[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-arize-arize-compliance-audit":3,"mdc--pb7vkb-key":50,"related-repo-arize-arize-compliance-audit":2419,"related-org-arize-arize-compliance-audit":2518},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":29,"repoUrl":30,"updatedAt":31,"license":32,"forks":33,"topics":34,"repo":45,"sourceUrl":48,"mdContent":49},"arize-compliance-audit","audit AI agents for regulatory compliance","INVOKE THIS SKILL when auditing an AI agent or LLM app for regulatory compliance. Covers EU AI Act, GPAI Code of Practice, GDPR, NIST AI RMF, Colorado AI Act, HIPAA, and ISO 42001. Scans the codebase for compliance gaps, cross-references Arize instrumentation for audit trail coverage, and produces an actionable remediation checklist tailored to the selected frameworks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"arize","Arize AI","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Farize.jpg","Arize-ai",[13,17,20,23,26],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"GDPR","gdpr",{"name":21,"slug":22,"type":16},"Compliance","compliance",{"name":24,"slug":25,"type":16},"Audit","audit",{"name":27,"slug":28,"type":16},"Legal","legal",38,"https:\u002F\u002Fgithub.com\u002FArize-ai\u002Farize-skills","2026-07-19T05:39:42.632738",null,5,[35,36,37,8,38,39,40,41,42,43,44],"agent-skills","ai-agents","ai-observability","claude-code","codex","cursor","datasets","experiments","llmops","tracing",{"repoUrl":30,"stars":29,"forks":33,"topics":46,"description":47},[35,36,37,8,38,39,40,41,42,43,44],"Agent skills for Arize — datasets, experiments, and traces via the ax CLI","https:\u002F\u002Fgithub.com\u002FArize-ai\u002Farize-skills\u002Ftree\u002FHEAD\u002Fskills\u002Farize-compliance-audit","---\nname: arize-compliance-audit\ndescription: \"INVOKE THIS SKILL when auditing an AI agent or LLM app for regulatory compliance. Covers EU AI Act, GPAI Code of Practice, GDPR, NIST AI RMF, Colorado AI Act, HIPAA, and ISO 42001. Scans the codebase for compliance gaps, cross-references Arize instrumentation for audit trail coverage, and produces an actionable remediation checklist tailored to the selected frameworks.\"\n---\n\n# Arize Compliance Audit Skill\n\nUse this skill when the user wants to **audit their AI agent or LLM application for regulatory compliance**. The skill scans the codebase for compliance gaps, cross-references Arize instrumentation for audit trail coverage, and produces a tailored checklist with optional remediation.\n\n**Triggers:** \"audit my app for compliance\", \"EU AI Act requirements\", \"NIST AI RMF checklist\", \"GDPR for AI\", \"is my AI app compliant\", \"compliance checklist\", \"regulatory audit\", \"ISO 42001\", \"AI management system\", \"AIMS certification\".\n\n## Disclaimer\n\n**Before doing anything else, present this disclaimer verbatim to the user:**\n\n---\n\n> ⚠️ **Legal disclaimer**\n>\n> This audit is for **guidance only** and does **not** constitute legal advice or a complete compliance assessment. It identifies common technical patterns and gaps based on publicly available regulatory frameworks, but cannot assess your organisation's specific legal obligations, contractual commitments, data processing agreements, or operational processes.\n>\n> **Do not rely on this output as a substitute for qualified legal counsel.** Regulatory compliance is a complex, jurisdiction-specific, and fact-dependent determination. Always engage a qualified attorney or compliance specialist for binding assessments.\n\n---\n\n## Core principles\n\n- **Prefer inspection over mutation** — understand the codebase before suggesting changes.\n- **Be practical, not legal** — produce developer-actionable items, not legal opinions.\n- **Tailor to jurisdiction and use case** — a chatbot has different obligations than a hiring tool. Do not dump the entire regulatory framework.\n- **Cross-reference instrumentation** — compliance requires audit trails; check whether Arize tracing captures what regulators expect.\n- **Offer remediation, always confirm** — after presenting the checklist, offer to implement specific fixes, but never modify code without explicit user confirmation.\n- **Keep output concise and production-focused** — do not generate extra documentation or summary files unless requested.\n- **Never embed literal credential values** — always reference environment variables. Never ask the user to paste secrets into the coding agent chat.\n\n## Phase 0: Framework selection and use case\n\nBefore scanning code, determine which compliance frameworks apply.\n\n### Step 1 — Framework selection\n\nUse the `AskUserQuestion` tool to ask the user which frameworks apply. **Do not infer or auto-select** — always ask explicitly.\n\nAsk:\n\n```\nWhich compliance frameworks should this audit cover?\nSelect all that apply (reply with numbers, e.g. \"1, 3\"):\n\n1. EU frameworks — EU AI Act, GPAI Code of Practice, GDPR\n   (choose if end-users or data subjects are located in the EU)\n\n2. US frameworks — NIST AI RMF, state laws (Colorado AI Act, NYC LL144),\n   HIPAA (if processing health data)\n   (choose if operating in the United States)\n\n3. ISO 42001 — International AI Management System standard\n   (choose if pursuing ISO 42001 certification, operating globally,\n   or wanting an internationally recognised baseline)\n\nYou can select any combination. If unsure, select all that seem relevant\nand we can narrow down during the audit.\n```\n\nBased on the selection:\n- **1 selected** — EU AI Act, GPAI Code of Practice, GDPR apply. See [references\u002Feu-ai-act-gpai.md](references\u002Feu-ai-act-gpai.md).\n- **2 selected** — NIST AI RMF, Colorado AI Act, NYC LL144, HIPAA may apply. See [references\u002Fus-ai-compliance.md](references\u002Fus-ai-compliance.md).\n- **3 selected** — ISO 42001 AIMS controls apply. See [references\u002Fiso-42001.md](references\u002Fiso-42001.md). Note: ISO 42001 is an organisational management system — the audit will cover technically-auditable controls only; purely organisational clauses (leadership review, internal audits) are flagged separately.\n- **Multiple selected** — all selected frameworks apply; the audit covers the union of requirements, with cross-references where frameworks overlap.\n\n### Step 2 — Determine use case category\n\nUse the `AskUserQuestion` tool to ask: **What does your AI application do?**\n\n- **General chatbot \u002F assistant** — Limited risk (EU), general obligations (US)\n- **Hiring \u002F HR** — High risk (EU Art. 6, Annex III); Colorado AI Act applies; NYC LL144 applies if NYC\n- **Healthcare** — High risk (EU); HIPAA applies if processing PHI\n- **Credit \u002F financial** — High risk (EU); Colorado AI Act applies\n- **Education** — High risk (EU)\n- **Content generation** — Limited risk (EU Art. 50 transparency); general obligations (US)\n- **GPAI model provider** — GPAI Code of Practice applies (EU)\n\n### Step 3 — Determine risk tier\n\nBased on the use case and selected frameworks:\n- **EU selected**: Classify as Unacceptable \u002F High \u002F Limited \u002F Minimal per [references\u002Feu-ai-act-gpai.md](references\u002Feu-ai-act-gpai.md)\n- **US selected**: Classify as High-risk (consequential decisions per Colorado AI Act) or General\n- **ISO 42001 selected**: Risk tier is not a formal classification in ISO 42001, but note whether the system is high-stakes (which elevates the priority of impact assessment and bias controls)\n\n### Phase 0 output\n\nPresent a brief summary:\n\n```\nFrameworks selected: {EU \u002F US \u002F ISO 42001 \u002F combination}\nUse case:            {category}\nRisk tier:           {EU tier if applicable} \u002F {US tier if applicable}\nApplicable:          {list of specific regulations and standards}\nISO 42001 note:      {if selected} Audit covers technically-auditable controls only;\n                     organisational clauses will be flagged but not code-audited.