ControlsMap agent guide · Version 1
Find risks, controls and workflows
Start with an audit topic, follow the recorded relationships, and return the results in the user's requested format.
Read the topic and framework directory or fetch the JSON data catalog. The Markdown data guide explains the record types, relationship directions, pagination and source limits. llms.txt provides another entry point.
Retrieve an audit scope
Choose relevant topics and candidate sources from the catalog. Read their pages, then follow the linked risk, unified control, requirement and workflow records. Keep the catalog revision and use its immutable data URLs for one consistent snapshot. Preserve source links, mapping rationale, partial coverage and remaining requirements in the answer.
For an AI audit, start with AI Governance and identify the company's systems, uses and jurisdictions before treating a source as applicable. A workflow may operate, test or oversee a control; use its recorded relationship. Guidance propositions are not requirements, and catalog risk ratings are not assessments of the company's controls. Workflows with no mappings remain in the full record index.
Open a filtered map
Build a link to open ControlsMap with chosen filters, search text and an item in the detail panel.
Use the exact values in filters.json and the item IDs in nodes.json. Both files include the catalog revision. No login or API key is required.
Combine filters
Repeat a key to select more than one value (OR). Different fields apply together (AND). Leave a field out to select every value, or supply an empty value to select none. Encode values with URLSearchParams; commas inside a value are ordinary text.
Framework and authority filters limit connected controls, risks and workflows to the chosen sources. Other filters apply to their own node type. Choosing high risks does not imply that every visible workflow relates exclusively to high risks.
workflow.department selects the department that owns execution, such as hr or it. Workflow rows in nodes.json expose that owner, participating teams, the library slug, source identity, release identity and mapping status. The existing workflow.domain filter selects the workflow area, including business workflows with no GRC domain; workflow.line selects its assurance role.
The unrestricted map includes every Workflow Library workflow. Framework filters select supported relationships. A workflow whose mappings are pending or reviewed as not applicable remains available in the unrestricted inventory without invented control edges. Downloaded workflow rows preserve the exact library release for tenant import and update review.
| Parameter | Field | Example values |
|---|---|---|
framework | Framework | aiuc-1, ccpa, cobit-2019, coso-erm; see manifest for all values |
source.authority | Authority | framework, guidance, mandatory |
uc.domain | Domain | AI Governance, Access Control & Identity Management, Asset Management & Inventory, Awareness & Training; see manifest for all values |
uc.type | Control type | corrective, detective, preventive |
uc.category | Control category | administrative, physical, technical |
workflow.domain | Area | audit, business, controls, grc; see manifest for all values |
workflow.department | Owning department | ai-governance, compliance-legal, executive, facilities; see manifest for all values |
workflow.line | Line of defense | assure, monitor, operate, __null__ |
risk.category | Category | ai_governance, business_continuity, compliance_regulatory, cyber_security; see manifest for all values |
risk.domain | Control domain | AI Governance, Access Control & Identity Management, Asset Management & Inventory, Awareness & Training; see manifest for all values |
risk.taxonomy | Taxonomy | basel-operational-risk, coso-erm-risk, enterprise-risk, eu-ai-act-risk; see manifest for all values |
risk.rating | Inherent rating | critical, high, low, medium |
Search and open an item
Set q to search eligible item IDs, titles and descriptions. The result includes direct matches and the controls and sources needed to explain them. Match and context counts are shown separately. Underlying requirements appear in search results and open in the detail panel.
Set node to an ID from nodes.json. It opens the item without changing the filters. If the item falls outside them, the panel says so. Records with rendered: false open only in the panel. Copy the browser address to share filters, search and the panel item; camera position and hover are temporary.
Retired workflow IDs listed in nodeAliases in both manifests open their current replacement. Existing SOC 2 CC1–CC9 links open SOC 2 readiness; ISO 27001 Stage 2 theme links open the combined Annex A controls audit. Filters and search text remain unchanged. Subsequent URL updates use the current item ID. Aliases add no duplicate graph records. Current item IDs take precedence; unlisted IDs open no panel.
v=1 identifies the URL contract. Omitting it preserves existing node links. An unsupported version resets the application state with a notice.
Examples
- AIUC-1 scope
https://controlsmap.com/?v=1&framework=aiuc-1 - AIUC-1 E013
https://controlsmap.com/?v=1&framework=aiuc-1&node=ctrl%3Aaiuc-1%3AE013 - High and critical risks
https://controlsmap.com/?v=1&risk.rating=high&risk.rating=critical - Assurance workflows
https://controlsmap.com/?v=1&workflow.line=assure - HR workflows
https://controlsmap.com/?v=1&workflow.department=hr
const query = new URLSearchParams({v: '1', framework: 'aiuc-1'});
query.append('risk.rating', 'high');
query.append('risk.rating', 'critical');
query.set('node', 'ctrl:aiuc-1:E013');
const link = 'https://controlsmap.com/?' + query.toString();Validation and limits
Unsupported filter values are removed with a notice. If none of the supplied values remain, the field stays empty. An unknown item ID opens no panel. Conflicting repeated scalar values are rejected. Mixing an empty filter value with a nonempty value leaves that field empty with a notice.
A URL may contain at most 8,192 UTF-8 query bytes, 128 parameters and 64 values per field. Search and item IDs allow 160 Unicode code points each. Over-limit links reset all application state with a visible notice. Tracking parameters do not affect filters.
The catalog revision changes when metadata, mappings or workflow definitions change. Refresh the manifests when a value or ID is unavailable.