RUS-001 · Design Effectiveness Quality Gate
A single design-quality gate over a control: design quality, risk–control linkage, judgment/exception challenge, evidence-by-design, and historical failure/finding intelligence.
Open View workflow DAGORM Coach — Solution Architecture (POC)
An ORM-only slice of the proven Risk Data Explorer stack. ORM Coach embeds operational-risk expertise in OneORM workflows: consistent, explainable, context-aware guidance at the point of work, grounded in approved OneORM data. It advises and challenges but never makes the accountable decision (BR-3).
RUS-006 · Guided Control Self-Assessment
Guides the accountable user step-by-step through the execution and evidence checks derived from the documented control design.
Open View workflow DAGUS_I_OE_04 · Reporting OE / Issues
One AI-assisted workflow: classification support, root-cause guidance, structured reporting and actionable recommendations from a single entry point.
Open View workflow DAGWorkflows are data, not code
Each use case's guided flow is an editable DAG in
app/Data/workflows/<use_case>.yaml, loaded, validated and
rendered by the generic workflow_engine.py. The engine binds a
tool set per step (generic tools ∪ the step's tools − denies) and
resolves form fields from a single source (orm_forms), so adding
a use case is a YAML file plus a persona — not new Python. Inspect or edit any
workflow visually at /workflow/<use_case>. See the
new-use-case authoring guide for
the full recipe.
How it fits together
flowchart TB
subgraph Browser["Browser (per use-case page)"]
UI["Chat UI + activity panel
+ on-screen form (SSE)"] MSAL["MSAL.js
Auth Code + PKCE"] end subgraph App["FastAPI app (app.py)"] MW["BearerTokenMiddleware
(OBO assertion capture)"] ROUTES["/uc/<use_case> · /api/chat (SSE)
/workflow/<use_case> designer"] AGENT["orm_agent.stream_orm_agent
tool-loop + use-case persona"] end subgraph WF["Workflow layer (data-defined)"] YAML["Data/workflows/<uc>.yaml
editable DAG"] ENGINE["workflow_engine.py
load · validate · Mermaid · per-step tool bind"] REG["tool_registry.py
every agent tool by name"] SCHEMAS["orm_forms · standards · workflow_contracts
fields · gates · payload schemas"] end subgraph LLM["Atlantis gateway"] RESP["Azure OpenAI
Responses API"] end subgraph Data["OneORM data plane (ORM scope)"] TOOLS["orm_cat_* · orm_ref_* · orm_get_/find_*
orm_db_run_sql (read-only guard)"] DB[("OneORM Azure SQL
orm-dwh (np / p)")] end UI -->|question| ROUTES MSAL -->|Bearer + X-LLM-Token + X-SQL/ADO/ARM-Token
secretless browser passthrough| MW MW --> ROUTES ROUTES --> AGENT YAML --> ENGINE REG --> ENGINE SCHEMAS --> ENGINE ENGINE -->|active-step tool binding| AGENT AGENT <-->|stream + tool calls| RESP AGENT -->|bound tools| TOOLS TOOLS --> DB TOOLS -. snapshot .-> DB AGENT -->|answer_delta / tool_result / form_fill / workflow_step| UI
+ on-screen form (SSE)"] MSAL["MSAL.js
Auth Code + PKCE"] end subgraph App["FastAPI app (app.py)"] MW["BearerTokenMiddleware
(OBO assertion capture)"] ROUTES["/uc/<use_case> · /api/chat (SSE)
/workflow/<use_case> designer"] AGENT["orm_agent.stream_orm_agent
tool-loop + use-case persona"] end subgraph WF["Workflow layer (data-defined)"] YAML["Data/workflows/<uc>.yaml
editable DAG"] ENGINE["workflow_engine.py
load · validate · Mermaid · per-step tool bind"] REG["tool_registry.py
every agent tool by name"] SCHEMAS["orm_forms · standards · workflow_contracts
fields · gates · payload schemas"] end subgraph LLM["Atlantis gateway"] RESP["Azure OpenAI
Responses API"] end subgraph Data["OneORM data plane (ORM scope)"] TOOLS["orm_cat_* · orm_ref_* · orm_get_/find_*
orm_db_run_sql (read-only guard)"] DB[("OneORM Azure SQL
orm-dwh (np / p)")] end UI -->|question| ROUTES MSAL -->|Bearer + X-LLM-Token + X-SQL/ADO/ARM-Token
secretless browser passthrough| MW MW --> ROUTES ROUTES --> AGENT YAML --> ENGINE REG --> ENGINE SCHEMAS --> ENGINE ENGINE -->|active-step tool binding| AGENT AGENT <-->|stream + tool calls| RESP AGENT -->|bound tools| TOOLS TOOLS --> DB TOOLS -. snapshot .-> DB AGENT -->|answer_delta / tool_result / form_fill / workflow_step| UI
Grounding principle (BR-3)
- Advise, don't decide. Recommendations, rationale and challenge only — the accountable user owns every decision and sign-off.
- Evidence-grounded. Material conclusions cite a catalogue object, git-mirrored SQL source, or a live query actually run.
- Expose limitations. Missing or uncertain information is stated explicitly; the coach never invents requirements, controls or figures.
Stack components
| Component | Role | Source |
|---|---|---|
| atlantis.py | Azure OpenAI (Responses API) gateway client | reused |
| resource_connector.py | MSAL / OBO auth, Azure SQL connector | reused |
| sql_db.py | Read-only SQL executor + guard | reused |
| sql_catalog.py + orm_catalog.py | OneORM metadata / source tools | reused |
| db_tools.py | Live orm_db_run_sql tool | trimmed to ORM |
| workflow_engine.py | Generic YAML workflow-DAG engine: load, validate, Mermaid, per-step tool binding | new |
| tool_registry.py | Central registry — every agent tool by name + schema | new |
| orm_forms.py | Form field schemas (single source) + orm_fill_form | new |
| orm_reference.py | Live reference tools (people, RCSAs, enums, impacts) | new |
| orm_templates.py | Fast-path fetch & comparable-case tools | new |
| standards.py | Targeted Standard lookups + mandatory-field gates | new |
| workflow_contracts.py | Structured step-payload contracts (Pydantic) | new |
| orm_agent.py | ORM-only tool-loop + 3 use-case personas | new |
| app.py + templates | Routed pages, SSE chat, workflow designer, architecture | new |