# Setup guide — Compliance Control Monitoring Agent

## 1. Install and connect evidence

Install the agent and connect your evidence sources.

```
pipx install control-monitor-agent
control-monitor-agent connect --evidence jira,okta,cloudtrail
control-monitor-agent doctor
```

## 2. Configure guardrails

No fabricated pass and no auto-attest are enforced here.

```
cp .env.example .env
ANTHROPIC_API_KEY=sk-ant-...
REQUIRE_EVIDENCE_FOR_PASS=true
AUTO_ATTEST=false
FLAG_STALE_EVIDENCE_DAYS=90
```

## 3. Define controls & evidence map

Map each control to the evidence that supports it.

```
# controls.yml
controls:
  AC-1: { desc: 'Access reviews quarterly', evidence: okta_review_export }
  CM-2: { desc: 'Change approvals', evidence: jira_change_tickets }
```

## 4. Run a control test

Test controls and review exceptions and citations.

```
control-monitor-agent run --framework soc2 --explain
# prints per-control status + cited evidence + exceptions (no attestation)
```

## 5. Wire into GRC

Schedule monitoring; exceptions go to control owners.

```
# scheduled run -> evidence-based status -> exceptions to owners; human attests
```
