycle.", steps: ["Create a Finding only when a confirmed gap needs its own owner, due date, status, or verified closure.", "Use the Finding itself for straightforward remediation; create Action Items only for separate assigned tasks.", "Work Action Items from Work Queue and close the Finding only after remediation is independently verified."], types: ["finding"], defaultOpen: false }
+      { id: "risk", title: "Risk", description: "Maintain the program’s risk assessments and risk register as the service, threats, suppliers, and control needs change.", steps: ["Complete and approve the required Risk Assessments.", "Record each risk that needs a response, owner, and treatment Controls."], types: ["risk-assessment", "risk"], defaultOpen: true },
+      { id: "queue", title: "Work Queue", description: "Complete recurring occurrences, Policy Event tasks, and assigned follow-up within their required windows.", steps: ["Complete due Work Queue occurrences with dated proof.", "Trigger a Policy Event when its real-world event occurs, then complete the linked Action Items."], types: ["obligation-event", "data-request"], utility: "obligation-board", defaultOpen: true },
+      { id: "evidence", title: "Evidence Artifacts", description: "Create records only for real exports, reports, screenshots, signed files, or approved external references collected during operation.", steps: ["Create an Evidence Artifact only when a real file or approved external reference exists.", "Link its source Component, supported Controls and work record, and fixed artifact or reference.", "Record the collector and Classification, then verify the artifact."], types: ["evidence"], defaultOpen: true },
+      { id: "governance", title: "Governance", description: "Record formal reviews, oversight meetings, and approved policy or control exceptions.", steps: ["Complete scheduled policy reviews and oversight meetings with decisions and evidence.", "Create separate Action Items only for follow-up with its own owner and deadline.", "Approve any time-limited Exception before the departure begins."], types: ["policy-review", "meeting", "exception"], defaultOpen: false },
+      { id: "inventories", title: "Assets and Vendors", description: "Maintain the asset inventory and recurring reviews of supplier relationships during operation.", steps: ["Keep important Assets and Vendor relationships current.", "Complete Vendor Reviews on schedule or after material changes, with a decision and evidence."], types: ["asset", "vendor-review"], defaultOpen: false },
+      { id: "access-training", title: "Access and Training Completion", description: "Inventory service accounts and retain access decisions, Training assignments, and acknowledgements produced during operation.", steps: ["Catalog Service Accounts that need separate tracking.", "Record access decisions and removals as they occur; complete scheduled Access Reviews.", "Keep Training assignments and Attestations tied to the exact active content revision."], types: ["service-account", "access-grant", "access-review", "attestation"], defaultOpen: false },
+      { id: "security", title: "Security Operations", description: "Record vulnerability work, applicable penetration testing, and incident response activity for the period.", steps: ["Record required scans and tests with their real scope, results, and evidence.", "Track confirmed weaknesses and their remediation.", "Start the Incident workflow when a qualifying event occurs."], types: ["vulnerability-scan", "vulnerability", "penetration-test", "incident"], defaultOpen: false },
+      { id: "resilience", title: "Resilience", description: "Preserve proof that backups, restoration, continuity, and incident exercises work as designed.", steps: ["Run scheduled restore tests and continuity or incident exercises.", "Record the result and evidence, then assign follow-up for failed objectives."], types: ["backup-test", "exercise"], defaultOpen: false },
+      { id: "issues", title: "Issues and Remediation", description: "Keep observations in the source report and track only confirmed gaps that need a separate remediation lifecycle.", steps: ["Create a Finding for a confirmed gap that needs a separate owner, deadline, or closure review.", "Use Action Items only for separately assigned tasks.", "Close the Finding after remediation is independently verified."], types: ["finding"], defaultOpen: false }
     ],
     resourceTypes: [
       "risk-assessment",
@@ -238,10 +288,10 @@ export const PROGRAM_PATH = [
     number: 5,
     title: "Audit",
     description: "Firm, formal period, fieldwork, and report",
-    summary: "Track the CPA engagement, fieldwork, and evidence packet.",
+    summary: "A CPA engagement record and a reviewable, period-bound evidence packet.",
     sections: [
-      { id: "engagement", title: "Engagement", description: "Record the actual CPA engagement, formal scope and dates, requests, and management responses.", steps: ["Create the Audit after the CPA firm is engaged.", "Record the firm-agreed type, scope, systems, criteria, and dates.", "Track incoming requests and approved response material."], types: ["audit", "audit-request"], defaultOpen: true },