\n```\n\nThen proceed directly to Phase 1.\n\n## Phase 1: Codebase audit (read-only)\n\n**Do not write any code or create any files during this phase.**\n\nSystematically scan the codebase for evidence of compliance and gaps across seven domains. For each domain, run the listed searches and record findings.\n\n### A. Transparency and disclosure\n\n**What to look for:**\n- User-facing strings disclosing AI involvement: search for terms like `AI`, `artificial intelligence`, `automated`, `bot`, `machine learning`, `generated by`, `powered by` in UI templates, API responses, and user-facing code\n- Content labelling: markers on AI-generated output (text, images, audio)\n- Terms of service, privacy policy references in the codebase\n\n**Signals of concern:** Absence of any AI disclosure in user-facing code, especially if the application generates content or makes recommendations.\n\n### B. Data protection and privacy\n\n**What to look for:**\n- PII field names in code: `email`, `phone`, `ssn`, `social_security`, `date_of_birth`, `address`, `name` in prompts, context, or retrieved documents\n- PII in trace span attributes: check if `input.value` or `output.value` could contain personal data sent to Arize without redaction\n- Consent mechanisms: `consent`, `opt-in`, `opt-out`, `gdpr`, `ccpa` references\n- DPIA or privacy assessment references\n- Data retention and deletion handlers\n- Data subject rights: `right_to_access`, `right_to_erasure`, `data_subject_request`, `data_protection_officer`\n\n### C. Security\n\n**What to look for:**\n- Prompt injection defences: input validation, guardrail libraries (`guardrails-ai`, `nemo-guardrails`, `rebuff`, `lakera`), content filtering, system prompt protection\n- Data loss prevention: output scanning before returning to users, sensitive data detection\n- Tool\u002Ffunction calling controls: permission boundaries, allowlists, sandboxing for tool execution\n- Rate limiting and authentication on AI endpoints\n- Hardcoded secrets: `api_key`, `secret`, `password`, `token` literals in source files (not env var references)\n\n### D. Testing and evaluation\n\n**What to look for:**\n- Bias and fairness testing: references to demographic parity, impact ratios, fairness metrics\n- Red teaming or adversarial test suites: prompt injection tests, jailbreak tests\n- Evaluation frameworks: Arize evaluators, custom eval scripts, `pytest`-based evals, experiment infrastructure\n- A\u002FB testing or model comparison infrastructure\n\n### E. Documentation\n\n**What to look for:**\n- Model cards: `MODEL_CARD.md`, `model_card.json`, `model_card.yaml`, or similar\n- System architecture documentation\n- Change logs or version tracking for prompts and model updates\n- Incident response documentation\n\n### F. Monitoring and observability\n\n**What to look for:**\n- Arize tracing setup: `arize-otel`, `register()`, `TracerProvider`, `opentelemetry`, `openinference` imports\n- If tracing exists, check coverage:\n  - All LLM calls traced (not just some)\n  - Session IDs for conversation continuity\n  - User IDs for data subject request support\n  - Error tracking and exception spans\n- Alerting and drift detection configuration\n- Trace retention configuration\n\n### G. Vendor management\n\n**What to look for:**\n- Third-party AI API usage: OpenAI, Anthropic, Google, Azure, Bedrock, Cohere imports or client instantiation\n- Model versioning: are specific model versions pinned (e.g., `gpt-4-0613`) or using `latest` \u002F unversioned identifiers\n- Fallback and failover logic between providers\n\n### Phase 1 output\n\nPresent a two-part report:\n\n**Part 1 — Summary table**\n\n| Domain | Evidence found | Gaps identified | Rating |\n|---|---|---|---|\n| A. Transparency | {findings} | {gaps} | Compliant \u002F Partial \u002F Non-compliant \u002F N\u002FA |\n| B. Data protection | {findings} | {gaps} | ... |\n| C. Security | {findings} | {gaps} | ... |\n| D. Testing | {findings} | {gaps} | ... |\n| E. Documentation | {findings} | {gaps} | ... |\n| F. Monitoring | {findings} | {gaps} | ... |\n| G. Vendor management | {findings} | {gaps} | ... |\n\n**Part 2 — Gap detail (required for every Non-compliant or Partial rating)**\n\nFor each domain rated Non-compliant or Partial, write a dedicated subsection that includes:\n\n1. **The exact code path** — file path(s), line number(s), and the relevant code snippet showing where the gap exists. Do not paraphrase; quote the actual code.\n2. **Why it matters in this specific app** — explain the concrete risk in the context of this codebase (e.g. which tools could be abused, which data flows are exposed, what an attacker or regulator would find).\n3. **What is missing** — a precise description of the control or code that should exist but does not (e.g. \"a span attribute processor that hashes `user_email` before the OTLP exporter fires\", not just \"add PII redaction\").\n\nMinimum one subsection per Non-compliant\u002FPartial domain. Do not omit this section — it is the primary value of the audit for engineering teams.\n\nThen proceed directly to Phase 2.\n\n## Phase 2: Compliance checklist\n\nUsing the Phase 1 findings and the template in [references\u002Fcompliance-checklist-template.md](references\u002Fcompliance-checklist-template.md), generate a **tailored compliance checklist**.\n\n### Rules for checklist generation\n\n1. **Only include relevant sections.** If the user is US-only, skip GDPR-specific items. If not healthcare, skip HIPAA. If not hiring in NYC, skip LL144.\n2. **Mark items from Phase 1.** Items where evidence was found: mark as `Compliant`. Items with gaps: mark as `Non-compliant` with a concrete remediation suggestion.\n3. **Prioritise correctly.** Critical = enforcement risk or system prohibition. High = required by regulation. Medium = recommended by framework. Low = best practice.\n4. **Be specific in remediation.** Instead of \"implement input validation\", say \"add a guardrail library like `guardrails-ai` to validate LLM inputs and outputs against your content policy\".\n5. **Include the instrumentation cross-reference table** from the template. If Arize tracing is not set up, flag this as a Critical gap — audit trails are required by EU Art. 12 and NIST MAN-2.1.\n\n### Final report\n\nPresent a single consolidated report with four sections:\n\n**Section 1 — Audit scope (Phase 0 summary)**\n- Frameworks selected, use case, risk tier, applicable regulations\n\n**Section 2 — Codebase findings (Phase 1 summary table)**\n- The domain table (A–G) with evidence, gaps, and ratings\n\n**Section 3 — Gap detail (Phase 1 expanded)**\n- One subsection per Non-compliant or Partial domain, each containing: exact file paths and line numbers, quoted code snippets, app-specific risk explanation, and a precise description of what is missing. This section is mandatory — never omit it.\n\n**Section 4 — Compliance checklist (Phase 2)**\n- The tailored checklist with status and remediation suggestions, instrumentation cross-reference table, priority summary, and recommended next steps\n\nWhen the user asks for a report file, write a single markdown file to `\u002Ftmp\u002F\u003Capp-name>-compliance-audit-\u003CYYYY-MM-DD>.md` containing all four sections.\n\nAfter presenting the report, offer Phase 3 remediation.\n\n## Phase 3: Remediation (optional)\n\nAfter presenting the checklist, offer to implement specific fixes. **Always use the `AskUserQuestion` tool to confirm before making any changes.