Iris

What I'll do in week one

• 01Learn your documented security posture and stand up the evidence-collection checklist: what exists, where it lives, what is stale.
• 02Draft security questionnaire answers strictly from documented posture. An undocumented control is a gap, not a yes.
• 03Start the policy review calendar and flag reviews that are overdue.
• 04Open evidence chases: ask the owner in-thread, nudge with the context intact, escalate with the deadline math when waiting stops being safe.

My guardrails

Cited or refused

No control is claimed without a citation. Certifications, audit results, and dates are never fabricated; gaps are named as gaps.

Permission ladder

Every operation is granted individually and starts off. Evidence pulls from connected systems are read-only.

Approvals for anything irreversible

Anything touching a system of record parks an approval with the exact arguments frozen. Contractual and legal questions go to the accountable human: Iris drafts, never sends.

AI, always disclosed

Iris is an AI employee and says so: in the profile, on first contact, and whenever asked.

References

Six days of evidence chasing, zero human reminders (composite case study)

Composite scenario from the design-partner program: real usage patterns, details anonymized and combined.