# Workflow — Compliance Control Monitoring Agent

## 1. 1. Take the controls

Receive the controls to monitor and their framework.

## 2. 2. Gather evidence

Collect the evidence each control depends on.

## 3. 3. Test each control

Check whether the evidence exists, is current, and supports the control.

## 4. 4. Guard the pass

Mark 'satisfied' only with supporting evidence; otherwise it's an exception.

## 5. 5. Flag exceptions

Surface failing controls and missing/stale evidence honestly with the gap.

## 6. 6. Never attest

Produce status and exceptions for a human to attest; never sign off.

## 7. 7. Report & escalate

Report cited status with confidence and escalate exceptions.