**\n\n### Remediation categories\n\n**Add dependencies** — offer to install:\n- Guardrail libraries for input\u002Foutput validation (e.g., `guardrails-ai`, `nemo-guardrails`)\n- PII detection\u002Fredaction packages (e.g., `presidio-analyzer`, `scrubadub`)\n- Content safety classifiers\n\n**Insert code** — offer to add:\n- AI disclosure strings in user-facing output (templates, API responses)\n- PII redaction filters on span attributes before export to Arize\n- Input validation\u002Fsanitisation on AI endpoints\n- User ID attributes on trace spans for data subject request support\n\n**Create documentation templates** — offer to scaffold:\n- Model card template (markdown file with standard sections)\n- Incident response plan template\n- Data processing record template\n\n**Configure monitoring** — offer to set up via related skills:\n- Arize evaluators for bias detection and content safety (via `arize-evaluator` skill)\n- Tracing for audit trail coverage (via `arize-instrumentation` skill)\n\n### Remediation rules\n\n- Present each remediation as a **discrete, confirmable action**. Never batch-apply changes.\n- Show exactly what will change (file, code diff concept) then use the `AskUserQuestion` tool to get confirmation before applying.\n- Follow existing code style and project conventions.\n- Never embed credentials — always use environment variables.\n- Test that the application still builds after changes.\n\n## Skill orchestration\n\nWhen gaps identified in Phase 1 or 2 require capabilities from other Arize skills, offer to invoke them. **Always use the `AskUserQuestion` tool to ask before invoking another skill** and explain why it is relevant to the compliance gap.\n\n| Gap | Skill to invoke | Why |\n|---|---|---|\n| No tracing \u002F incomplete audit trail | `arize-instrumentation` | EU Art. 12 and NIST MAN-2.1 require event logging; Arize tracing provides this |\n| No bias or safety evaluation | `arize-evaluator` | Create LLM-as-judge evaluators for fairness, content safety, or quality monitoring |\n| Need trace export for compliance evidence | `arize-trace` | Export spans for regulatory documentation or incident investigation |\n| Need human review for high-risk decisions | `arize-annotation` | Set up annotation queues for human oversight per EU Art. 14 |\n| Need deep link to share compliance evidence | `arize-link` | Generate URLs to specific traces, spans, or evaluations for stakeholder review |\n\n## Instrumentation cross-reference\n\nIf Arize tracing is already set up, verify it meets compliance requirements:\n\n| Compliance need | Required trace data | What to check |\n|---|---|---|\n| Audit trail for AI decisions | All LLM spans with input\u002Foutput | Verify all LLM client calls are instrumented, not just some |\n| Data subject access requests | User ID attribute on spans | Check for `user.id` or custom user identifier attribute |\n| PII in traces | Sensitive data in `input.value`\u002F`output.value` | Check if PII passes through unredacted — flag if so |\n| Incident investigation | Error spans with full context | Check for exception tracking and error status on spans |\n| Retention requirements | Trace data retained for required period | EU: appropriate period (min 6 months for high-risk); HIPAA: 6 years |\n| Bias monitoring | Demographic or group attributes | Check for metadata attributes that enable fairness analysis |\n\nIf Arize tracing is **not** set up, this is a significant compliance gap. Offer: \"Shall I run the `arize-instrumentation` skill to set up audit-trail tracing? Regulatory frameworks (EU AI Act Art. 12, NIST AI RMF MAN-2.1) require event logging for AI systems.\"\n\n## Reference links\n\n| Resource | URL |\n|---|---|\n| EU AI Act full text | https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2024\u002F1689\u002Foj |\n| GPAI Code of Practice | https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Fpolicies\u002Fcontents-code-gpai |\n| Code of Practice portal | https:\u002F\u002Fcode-of-practice.ai\u002F |\n| NIST AI RMF | https:\u002F\u002Fwww.nist.gov\u002Fartificial-intelligence\u002Fai-risk-management-framework |\n| Colorado AI Act (SB24-205) | https:\u002F\u002Fleg.colorado.gov\u002Fbills\u002Fsb24-205 |\n| NYC Local Law 144 | https:\u002F\u002Fwww.nyc.gov\u002Fsite\u002Fdca\u002Fabout\u002Fautomated-employment-decision-tools.page |\n| HIPAA | https:\u002F\u002Fwww.hhs.gov\u002Fhipaa\u002Findex.html |\n| ISO\u002FIEC 42001:2023 | https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F42001.html |\n| Arize AX Docs | https:\u002F\u002Farize.com\u002Fdocs\u002Fax |\n\n## Reference files\n\n- [references\u002Feu-ai-act-gpai.md](references\u002Feu-ai-act-gpai.md) — EU AI Act and GPAI Code of Practice developer guide\n- [references\u002Fus-ai-compliance.md](references\u002Fus-ai-compliance.md) — US compliance landscape (NIST AI RMF, Colorado, NYC LL144, HIPAA)\n- [references\u002Fiso-42001.md](references\u002Fiso-42001.md) — ISO\u002FIEC 42001:2023 AI Management Systems developer guide (technically-auditable controls only)\n- [references\u002Fcompliance-checklist-template.md](references\u002Fcompliance-checklist-template.md) — Reusable checklist template for Phase 2 output\n",{"data":51,"body":52},{"name":4,"description":6},{"type":53,"children":54},"root",[55,64,78,88,95,103,107,150,153,159,234,240,245,252,273,278,290,295,359,365,381,454,460,465,502,508,513,522,527,533,541,546,552,560,629,639,645,652,813,819,826,912,918,925,956,962,969,1014,1020,1027,1109,1115,1122,1156,1162,1167,1175,1354,1362,1367,1409,1414,1419,1425,1443,1449,1525,1531,1536,1544,1552,1560,1568,1576,1584,1592,1600,1613,1618,1624,1641,1647,1657,1702,1712,1735,1745,1763,1773,1801,1807,1849,1855,1873,2008,2014,2019,2174,2192,2198,2374,2380],{"type":56,"tag":57,"props":58,"children":60},"element","h1",{"id":59},"arize-compliance-audit-skill",[61],{"type":62,"value":63},"text","Arize Compliance Audit Skill",{"type":56,"tag":65,"props":66,"children":67},"p",{},[68,70,76],{"type":62,"value":69},"Use this skill when the user wants to ",{"type":56,"tag":71,"props":72,"children":73},"strong",{},[74],{"type":62,"value":75},"audit their AI agent or LLM application for regulatory compliance",{"type":62,"value":77},". The skill scans the codebase for compliance gaps, cross-references Arize instrumentation for audit trail coverage, and produces a tailored checklist with optional remediation.",{"type":56,"tag":65,"props":79,"children":80},{},[81,86],{"type":56,"tag":71,"props":82,"children":83},{},[84],{"type":62,"value":85},"Triggers:",{"type":62,"value":87}," \"audit my app for compliance\", \"EU AI Act requirements\", \"NIST AI RMF checklist\", \"GDPR for AI\", \"is my AI app compliant\", \"compliance checklist\", \"regulatory audit\", \"ISO 42001\", \"AI management system\", \"AIMS certification\".",{"type":56,"tag":89,"props":90,"children":92},"h2",{"id":91},"disclaimer",[93],{"type":62,"value":94},"Disclaimer",{"type":56,"tag":65,"props":96,"children":97},{},[98],{"type":56,"tag":71,"props":99,"children":100},{},[101],{"type":62,"value":102},"Before doing anything else, present this disclaimer verbatim to the user:",{"type":56,"tag":104,"props":105,"children":106},"hr",{},[],{"type":56,"tag":108,"props":109,"children":110},"blockquote",{},[111,121,140],{"type":56,"tag":65,"props":112,"children":113},{},[114,116],{"type":62,"value":115},"⚠️ ",{"type":56,"tag":71,"props":117,"children":118},{},[119],{"type":62,"value":120},"Legal disclaimer",{"type":56,"tag":65,"props":122,"children":123},{},[124,126,131,133,138],{"type":62,"value":125},"This audit is for ",{"type":56,"tag":71,"props":127,"children":128},{},[129],{"type":62,"value":130},"guidance only",{"type":62,"value":132}," and does ",{"type":56,"tag":71,"props":134,"children":135},{},[136],{"type":62,"value":137},"not",{"type":62,"value":139}," constitute legal advice or a complete compliance assessment. It identifies common technical patterns and gaps based on publicly available regulatory frameworks, but cannot assess your organisation's specific legal obligations, contractual commitments, data processing