Resources

Everything we publish and everything we ship, in one place: how evidence actually gets collected, how controls get mapped, and what auditors really ask for.

Permissions that hold

Every route, every write affordance and every agent tool now checks the same organization role.

access

Roles are only worth having if everything honours them. Permissions are now resolved per request from the member's role in the organization, and every app route requires one, including the tools Agent calls on your behalf. Buttons you cannot use no longer appear and then fail; they are not offered.

View Only is assignable, and role assignment itself is guarded, so a member cannot quietly grant themselves more than they were given.

Improvements
  • Software providers mirror into the asset inventory. A vendor you already track as a provider shows up as an asset without being entered twice.
  • Assessments gained bulk status actions and a closure status for work sitting under tenant review.
  • Framework badges are theme-driven.
Fixes
  • The controls list paginates on the server, so a large framework opens at the speed a small one does.
  • A Common Control's validations are counted once, not once per framework that references it.
  • The framework header stops cramping at narrow widths.
  • The vendor portal opens from the platform without needing a token.

Agent, raised

Cyberwiz AI is now Agent, lifted out of the bottom bar into its own surface.

Agent

Agent used to live in a strip at the bottom of the screen, which is a fine place for a toy and a bad one for something you actually work with. It now has its own surface, with named threads you can come back to, real deletion, and chat chrome that behaves the way you expect a chat to behave.

Also this week:

  • Framework controls carry their own record. Implementation notes, comments and an activity trail now sit on the control itself, so the reasoning behind a decision stops living in someone's inbox.
  • Owner changes record both ends. Who it moved from, who it moved to, and the applicability reason: all captured rather than inferred.
  • Reports get an answer. Raise an issue from inside the product and it lands in our triage queue; you hear back when the fix ships.

The assistant stops pretending

Agent is backed by a real model now, not a mock, and the app around it grew a settings surface worth having.

Agent

The in-app assistant was a convincing mock. It is now a real Bedrock-backed agent on the Vercel AI SDK, which means it answers from your data instead of from a script, and the always-on disclaimer that said so is gone.

Improvements
  • Settings became pages. One crowded dialog split into dedicated pages behind a nested sidebar, including an Appearance page with accent colours.
  • Drawer presentation is a global setting, and side drawers open from the bottom on phones where a side panel never fitted.
  • The inbox got a responsive layout, Linear-style filters and bulk delete.
  • Office documents are extracted for AI intake, so a .docx policy is read rather than stored.
  • The sidebar animates its icons on hover, surfaces its ⌘B hint, and shows the unread indicator even when collapsed.
Fixes
  • Vendor overview text fields can be cleared again instead of refusing an empty value.
  • The AI fallback evaluator's confidence is floored, so a guess stops presenting as certainty.
  • Missing required evidence counts against a Common Control's score rather than being skipped.
  • The integrations list is bounded and surfaces load failures instead of hanging.

The vendor page, rebuilt around a rail

Vendor detail keeps its identity on screen while you move through tabs, and the dashboard opens on a layout worth keeping.

Vendors

The vendor detail page used to lose the vendor when you changed tabs. It is now built around a persistent rail: who they are, their status and their owner stay on screen while assessments, findings and contacts move beside it.

Improvements
  • A new default dashboard layout, and small widgets resize properly instead of snapping back.
  • The compliance digest email is trimmed, and its card renders on mobile.
Fixes
  • Section ratings stay attached when a question-bank sync moves a section, and are keyed by canonical English name so a language switch cannot orphan them.
  • Report section keys are derived in one place and tolerate every shape stored historically.
  • Phone numbers and addresses stay left-to-right in Hebrew layouts, in the last two places that still flipped them.
  • The OneDrive picker stops overflowing its dialog.

Vendors, end to end

Create, duplicate, filter and validate vendors without leaving the list.

Vendors

A week spent on the parts of vendor management that are used every day. Creating a vendor is a drawer with a review step rather than a full-page form. Vendors, systems, processes and repositories can be duplicated. Status changes from the list, and the list filters by it.

Improvements
  • Validation is recorded, not remembered: dates and result on the vendor, process and closure status on the assessment.
  • Custom compliance standards, for the frameworks that are not in the catalog.
  • Primary Contact is its own column, and the old Owner column is named for what it holds.
  • Domain-based auto-join, so a colleague signing up with a company address lands in the right organization.
  • Framework controls show their Common Control and evidence type columns, and map to common controls in bulk.
Fixes
  • A create-vendor draft survives a reload and nothing longer, instead of following you into the next vendor.
  • Copied approval documents are dropped on duplicate, and copy status resets.