-      { id: "fieldwork", title: "Fieldwork", description: "Prepare Audit Documents, reconcile Type 2 populations, review both evidence paths, support testing, and build the indexed packet.", steps: ["Initialize and complete engagement-specific management Documents and populations.", "Approve and activate each Audit Document only when its engagement facts and timing are final.", "Review dated FileGRC operating records and verified Evidence Artifacts for the formal period.", "Reconcile complete populations, link samples, and resolve fieldwork requests and Findings.", "Build the packet from a clean Git revision; it includes FileGRC records, Markdown, Evidence Artifacts, attachments, indexes, history, and checksums."], types: ["audit-population", "control-test"], relatedLinks: [{ type: "document", label: "Audit Documents", href: "#/resources/document?stage=audit&documentScope=audit" }], utility: "audit-packet", defaultOpen: true }
+      { id: "engagement", title: "Engagement", description: "Record the actual CPA engagement, formal scope and dates, requests, and management responses.", steps: ["After engaging the CPA firm, create the Audit with its agreed type, scope, and date or period.", "Track firm requests with owners, due dates, and approved responses."], types: ["audit", "audit-request"], defaultOpen: true },
+      { id: "fieldwork", title: "Fieldwork", description: "Complete engagement documents, populations, requests, and the evidence packet.", steps: ["Complete engagement Documents and, for Type 2, reconcile each population to its fixed export.", "Review dated operating records and verified Evidence Artifacts for the agreed period; link samples and answer requests.", "Build and review the indexed packet from a clean Git revision."], types: ["audit-population", "control-test"], relatedLinks: [{ type: "document", label: "Audit Documents", href: "#/resources/document?stage=audit&documentScope=audit", summary: "Complete and approve engagement Documents, then link the required ones from each Audit.", instructions: "Complete each required engagement Document, link it from its Audit, obtain separate approval of the exact Markdown revision, then activate that approved revision for that Audit.", output: "Active Audit Documents linked to their Audits and bound to their approved revisions." }], utility: "audit-packet", defaultOpen: true }
     ],
     resourceTypes: ["audit", "audit-request", "audit-population", "control-test"],
     utilities: [
@@ -257,9 +307,12 @@ export const PROGRAM_PATH = [
     ],
     commands: [
       "filegrc guide audit --json",
+      "filegrc guide document --json",
+      "filegrc list document --json",
       "filegrc scaffold audit --title \"YEAR SOC 2 TYPE\"",
       "filegrc create AUDIT-MUTATION.json --json",
       "filegrc prepare-audit AUDIT_ID --json",
+      "filegrc activate-documents --scaffold --audit AUDIT_ID",
       "filegrc audit-readiness AUDIT_ID --json",
       "filegrc evidence-packet --audit AUDIT_ID --preview --json"
     ]
@@ -321,14 +374,27 @@ export function buildAgentProgramPath(model) {
         title: definition.pluralTitle,
         summary: RESOURCE_PAGE_SUMMARIES[type] || definition.description,
         instructions: RESOURCE_INSTRUCTIONS[type] || definition.description,
+        output: RESOURCE_OUTPUTS[type] || `A validated ${definition.title} record.`,
         use: definition.description,
         policyBasis: definition.guidance.policyBasis,
         guide: `npx filegrc guide ${type} --json`,
         list: `npx filegrc list ${type} --json`
       };
     });
+    const relatedPages = stage.sections.flatMap((section) => section.relatedLinks || [])
+      .filter((link) => link.instructions)
+      .map((link, index) => ({
+        order: `${stage.number}.${String.fromCharCode(97 + stage.resourceTypes.length + index)}`,
+        type: link.type,
+        title: link.label,
+        summary: link.summary,
+        instructions: link.instructions,
+        output: link.output,
+        guide: `npx filegrc program-path --json`,
+        list: `npx filegrc list ${link.type} --json`
+      }));
     const utilityPages = (stage.utilities || []).map((utility, index) => ({
-      order: stage.id === "run" ? null : `${stage.number}.${String.fromCharCode(97 + stage.resourceTypes.length + index)}`,
+      order: stage.id === "run" ? null : `${stage.number}.${String.fromCharCode(97 + stage.resourceTypes.length + relatedPages.length + index)}`,
       utility: utility.id,
       title: utility.title,
       summary: utility.summary,
@@ -340,7 +406,7 @@ export function buildAgentProgramPath(model) {
     return {
       ...stage,
       commands: stage.commands.map(agentCommand),
-      pages: stage.id === "run" ? utilityPages : [...resourcePages, ...utilityPages],
+      pages: stage.id === "run" ? utilityPages : [...resourcePages, ...relatedPages, ...utilityPages],
       ...(stage.id === "run" ? { operatingRecords: resourcePages } : {})
     };
   });