agreements, or operational processes.",{"type":56,"tag":65,"props":141,"children":142},{},[143,148],{"type":56,"tag":71,"props":144,"children":145},{},[146],{"type":62,"value":147},"Do not rely on this output as a substitute for qualified legal counsel.",{"type":62,"value":149}," Regulatory compliance is a complex, jurisdiction-specific, and fact-dependent determination. Always engage a qualified attorney or compliance specialist for binding assessments.",{"type":56,"tag":104,"props":151,"children":152},{},[],{"type":56,"tag":89,"props":154,"children":156},{"id":155},"core-principles",[157],{"type":62,"value":158},"Core principles",{"type":56,"tag":160,"props":161,"children":162},"ul",{},[163,174,184,194,204,214,224],{"type":56,"tag":164,"props":165,"children":166},"li",{},[167,172],{"type":56,"tag":71,"props":168,"children":169},{},[170],{"type":62,"value":171},"Prefer inspection over mutation",{"type":62,"value":173}," — understand the codebase before suggesting changes.",{"type":56,"tag":164,"props":175,"children":176},{},[177,182],{"type":56,"tag":71,"props":178,"children":179},{},[180],{"type":62,"value":181},"Be practical, not legal",{"type":62,"value":183}," — produce developer-actionable items, not legal opinions.",{"type":56,"tag":164,"props":185,"children":186},{},[187,192],{"type":56,"tag":71,"props":188,"children":189},{},[190],{"type":62,"value":191},"Tailor to jurisdiction and use case",{"type":62,"value":193}," — a chatbot has different obligations than a hiring tool. Do not dump the entire regulatory framework.",{"type":56,"tag":164,"props":195,"children":196},{},[197,202],{"type":56,"tag":71,"props":198,"children":199},{},[200],{"type":62,"value":201},"Cross-reference instrumentation",{"type":62,"value":203}," — compliance requires audit trails; check whether Arize tracing captures what regulators expect.",{"type":56,"tag":164,"props":205,"children":206},{},[207,212],{"type":56,"tag":71,"props":208,"children":209},{},[210],{"type":62,"value":211},"Offer remediation, always confirm",{"type":62,"value":213}," — after presenting the checklist, offer to implement specific fixes, but never modify code without explicit user confirmation.",{"type":56,"tag":164,"props":215,"children":216},{},[217,222],{"type":56,"tag":71,"props":218,"children":219},{},[220],{"type":62,"value":221},"Keep output concise and production-focused",{"type":62,"value":223}," — do not generate extra documentation or summary files unless requested.",{"type":56,"tag":164,"props":225,"children":226},{},[227,232],{"type":56,"tag":71,"props":228,"children":229},{},[230],{"type":62,"value":231},"Never embed literal credential values",{"type":62,"value":233}," — always reference environment variables. Never ask the user to paste secrets into the coding agent chat.",{"type":56,"tag":89,"props":235,"children":237},{"id":236},"phase-0-framework-selection-and-use-case",[238],{"type":62,"value":239},"Phase 0: Framework selection and use case",{"type":56,"tag":65,"props":241,"children":242},{},[243],{"type":62,"value":244},"Before scanning code, determine which compliance frameworks apply.",{"type":56,"tag":246,"props":247,"children":249},"h3",{"id":248},"step-1-framework-selection",[250],{"type":62,"value":251},"Step 1 — Framework selection",{"type":56,"tag":65,"props":253,"children":254},{},[255,257,264,266,271],{"type":62,"value":256},"Use the ",{"type":56,"tag":258,"props":259,"children":261},"code",{"className":260},[],[262],{"type":62,"value":263},"AskUserQuestion",{"type":62,"value":265}," tool to ask the user which frameworks apply. ",{"type":56,"tag":71,"props":267,"children":268},{},[269],{"type":62,"value":270},"Do not infer or auto-select",{"type":62,"value":272}," — always ask explicitly.",{"type":56,"tag":65,"props":274,"children":275},{},[276],{"type":62,"value":277},"Ask:",{"type":56,"tag":279,"props":280,"children":284},"pre",{"className":281,"code":283,"language":62},[282],"language-text","Which compliance frameworks should this audit cover?\nSelect all that apply (reply with numbers, e.g. \"1, 3\"):\n\n1. EU frameworks — EU AI Act, GPAI Code of Practice, GDPR\n   (choose if end-users or data subjects are located in the EU)\n\n2. US frameworks — NIST AI RMF, state laws (Colorado AI Act, NYC LL144),\n   HIPAA (if processing health data)\n   (choose if operating in the United States)\n\n3. ISO 42001 — International AI Management System standard\n   (choose if pursuing ISO 42001 certification, operating globally,\n   or wanting an internationally recognised baseline)\n\nYou can select any combination. If unsure, select all that seem relevant\nand we can narrow down during the audit.\n",[285],{"type":56,"tag":258,"props":286,"children":288},{"__ignoreMap":287},"",[289],{"type":62,"value":283},{"type":56,"tag":65,"props":291,"children":292},{},[293],{"type":62,"value":294},"Based on the selection:",{"type":56,"tag":160,"props":296,"children":297},{},[298,316,332,349],{"type":56,"tag":164,"props":299,"children":300},{},[301,306,308,314],{"type":56,"tag":71,"props":302,"children":303},{},[304],{"type":62,"value":305},"1 selected",{"type":62,"value":307}," — EU AI Act, GPAI Code of Practice, GDPR apply. See ",{"type":56,"tag":309,"props":310,"children":312},"a",{"href":311},"references\u002Feu-ai-act-gpai.md",[313],{"type":62,"value":311},{"type":62,"value":315},".",{"type":56,"tag":164,"props":317,"children":318},{},[319,324,326,331],{"type":56,"tag":71,"props":320,"children":321},{},[322],{"type":62,"value":323},"2 selected",{"type":62,"value":325}," — NIST AI RMF, Colorado AI Act, NYC LL144, HIPAA may apply. See ",{"type":56,"tag":309,"props":327,"children":329},{"href":328},"references\u002Fus-ai-compliance.md",[330],{"type":62,"value":328},{"type":62,"value":315},{"type":56,"tag":164,"props":333,"children":334},{},[335,340,342,347],{"type":56,"tag":71,"props":336,"children":337},{},[338],{"type":62,"value":339},"3 selected",{"type":62,"value":341}," — ISO 42001 AIMS controls apply. See ",{"type":56,"tag":309,"props":343,"children":345},{"href":344},"references\u002Fiso-42001.md",[346],{"type":62,"value":344},{"type":62,"value":348},". Note: ISO 42001 is an organisational management system — the audit will cover technically-auditable controls only; purely organisational clauses (leadership review, internal audits) are flagged separately.",{"type":56,"tag":164,"props":350,"children":351},{},[352,357],{"type":56,"tag":71,"props":353,"children":354},{},[355],{"type":62,"value":356},"Multiple selected",{"type":62,"value":358}," — all selected frameworks apply; the audit covers the union of requirements, with cross-references where frameworks overlap.",{"type":56,"tag":246,"props":360,"children":362},{"id":361},"step-2-determine-use-case-category",[363],{"type":62,"value":364},"Step 2 — Determine use case category",{"type":56,"tag":65,"props":366,"children":367},{},[368,369,374,376],{"type":62,"value":256},{"type":56,"tag":258,"props":370,"children":372},{"className":371},[],[373],{"type":62,"value":263},{"type":62,"value":375}," tool to ask: ",{"type":56,"tag":71,"props":377,"children":378},{},[379],{"type":62,"value":380},"What does your AI application do?",{"type":56,"tag":160,"props":382,"children":383},{},[384,394,404,414,424,434,444],{"type":56,"tag":164,"props":385,"children":386},{},[387,392],{"type":56,"tag":71,"props":388,"children":389},{},[390],{"type":62,"value":391},"General chatbot \u002F assistant",{"type":62,"value":393}," — Limited risk (EU), general obligations (US)",{"type":56,"tag":164,"props":395,"children":396},{},[397,402],{"type":56,"tag":71,"props":398,"children":399},{},[400],{"type":62,"value":401},"Hiring \u002F HR",{"type":62,"value":403}," — High risk (EU Art. 6, Annex III); Colorado AI Act applies; NYC LL144 applies if