Menu
Standardize remediation decisions, baseline-policy entries, and legal-review banners for accepted, deferred, or policy-blocked audit findings.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Walk the B1-B15 AI-to-AI blind-spot catalog systematically. Use during the audit pipeline AFTER hard-stops and Tambon hunt and BEFORE the 13 domain audits. Output: PRESENT / NOT PRESENT for each B-class with evidence. Findings flow into the appropriate domains.
Audit the security domain - auth, authz, secrets, transport, sensitive data exposure, dependency CVEs. Run as part of /audit Phase E.
Audit the architecture and code quality domain - module boundaries, abstraction layers, code organization, naming, documentation. Run as part of /audit Phase E.
Audit the database and data layer - schema design, query patterns, migrations, indexing, RLS, soft-delete, transactions. Run as part of /audit Phase E.
Audit the infra and DevOps domain - CI/CD, deployment, IaC, secrets management, environments, logging, observability. Run as part of /audit Phase E.
Audit the performance domain - query efficiency, caching, async / blocking calls, payload sizes, scaling assumptions. Run as part of /audit Phase E.
| name | audit-decisions |
| description | Standardize remediation decisions, baseline-policy entries, and legal-review banners for accepted, deferred, or policy-blocked audit findings. |
Use this skill when an audit finding is accepted, deferred, converted to policy baseline, or routed to legal review.
This skill provides the governance records that audit-loop uses to
decide whether a finding can count as resolved for convergence.
Create or update remediation-decisions.md with one entry per finding:
## <Finding ID> - <Finding title>
Severity: <Critical | High | Medium | Low>
Decision: <ACCEPT | REMEDIATE | DEFER>
Rationale: <why this decision is appropriate>
Owner: <person/team/role>
Review-by date: <YYYY-MM-DD>
Evidence: <report path and path:line citations>
Decision meanings:
REMEDIATE: fix in repo or required external system.DEFER: acknowledged but scheduled for a later date with an owner.ACCEPT: deliberate risk acceptance with baseline-policy entry.Any ACCEPT decision or BLOCKED-POLICY audit-loop item requires a
structured entry in baseline-policy.md:
## <Finding ID> - <Finding title>
Justification: <business/technical reason for exception>
Residual risk level: <Critical | High | Medium | Low>
Approval authority: <name/role or governance body>
Expiry date: <YYYY-MM-DD>
Review cadence: <monthly | quarterly | before launch | other>
Compensating controls: <controls currently reducing risk>
Evidence: <links or path:line citations>
An expired baseline entry does not count as resolved. A baseline entry without approval authority does not count as resolved.
Any finding touching PII, financial data, auth/authz, or data retention
MUST include this banner in remediation-decisions.md and any roadmap
entry:
WARNING LEGAL REVIEW REQUIRED - do not mark ACCEPT without legal sign-off
Do not mark these findings ACCEPT unless legal sign-off is recorded in
the decision entry and reflected in the baseline-policy approval
authority.
audit-loop must invoke this skill before it marks any finding
BLOCKED-POLICY.
Gate requirements for BLOCKED-POLICY:
remediation-decisions.md contains the finding with Decision ACCEPT
or DEFER and a review-by date.baseline-policy.md contains a complete block for the finding.If any gate requirement is missing, the item remains unresolved and the
audit loop must continue or report TERMINAL BLOCKED.
DEFER as resolved without an owner and review-by date.ACCEPT as resolved without baseline-policy.md.[SECTION COMPLETE: audit-decisions]