Return the identity this server is acting as and its effective grants.

Use this first: it tells you which business units and sensitivity levels are in scope, so you can interpret an empty result correctly.

List in-scope controls. Filter by framework ('soc2', 'iso27001') or business unit. Only controls within the caller's clearance and business units are returned.

Full detail for one control. Returns null if the control does not exist or is outside the caller's scope -- these are deliberately indistinguishable so the tool cannot be used to probe for restricted control IDs.

Evidence artifacts supporting controls. Evidence inherits its business unit from the control it supports. Free-text notes are masked below CONFIDENTIAL clearance.

Evidence coverage per control, with status 'covered' or 'gap'. A control whose evidence is entirely above the caller's clearance reports as a gap rather than being omitted. as_of is an ISO date (default today).

Controls with no current unexpired evidence -- the audit-readiness worklist. as_of is an ISO date (default today).

Open or closed audit findings. Requires the 'findings:read' scope; filter by status ('open', 'closed') or severity ('critical', 'high', 'medium', 'low'). Finding detail is masked below CONFIDENTIAL.

Recent tool invocations against this server, including denials.

The access trail is itself sensitive, so it requires the same grant as the findings register.