GRC Assistant

What it is

The GRC Assistant is a chat interface that reads your live tenant data (risks, policies, evidence, framework state, integrations) and answers questions in plain English. It is not a general-purpose chatbot. It is scoped to the current tenant and grounded in that tenant's data.

When it answers a question about your program, the answer comes from your actual records. When it does not have enough data, it tells you what is missing instead of guessing.

Opening the assistant

Click Ask Radius in the sidebar to open the assistant. Type a question in the input field and press Enter.

If you are in a multi-client setup, the assistant is always scoped to the tenant you are currently viewing. Switch clients from the client bar at the top of the app to scope the assistant to a different tenant.

Query patterns that work

Question types the assistant handles well:

• Posture questions. "What is our MFA coverage?" "How many critical risks are open?" "What is our SOC 2 completion percentage?"
• Specific lookups. "Which risks are past their SLA?" "Who owns the Access Control policy?" "Which integrations have not synced in 24 hours?"
• Cross-reference questions. "Which SOC 2 controls are not yet covered by a policy?" "Which risks touch CIS Controls IG3?"
• Draft requests. "Draft a data retention policy for a healthcare client." "Write a board update on this quarter's progress."
• Summaries. "Summarize what changed in our posture this week." "Give me the top three things a board would want to know."
• Evidence requests. "What evidence do we have for SOC 2 CC6.6?" "Show me the most recent Okta evidence."

Question types that do not work:

• General knowledge questions (it is not a Wikipedia replacement)
• Questions about data from other tenants (the assistant is strictly scoped)
• Predictions about the future ("Will we pass our audit?")
• Opinions ("Is our security good?")

Saving answers as policies

When the assistant drafts policy-shaped content (in response to a draft request), a Save to Policy Library button appears at the bottom of the answer. Click it and:

1. 1
   A dialog opens with the title and content pre-filled; edit either if needed
2. 2
   Pick a category and click Save as Draft Policy
3. 3
   The policy lands in your library as a Draft; review and publish it from Policies

No copy-paste. The draft you just read is the same content that lands in the library.

When the assistant says it does not know

If you ask a question the assistant cannot answer from your data, it tells you why and what to do about it. Examples:

• "I do not have MFA data. You have not connected an identity provider yet. Connect Okta or Microsoft Entra for this answer."
• "No SOC 2 framework is active in this tenant. Activate SOC 2 from the Frameworks page to start tracking these controls."
• "I can see this policy exists but I have no record of who has acknowledged it. Enable acknowledgment tracking on the policy to get this data."

Audit trail

Every assistant interaction is logged: the question, the response, the user, and the timestamp. This log is visible in Settings, Audit Log, GRC Assistant and is included in the audit export for SOC 2 and ISO 27001 reviews (auditors increasingly ask how AI is used in security operations).

Sensitive queries (ones that reveal user-identifiable data or critical findings) are flagged in the log with extra metadata to make auditor reviews faster.

See AI policy generation and AI risk scoring for the other AI surfaces in the platform.

Monthly query caps

The assistant enforces a per-tenant monthly query limit aligned with your subscription:

Caps reset on the 1st of each month. The assistant header always shows your remaining balance. At ≤5 remaining, you'll see a warning toast on each query. When you hit 0, the assistant blocks new queries until the next reset or an upgrade.