Record a compliance evidence event in the Mima governance ledger, mapped to EU AI Act, SOC 2 Type II, ISO 42001, and NIST AI RMF controls.

Call this when the AI system performs a governance-relevant action that requires an audit trail: a human reviewing or overriding an AI decision, a risk assessment being completed, a model being evaluated for accuracy or bias, an access review, a policy being acknowledged, or an incident being reported.

Do NOT call this for routine AI inference calls — only for actions where a regulator or auditor would expect documented evidence.

Returns the record_id and the list of compliance controls earned (e.g. EUAIA_ART14, SOC2_CC6.1). The GRC manager sees these in the Mima governance dashboard and they count toward the readiness score.

Preview which compliance controls a proposed evidence record would earn — without writing anything to the ledger. Use this before calling attest to confirm the record is correct.

This is the verification step in the compliance copilot loop:

1. get_posture() → identify gap

2. dry_run_attest() → confirm this record closes it

3. [present to human for approval]

4. attest() → write the real record

Returns the same mapped_controls list that attest would return, but record_id is the nil UUID (all zeros) — a clear signal no DB row was written.

Do NOT skip this step when proposing records on behalf of a human — always show them what controls would be earned before writing.

Get the current AI governance posture for this workspace. Returns per-framework compliance scores (EU AI Act, SOC 2, ISO 42001, NIST AI RMF), failing gates, and the count of unattested AI calls in the last 24 hours.

Use this to answer questions like:

• "How compliant are we with the EU AI Act?"

• "What is our current governance score?"

• "Are we ready for the August deadline?"

• "Which frameworks have gaps?"

Check the status of all configured governance gates for this workspace. Gates are threshold-based controls that block deployments when compliance scores drop below a required level.

Returns each gate's current score vs threshold, and whether it passes.

Use this to answer questions like:

• "Can we deploy right now?"

• "Which gates are blocking us?"

• "What do we need to fix before merging?"

List all AI systems in this workspace with their registration status and evidence coverage.

The key field is is_registered: false means the system has emitted evidence (the guard or AST scanner detected it) but no ai_risk_assessment record exists — the Art. 9 intake gap.

Use this to:

• Identify unregistered AI systems before the EU AI Act deadline

• See which systems have evidence gaps (record_types shows what categories exist)

• Answer: "what AI systems do we have?" and "which ones are formally registered?"

Returns system_name, record_count, last_seen, is_registered, record_types[], controls[].

List evidence records from the governance ledger, optionally filtered by system and time.

Use this to understand what evidence already exists before proposing new records — prevents duplicate attestations and helps the agent reason about gaps:

• 'Has loan-scoring-v2 had a human_oversight record in the last 30 days?'

• 'What evidence does the chatbot system have for EU AI Act controls?'

• 'Show me the last 10 records across all systems'

Returns records ordered newest-first. Default limit 20, max 100. The source field is 'sdk' (attested) or 'inferred' (estate scan — lower audit weight).

Returns your current governance coverage gaps relative to the described action.

Provides: the action description as context, uncovered required controls (with which record types evidence them), the system's registered risk tier and Art. 14 status where deterministic from the ledger.

Use this data to reason about which record types the described action requires and why — then propose them via dry_run_attest before writing.

When art14_applicable is null, the system is not yet registered. Offer to run /mima:register-systems to resolve it.

Register an AI system in the Mima governance ledger. Creates an Art. 9 risk assessment record — required once per AI system before it processes EU persons under the EU AI Act.

Use this during design reviews or architecture discussions when a new AI system is being planned or has just been deployed:

• "We're adding a loan scoring model to production"

• "This new hiring algorithm needs to be registered"

• "Register the content moderation system we just deployed"

Pass dry_run=true to preview which controls this registration would earn without writing anything to the ledger. Use this before the real call to confirm the payload is correct.

Returns the record_id and mapped controls (e.g. EUAIA_ART9, ISO42001_6.1). In dry-run mode, record_id is the nil UUID — a clear signal nothing was written.

Record that a team member has read and understood an AI governance policy. Generates an immutable policy_acknowledged evidence record — required for EU AI Act Art. 9, SOC 2 CC1.4, and ISO 42001 A.5.1.

Use this when:

• A new employee joins and needs to acknowledge the AI use policy

• An AI policy has been updated and the team needs to re-acknowledge

• A periodic renewal acknowledgment is due (annual policy reviews)

The record is timestamped to now and cannot be modified after creation. Auditors verify the person's email, policy version, and exact timestamp.

Pass dry_run=true to preview which controls this acknowledgment would earn without writing anything to the ledger. Use this before the real call to confirm the payload is correct.

Analyse the current governance posture and gate configuration, then return a prioritised list of gate recommendations.

Suggestions are one of four actions: • increase_coverage — a required gate is failing; push more evidence • add_required_gate — a framework scores well enough to gate CI on it • add_advisory_gate — an unconfigured framework has real coverage; worth tracking • promote_to_required — an advisory gate has been passing steadily; safe to make required

Use this when:

• "What gates should we add?"

• "How do we improve our gate coverage?"

• "Which frameworks are ready to become required gates?"

• "We have no gates configured — where do we start?"