NYC",{"type":56,"tag":164,"props":405,"children":406},{},[407,412],{"type":56,"tag":71,"props":408,"children":409},{},[410],{"type":62,"value":411},"Healthcare",{"type":62,"value":413}," — High risk (EU); HIPAA applies if processing PHI",{"type":56,"tag":164,"props":415,"children":416},{},[417,422],{"type":56,"tag":71,"props":418,"children":419},{},[420],{"type":62,"value":421},"Credit \u002F financial",{"type":62,"value":423}," — High risk (EU); Colorado AI Act applies",{"type":56,"tag":164,"props":425,"children":426},{},[427,432],{"type":56,"tag":71,"props":428,"children":429},{},[430],{"type":62,"value":431},"Education",{"type":62,"value":433}," — High risk (EU)",{"type":56,"tag":164,"props":435,"children":436},{},[437,442],{"type":56,"tag":71,"props":438,"children":439},{},[440],{"type":62,"value":441},"Content generation",{"type":62,"value":443}," — Limited risk (EU Art. 50 transparency); general obligations (US)",{"type":56,"tag":164,"props":445,"children":446},{},[447,452],{"type":56,"tag":71,"props":448,"children":449},{},[450],{"type":62,"value":451},"GPAI model provider",{"type":62,"value":453}," — GPAI Code of Practice applies (EU)",{"type":56,"tag":246,"props":455,"children":457},{"id":456},"step-3-determine-risk-tier",[458],{"type":62,"value":459},"Step 3 — Determine risk tier",{"type":56,"tag":65,"props":461,"children":462},{},[463],{"type":62,"value":464},"Based on the use case and selected frameworks:",{"type":56,"tag":160,"props":466,"children":467},{},[468,482,492],{"type":56,"tag":164,"props":469,"children":470},{},[471,476,478],{"type":56,"tag":71,"props":472,"children":473},{},[474],{"type":62,"value":475},"EU selected",{"type":62,"value":477},": Classify as Unacceptable \u002F High \u002F Limited \u002F Minimal per ",{"type":56,"tag":309,"props":479,"children":480},{"href":311},[481],{"type":62,"value":311},{"type":56,"tag":164,"props":483,"children":484},{},[485,490],{"type":56,"tag":71,"props":486,"children":487},{},[488],{"type":62,"value":489},"US selected",{"type":62,"value":491},": Classify as High-risk (consequential decisions per Colorado AI Act) or General",{"type":56,"tag":164,"props":493,"children":494},{},[495,500],{"type":56,"tag":71,"props":496,"children":497},{},[498],{"type":62,"value":499},"ISO 42001 selected",{"type":62,"value":501},": Risk tier is not a formal classification in ISO 42001, but note whether the system is high-stakes (which elevates the priority of impact assessment and bias controls)",{"type":56,"tag":246,"props":503,"children":505},{"id":504},"phase-0-output",[506],{"type":62,"value":507},"Phase 0 output",{"type":56,"tag":65,"props":509,"children":510},{},[511],{"type":62,"value":512},"Present a brief summary:",{"type":56,"tag":279,"props":514,"children":517},{"className":515,"code":516,"language":62},[282],"Frameworks selected: {EU \u002F US \u002F ISO 42001 \u002F combination}\nUse case:            {category}\nRisk tier:           {EU tier if applicable} \u002F {US tier if applicable}\nApplicable:          {list of specific regulations and standards}\nISO 42001 note:      {if selected} Audit covers technically-auditable controls only;\n                     organisational clauses will be flagged but not code-audited.\n",[518],{"type":56,"tag":258,"props":519,"children":520},{"__ignoreMap":287},[521],{"type":62,"value":516},{"type":56,"tag":65,"props":523,"children":524},{},[525],{"type":62,"value":526},"Then proceed directly to Phase 1.",{"type":56,"tag":89,"props":528,"children":530},{"id":529},"phase-1-codebase-audit-read-only",[531],{"type":62,"value":532},"Phase 1: Codebase audit (read-only)",{"type":56,"tag":65,"props":534,"children":535},{},[536],{"type":56,"tag":71,"props":537,"children":538},{},[539],{"type":62,"value":540},"Do not write any code or create any files during this phase.",{"type":56,"tag":65,"props":542,"children":543},{},[544],{"type":62,"value":545},"Systematically scan the codebase for evidence of compliance and gaps across seven domains. For each domain, run the listed searches and record findings.",{"type":56,"tag":246,"props":547,"children":549},{"id":548},"a-transparency-and-disclosure",[550],{"type":62,"value":551},"A. Transparency and disclosure",{"type":56,"tag":65,"props":553,"children":554},{},[555],{"type":56,"tag":71,"props":556,"children":557},{},[558],{"type":62,"value":559},"What to look for:",{"type":56,"tag":160,"props":561,"children":562},{},[563,619,624],{"type":56,"tag":164,"props":564,"children":565},{},[566,568,574,576,582,583,589,590,596,597,603,604,610,611,617],{"type":62,"value":567},"User-facing strings disclosing AI involvement: search for terms like ",{"type":56,"tag":258,"props":569,"children":571},{"className":570},[],[572],{"type":62,"value":573},"AI",{"type":62,"value":575},", ",{"type":56,"tag":258,"props":577,"children":579},{"className":578},[],[580],{"type":62,"value":581},"artificial intelligence",{"type":62,"value":575},{"type":56,"tag":258,"props":584,"children":586},{"className":585},[],[587],{"type":62,"value":588},"automated",{"type":62,"value":575},{"type":56,"tag":258,"props":591,"children":593},{"className":592},[],[594],{"type":62,"value":595},"bot",{"type":62,"value":575},{"type":56,"tag":258,"props":598,"children":600},{"className":599},[],[601],{"type":62,"value":602},"machine learning",{"type":62,"value":575},{"type":56,"tag":258,"props":605,"children":607},{"className":606},[],[608],{"type":62,"value":609},"generated by",{"type":62,"value":575},{"type":56,"tag":258,"props":612,"children":614},{"className":613},[],[615],{"type":62,"value":616},"powered by",{"type":62,"value":618}," in UI templates, API responses, and user-facing code",{"type":56,"tag":164,"props":620,"children":621},{},[622],{"type":62,"value":623},"Content labelling: markers on AI-generated output (text, images, audio)",{"type":56,"tag":164,"props":625,"children":626},{},[627],{"type":62,"value":628},"Terms of service, privacy policy references in the codebase",{"type":56,"tag":65,"props":630,"children":631},{},[632,637],{"type":56,"tag":71,"props":633,"children":634},{},[635],{"type":62,"value":636},"Signals of concern:",{"type":62,"value":638}," Absence of any AI disclosure in user-facing code, especially if the application generates content or makes recommendations.",{"type":56,"tag":246,"props":640,"children":642},{"id":641},"b-data-protection-and-privacy",[643],{"type":62,"value":644},"B. Data protection and privacy",{"type":56,"tag":65,"props":646,"children":647},{},[648],{"type":56,"tag":71,"props":649,"children":650},{},[651],{"type":62,"value":559},{"type":56,"tag":160,"props":653,"children":654},{},[655,710,731,771,776,781],{"type":56,"tag":164,"props":656,"children":657},{},[658,660,666,667,673,674,680,681,687,688,694,695,701,702,708],{"type":62,"value":659},"PII field names in code: ",{"type":56,"tag":258,"props":661,"children":663},{"className":662},[],[664],{"type":62,"value":665},"email",{"type":62,"value":575},{"type":56,"tag":258,"props":668,"children":670},{"className":669},[],[671],{"type":62,"value":672},"phone",{"type":62,"value":575},{"type":56,"tag":258,"props":675,"children":677},{"className":676},[],[678],{"type":62,"value":679},"ssn",{"type":62,"value":575},{"type":56,"tag":258,"props":682,"children":684},{"className":683},[],[685],{"type":62,"value":686},"social_security",{"type":62,"value":575},{"type":56,"tag":258,"props":689,"children":691},{"className":690},[],[692],{"type":62,"value":693},"date_of_birth",{"type":62,"value":575},{"type":56,"tag":258,"props":696,"children":698},{"className":697},[],[699],{"type":62,"value":700},"address",{"type":62,"value":575},{"type":56,"tag":258,"props":703,"children":705},{"className":704},[],[706],{"type":62,"value":707},"name",{"type":62,"value":709}," in prompts, context, or retrieved documents",{"type":56,"tag":164,"props":711,"children":712},{},[713,715,721,723,729],{"type":62,"value":714},"PII in trace span attributes: check if ",{"type":56,"tag":258,"props":716,"children":718},{"className":717},[],[719],{"type":62,"value":720},"input.value",{"type":62,"value":722}," or ",{"type":56,"tag":258,"props":724,"children":726},{"className":725},[],[727],{"type":62,"value":728},"output.value",{"type":62,"value":730}," could contain personal data sent to Arize without redaction",{"type":56,"tag":164,"props":732,"children":733},{},[734,736,742,743,749,750,756,757,762,763,769],{"type":62,"value":735},"Consent mechanisms: ",{"type":56,"tag":258,"props":737,"children":739},{"className":738},[],[740],{"type":62,"value":741},"consent",{"type":62,"value":575},{"type":56,"tag":258,"props":744,"children":746},{"className":745},[],[747],{"type":62,"value":748},"opt-in",{"type":62,"value":575},{"type":56,"tag":258,"props":751,"children":753},{"className":752},[],[754],{"type":62,"value":755},"opt-out",{"type":62,"value":575},{"type":56,"tag":258,"props":758,"children":760},{"className":759},[],[761],{"type":62,"value":19},{"type":62,"value":575},{"type":56,"tag":258,"props":764,"children":766},{"className":765},[],[767],{"type":62,"value":768},"ccpa",{"type":62,"value":770}," references",{"type":56,"tag":164,"props":772,"children":773},{},[774],{"type":62,"value":775},"DPIA or privacy assessment references",{"type":56,"tag":164,"props":777,"children":778},{},[779],{"type":62,"value":780},"Data retention and deletion handlers",{"type":56,"tag":164,"props":782,"children":783},{},[784,786,792,793,799,800,806,807],{"type":62,"value":785},"Data subject rights: ",{"type":56,"tag":258,"props":787,"children":789},{"className":788},[],[790],{"type":62,"value":791},"right_to_access",{"type":62,"value":575},{"type":56,"tag":258,"props":794,"children":796},{"className":795},[],[797],{"type":62,"value":798},"right_to_erasure",{"type":62,"value":575},{"type":56,"tag":258,"props":801,"children":803},{"className":802},[],[804],{"type":62,"value":805},"data_subject_request",{"type":62,"value":575},{"type":56,"tag":258,"props":808,"children":810},{"className":809},[],[811],{"type":62,"value":812},"data_protection_officer",{"type":56,"tag":246,"props":814,"children":816},{"id":815},"c-security",[817],{"type":62,"value":818},"C. Security",{"type":56,"tag":65,"props":820,"children":821},{},[822],{"type":56,"tag":71,"props":823,"children":824},{},[825],{"type":62,"value":559},{"type":56,"tag":160,"props":827,"children":828},{},[829,863,868,873,878],{"type":56,"tag":164,"props":830,"children":831},{},[832,834,840,841,847,848,854,855,861],{"type":62,"value":833},"Prompt injection defences: input validation, guardrail libraries (",{"type":56,"tag":258,"props":835,"children":837},{"className":836},[],[838],{"type":62,"value":839},"guardrails-ai",{"type":62,"value":575},{"type":56,"tag":258,"props":842,"children":844},{"className":843},[],[845],{"type":62,"value":846},"nemo-guardrails",{"type":62,"value":575},{"type":56,"tag":258,"props":849,"children":851},{"className":850},[],[852],{"type":62,"value":853},"rebuff",{"type":62,"value":575},{"type":56,"tag":258,"props":856,"children":858},{"className":857},[],[859],{"type":62,"value":860},"lakera",{"type":62,"value":862},"), content filtering, system prompt protection",{"type":56,"tag":164,"props":864,"children":865},{},[866],{"type":62,"value":867},"Data loss prevention: output scanning before returning to users, sensitive data detection",{"type":56,"tag":164,"props":869,"children":870},{},[871],{"type":62,"value":872},"Tool\u002Ffunction calling controls: permission boundaries, allowlists, sandboxing for tool execution",{"type":56,"tag":164,"props":874,"children":875},{},[876],{"type":62,"value":877},"Rate limiting and authentication on AI endpoints",{"type":56,"tag":164,"props":879,"children":880},{},[881,883,889,890,896,897,903,904,910],{"type":62,"value":882},"Hardcoded secrets: ",{"type":56,"tag":258,"props":884,"children":886},{"className":885},[],[887],{"type":62,"value":888},"api_key",{"type":62,"value":575},{"type":56,"tag":258,"props":891,"children":893},{"className":892},[],[894],{"type":62,"value":895},"secret",{"type":62,"value":575},{"type":56,"tag":258,"props":898,"children":900},{"className":899},[],[901],{"type":62,"value":902},"password",{"type":62,"value":575},{"type":56,"tag":258,"props":905,"children":907},{"className":906},[],[908],{"type":62,"value":909},"token",{"type":62,"value":911}," literals in source files (not env var references)",{"type":56,"tag":246,"props":913,"children":915},{"id":914},"d-testing-and-evaluation",[916],{"type":62,"value":917},"D. Testing and evaluation",{"type":56,"tag":65,"props":919,"children":920},{},[921],{"type":56,"tag":71,"props":922,"children":923},{},[924],{"type":62,"value":559},{"type":56,"tag":160,"props":926,"children":927},{},[928,933,938,951],{"type":56,"tag":164,"props":929,"children":930},{},[931],{"type":62,"value":932},"Bias and fairness testing: references to demographic parity, impact ratios, fairness metrics",{"type":56,"tag":164,"props":934,"children":935},{},[936],{"type":62,"value":937},"Red teaming or adversarial test suites: prompt injection tests, jailbreak tests",{"type":56,"tag":164,"props":939,"children":940},{},[941,943,949],{"type":62,"value":942},"Evaluation frameworks: Arize evaluators, custom eval scripts, ",{"type":56,"tag":258,"props":944,"children":946},{"className":945},[],[947],{"type":62,"value":948},"pytest",{"type":62,"value":950},"-based evals, experiment infrastructure",{"type":56,"tag":164,"props":952,"children":953},{},[954],{"type":62,"value":955},"A\u002FB testing or model comparison infrastructure",{"type":56,"tag":246,"props":957,"children":959},{"id":958},"e-documentation",[960],{"type":62,"value":961},"E. Documentation",{"type":56,"tag":65,"props":963,"children":964},{},[965],{"type":56,"tag":71,"props":966,"children":967},{},[968],{"type":62,"value":559},{"type":56,"tag":160,"props":970,"children":971},{},[972,999,1004,1009],{"type":56,"tag":164,"props":973,"children":974},{},[975,977,983,984,990,991,997],{"type":62,"value":976},"Model cards: ",{"type":56,"tag":258,"props":978,"children":980},{"className":979},[],[981],{"type":62,"value":982},"MODEL_CARD.md",{"type":62,"value":575},{"type":56,"tag":258,"props":985,"children":987},{"className":986},[],[988],{"type":62,"value":989},"model_card.json",{"type":62,"value":575},{"type":56,"tag":258,"props":992,"children":994},{"className":993},[],[995],{"type":62,"value":996},"model_card.yaml",{"type":62,"value":998},", or similar",{"type":56,"tag":164,"props":1000,"children":1001},{},[1002],{"type":62,"value":1003},"System architecture documentation",{"type":56,"tag":164,"props":1005,"children":1006},{},[1007],{"type":62,"value":1008},"Change logs or version tracking for prompts and model updates",{"type":56,"tag":164,"props":1010,"children":1011},{},[1012],{"type":62,"value":1013},"Incident response documentation",{"type":56,"tag":246,"props":1015,"children":1017},{"id":1016},"f-monitoring-and-observability",[1018],{"type":62,"value":1019},"F. Monitoring and observability",{"type":56,"tag":65,"props":1021,"children":1022},{},[1023],{"type":56,"tag":71,"props":1024,"children":1025},{},[1026],{"type":62,"value":559},{"type":56,"tag":160,"props":1028,"children":1029},{},[1030,1071,1099,1104],{"type":56,"tag":164,"props":1031,"children":1032},{},[1033,1035,1041,1042,1048,1049,1055,1056,1062,1063,1069],{"type":62,"value":1034},"Arize tracing setup: ",{"type":56,"tag":258,"props":1036,"children":1038},{"className":1037},[],[1039],{"type":62,"value":1040},"arize-otel",{"type":62,"value":575},{"type":56,"tag":258,"props":1043,"children":1045},{"className":1044},[],[1046],{"type":62,"value":1047},"register()",{"type":62,"value":575},{"type":56,"tag":258,"props":1050,"children":1052},{"className":1051},[],[1053],{"type":62,"value":1054},"TracerProvider",{"type":62,"value":575},{"type":56,"tag":258,"props":1057,"children":1059},{"className":1058},[],[1060],{"type":62,"value":1061},"opentelemetry",{"type":62,"value":575},{"type":56,"tag":258,"props":1064,"children":1066},{"className":1065},[],[1067],{"type":62,"value":1068},"openinference",{"type":62,"value":1070}," imports",{"type":56,"tag":164,"props":1072,"children":1073},{},[1074,1076],{"type":62,"value":1075},"If tracing exists, check coverage:\n",{"type":56,"tag":160,"props":1077,"children":1078},{},[1079,1084,1089,1094],{"type":56,"tag":164,"props":1080,"children":1081},{},[1082],{"type":62,"value":1083},"All LLM calls traced (not just some)",{"type":56,"tag":164,"props":1085,"children":1086},{},[1087],{"type":62,"value":1088},"Session IDs for conversation continuity",{"type":56,"tag":164,"props":1090,"children":1091},{},[1092],{"type":62,"value":1093},"User IDs for data subject request support",{"type":56,"tag":164,"props":1095,"children":1096},{},[1097],{"type":62,"value":1098},"Error tracking and exception spans",{"type":56,"tag":164,"props":1100,"children":1101},{},[1102],{"type":62,"value":1103},"Alerting and drift detection configuration",{"type":56,"tag":164,"props":1105,"children":1106},{},[1107],{"type":62,"value":1108},"Trace retention configuration",{"type":56,"tag":246,"props":1110,"children":1112},{"id":1111},"g-vendor-management",[1113],{"type":62,"value":1114},"G. Vendor management",{"type":56,"tag":65,"props":1116,"children":1117},{},[1118],{"type":56,"tag":71,"props":1119,"children":1120},{},[1121],{"type":62,"value":559},{"type":56,"tag":160,"props":1123,"children":1124},{},[1125,1130,1151],{"type":56,"tag":164,"props":1126,"children":1127},{},[1128],{"type":62,"value":1129},"Third-party AI API usage: OpenAI, Anthropic, Google, Azure, Bedrock, Cohere imports or client instantiation",{"type":56,"tag":164,"props":1131,"children":1132},{},[1133,1135,1141,1143,1149],{"type":62,"value":1134},"Model versioning: are specific model versions pinned (e.g., ",{"type":56,"tag":258,"props":1136,"children":1138},{"className":1137},[],[1139],{"type":62,"value":1140},"gpt-4-0613",{"type":62,"value":1142},") or using ",{"type":56,"tag":258,"props":1144,"children":1146},{"className":1145},[],[1147],{"type":62,"value":1148},"latest",{"type":62,"value":1150}," \u002F unversioned identifiers",{"type":56,"tag":164,"props":1152,"children":1153},{},[1154],{"type":62,"value":1155},"Fallback and failover logic between providers",{"type":56,"tag":246,"props":1157,"children":1159},{"id":1158},"phase-1-output",[1160],{"type":62,"value":1161},"Phase 1 output",{"type":56,"tag":65,"props":1163,"children":1164},{},[1165],{"type":62,"value":1166},"Present a two-part report:",{"type":56,"tag":65,"props":1168,"children":1169},{},[1170],{"type":56,"tag":71,"props":1171,"children":1172},{},[1173],{"type":62,"value":1174},"Part 1 — Summary table",{"type":56,"tag":1176,"props":1177,"children":1178},"table",{},[1179,1208],{"type":56,"tag":1180,"props":1181,"children":1182},"thead",{},[1183],{"type":56,"tag":1184,"props":1185,"children":1186},"tr",{},[1187,1193,1198,1203],{"type":56,"tag":1188,"props":1189,"children":1190},"th",{},[1191],{"type":62,"value":1192},"Domain",{"type":56,"tag":1188,"props":1194,"children":1195},{},[1196],{"type":62,"value":1197},"Evidence found",{"type":56,"tag":1188,"props":1199,"children":1200},{},[1201],{"type":62,"value":1202},"Gaps identified",{"type":56,"tag":1188,"props":1204,"children":1205},{},[1206],{"type":62,"value":1207},"Rating",{"type":56,"tag":1209,"props":1210,"children":1211},"tbody",{},[1212,1236,1257,1276,1296,1315,1335],{"type":56,"tag":1184,"props":1213,"children":1214},{},[1215,1221,1226,1231],{"type":56,"tag":1216,"props":1217,"children":1218},"td",{},[1219],{"type":62,"value":1220},"A. Transparency",{"type":56,"tag":1216,"props":1222,"children":1223},{},[1224],{"type":62,"value":1225},"{findings}",{"type":56,"tag":1216,"props":1227,"children":1228},{},[1229],{"type":62,"value":1230},"{gaps}",{"type":56,"tag":1216,"props":1232,"children":1233},{},[1234],{"type":62,"value":1235},"Compliant \u002F Partial \u002F Non-compliant \u002F N\u002FA",{"type":56,"tag":1184,"props":1237,"children":1238},{},[1239,1244,1248,1252],{"type":56,"tag":1216,"props":1240,"children":1241},{},[1242],{"type":62,"value":1243},"B. Data protection",{"type":56,"tag":1216,"props":1245,"children":1246},{},[1247],{"type":62,"value":1225},{"type":56,"tag":1216,"props":1249,"children":1250},{},[1251],{"type":62,"value":1230},{"type":56,"tag":1216,"props":1253,"children":1254},{},[1255],{"type":62,"value":1256},"...",{"type":56,"tag":1184,"props":1258,"children":1259},{},[1260,1264,1268,1272],{"type":56,"tag":1216,"props":1261,"children":1262},{},[1263],{"type":62,"value":818},{"type":56,"tag":1216,"props":1265,"children":1266},{},[1267],{"type":62,"value":1225},{"type":56,"tag":1216,"props":1269,"children":1270},{},[1271],{"type":62,"value":1230},{"type":56,"tag":1216,"props":1273,"children":1274},{},[1275],{"type":62,"value":1256},{"type":56,"tag":1184,"props":1277,"children":1278},{},[1279,1284,1288,1292],{"type":56,"tag":1216,"props":1280,"children":1281},{},[1282],{"type":62,"value":1283},"D. Testing",{"type":56,"tag":1216,"props":1285,"children":1286},{},[1287],{"type":62,"value":1225},{"type":56,"tag":1216,"props":1289,"children":1290},{},[1291],{"type":62,"value":1230},{"type":56,"tag":1216,"props":1293,"children":1294},{},[1295],{"type":62,"value":1256},{"type":56,"tag":1184,"props":1297,"children":1298},{},[1299,1303,1307,1311],{"type":56,"tag":1216,"props":1300,"children":1301},{},[1302],{"type":62,"value":961},{"type":56,"tag":1216,"props":1304,"children":1305},{},[1306],{"type":62,"value":1225},{"type":56,"tag":1216,"props":1308,"children":1309},{},[1310],{"type":62,"value":1230},{"type":56,"tag":1216,"props":1312,"children":1313},{},[1314],{"type":62,"value":1256},{"type":56,"tag":1184,"props":1316,"children":1317},{},[1318,1323,1327,1331],{"type":56,"tag":1216,"props":1319,"children":1320},{},[1321],{"type":62,"value":1322},"F. Monitoring",{"type":56,"tag":1216,"props":1324,"children":1325},{},[1326],{"type":62,"value":1225},{"type":56,"tag":1216,"props":1328,"children":1329},{},[1330],{"type":62,"value":1230},{"type":56,"tag":1216,"props":1332,"children":1333},{},[1334],{"type":62,"value":1256},{"type":56,"tag":1184,"props":1336,"children":1337},{},[1338,1342,1346,1350],{"type":56,"tag":1216,"props":1339,"children":1340},{},[1341],{"type":62,"value":1114},{"type":56,"tag":1216,"props":1343,"children":1344},{},[1345],{"type":62,"value":1225},{"type":56,"tag":1216,"props":1347,"children":1348},{},[1349],{"type":62,"value":1230},{"type":56,"tag":1216,"props":1351,"children":1352},{},[1353],{"type":62,"value":1256},{"type":56,"tag":65,"props":1355,"children":1356},{},[1357],{"type":56,"tag":71,"props":1358,"children":1359},{},[1360],{"type":62,"value":1361},"Part 2 — Gap detail (required for every Non-compliant or Partial rating)",{"type":56,"tag":65,"props":1363,"children":1364},{},[1365],{"type":62,"value":1366},"For each domain rated Non-compliant or Partial, write a dedicated subsection that includes:",{"type":56,"tag":1368,"props":1369,"children":1370},"ol",{},[1371,1381,1391],{"type":56,"tag":164,"props":1372,"children":1373},{},[1374,1379],{"type":56,"tag":71,"props":1375,"children":1376},{},[1377],{"type":62,"value":1378},"The exact code path",{"type":62,"value":1380}," — file path(s), line number(s), and the relevant code snippet showing where the gap exists. Do not paraphrase; quote the actual code.",{"type":56,"tag":164,"props":1382,"children":1383},{},[1384,1389],{"type":56,"tag":71,"props":1385,"children":1386},{},[1387],{"type":62,"value":1388},"Why it matters in this specific app",{"type":62,"value":1390}," — explain the concrete risk in the context of this codebase (e.g. which tools could be abused, which data flows are exposed, what an attacker or regulator would find).",{"type":56,"tag":164,"props":1392,"children":1393},{},[1394,1399,1401,1407],{"type":56,"tag":71,"props":1395,"children":1396},{},[1397],{"type":62,"value":1398},"What is missing",{"type":62,"value":1400}," — a precise description of the control or code that should exist but does not (e.g. \"a span attribute processor that hashes ",{"type":56,"tag":258,"props":1402,"children":1404},{"className":1403},[],[1405],{"type":62,"value":1406},"user_email",{"type":62,"value":1408}," before the OTLP exporter fires\", not just \"add PII redaction\").",{"type":56,"tag":65,"props":1410,"children":1411},{},[1412],{"type":62,"value":1413},"Minimum one subsection per Non-compliant\u002FPartial domain. Do not omit this section — it is the primary value of the audit for engineering teams.",{"type":56,"tag":65,"props":1415,"children":1416},{},[1417],{"type":62,"value":1418},"Then proceed directly to Phase 2.",{"type":56,"tag":89,"props":1420,"children":1422},{"id":1421},"phase-2-compliance-checklist",[1423],{"type":62,"value":1424},"Phase 2: Compliance checklist",{"type":56,"tag":65,"props":1426,"children":1427},{},[1428,1430,1435,1437,1442],{"type":62,"value":1429},"Using the Phase 1 findings and the template in ",{"type":56,"tag":309,"props":1431,"children":1433},{"href":1432},"references\u002Fcompliance-checklist-template.md",[1434],{"type":62,"value":1432},{"type":62,"value":1436},", generate a ",{"type":56,"tag":71,"props":1438,"children":1439},{},[1440],{"type":62,"value":1441},"tailored compliance checklist",{"type":62,"value":315},{"type":56,"tag":246,"props":1444,"children":1446},{"id":1445},"rules-for-checklist-generation",[1447],{"type":62,"value":1448},"Rules for checklist generation",{"type":56,"tag":1368,"props":1450,"children":1451},{},[1452,1462,1488,1498,1515],{"type":56,"tag":164,"props":1453,"children":1454},{},[1455,1460],{"type":56,"tag":71,"props":1456,"children":1457},{},[1458],{"type":62,"value":1459},"Only include relevant sections.",{"type":62,"value":1461}," If the user is US-only, skip GDPR-specific items. If not healthcare, skip HIPAA. If not hiring in NYC, skip LL144.",{"type":56,"tag":164,"props":1463,"children":1464},{},[1465,1470,1472,1478,1480,1486],{"type":56,"tag":71,"props":1466,"children":1467},{},[1468],{"type":62,"value":1469},"Mark items from Phase 1.",{"type":62,"value":1471}," Items where evidence was found: mark as ",{"type":56,"tag":258,"props":1473,"children":1475},{"className":1474},[],[1476],{"type":62,"value":1477},"Compliant",{"type":62,"value":1479},". Items with gaps: mark as ",{"type":56,"tag":258,"props":1481,"children":1483},{"className":1482},[],[1484],{"type":62,"value":1485},"Non-compliant",{"type":62,"value":1487}," with a concrete remediation suggestion.",{"type":56,"tag":164,"props":1489,"children":1490},{},[1491,1496],{"type":56,"tag":71,"props":1492,"children":1493},{},[1494],{"type":62,"value":1495},"Prioritise correctly.",{"type":62,"value":1497}," Critical = enforcement risk or system prohibition. High = required by regulation. Medium = recommended by framework. Low = best practice.",{"type":56,"tag":164,"props":1499,"children":1500},{},[1501,1506,1508,1513],{"type":56,"tag":71,"props":1502,"children":1503},{},[1504],{"type":62,"value":1505},"Be specific in remediation.",{"type":62,"value":1507}," Instead of \"implement input validation\", say \"add a guardrail library like ",{"type":56,"tag":258,"props":1509,"children":1511},{"className":1510},[],[1512],{"type":62,"value":839},{"type":62,"value":1514}," to validate LLM inputs and outputs against your content policy\".",{"type":56,"tag":164,"props":1516,"children":1517},{},[1518,1523],{"type":56,"tag":71,"props":1519,"children":1520},{},[1521],{"type":62,"value":1522},"Include the instrumentation cross-reference table",{"type":62,"value":1524}," from the template. If Arize tracing is not set up, flag this as a Critical gap — audit trails are required by EU Art. 12 and NIST MAN-2.1.",{"type":56,"tag":246,"props":1526,"children":1528},{"id":1527},"final-report",[1529],{"type":62,"value":1530},"Final report",{"type":56,"tag":65,"props":1532,"children":1533},{},[1534],{"type":62,"value":1535},"Present a single consolidated report with four sections:",{"type":56,"tag":65,"props":1537,"children":1538},{},[1539],{"type":56,"tag":71,"props":1540,"children":1541},{},[1542],{"type":62,"value":1543},"Section 1 — Audit scope (Phase 0 summary)",{"type":56,"tag":160,"props":1545,"children":1546},{},[1547],{"type":56,"tag":164,"props":1548,"children":1549},{},[1550],{"type":62,"value":1551},"Frameworks selected, use case, risk tier, applicable regulations",{"type":56,"tag":65,"props":1553,"children":1554},{},[1555],{"type":56,"tag":71,"props":1556,"children":1557},{},[1558],{"type":62,"value":1559},"Section 2 — Codebase findings (Phase 1 summary table)",{"type":56,"tag":160,"props":1561,"children":1562},{},[1563],{"type":56,"tag":164,"props":1564,"children":1565},{},[1566],{"type":62,"value":1567},"The domain table (A–G) with evidence, gaps, and ratings",{"type":56,"tag":65,"props":1569,"children":1570},{},[1571],{"type":56,"tag":71,"props":1572,"children":1573},{},[1574],{"type":62,"value":1575},"Section 3 — Gap detail (Phase 1 expanded)",{"type":56,"tag":160,"props":1577,"children":1578},{},[1579],{"type":56,"tag":164,"props":1580,"children":1581},{},[1582],{"type":62,"value":1583},"One subsection per Non-compliant or Partial domain, each containing: exact file paths and line numbers, quoted code snippets, app-specific risk explanation, and a precise description of what is missing. This section is mandatory — never omit it.",{"type":56,"tag":65,"props":1585,"children":1586},{},[1587],{"type":56,"tag":71,"props":1588,"children":1589},{},[1590],{"type":62,"value":1591},"Section 4 — Compliance checklist (Phase 2)",{"type":56,"tag":160,"props":1593,"children":1594},{},[1595],{"type":56,"tag":164,"props":1596,"children":1597},{},[1598],{"type":62,"value":1599},"The tailored checklist with status and remediation suggestions, instrumentation cross-reference table, priority summary, and recommended next steps",{"type":56,"tag":65,"props":1601,"children":1602},{},[1603,1605,1611],{"type":62,"value":1604},"When the user asks for a report file, write a single markdown file to ",{"type":56,"tag":258,"props":1606,"children":1608},{"className":1607},[],[1609],{"type":62,"value":1610},"\u002Ftmp\u002F\u003Capp-name>-compliance-audit-\u003CYYYY-MM-DD>.md",{"type":62,"value":1612}," containing all four sections.",{"type":56,"tag":65,"props":1614,"children":1615},{},[1616],{"type":62,"value":1617},"After presenting the report, offer Phase 3 remediation.",{"type":56,"tag":89,"props":1619,"children":1621},{"id":1620},"phase-3-remediation-optional",[1622],{"type":62,"value":1623},"Phase 3: Remediation (optional)",{"type":56,"tag":65,"props":1625,"children":1626},{},[1627,1629],{"type":62,"value":1628},"After presenting the checklist, offer to implement specific fixes. ",{"type":56,"tag":71,"props":1630,"children":1631},{},[1632,1634,1639],{"type":62,"value":1633},"Always use the ",{"type":56,"tag":258,"props":1635,"children":1637},{"className":1636},[],[1638],{"type":62,"value":263},{"type":62,"value":1640}," tool to confirm before making any changes.",{"type":56,"tag":246,"props":1642,"children":1644},{"id":1643},"remediation-categories",[1645],{"type":62,"value":1646},"Remediation categories",{"type":56,"tag":65,"props":1648,"children":1649},{},[1650,1655],{"type":56,"tag":71,"props":1651,"children":1652},{},[1653],{"type":62,"value":1654},"Add dependencies",{"type":62,"value":1656}," — offer to install:",{"type":56,"tag":160,"props":1658,"children":1659},{},[1660,1678,1697],{"type":56,"tag":164,"props":1661,"children":1662},{},[1663,1665,1670,1671,1676],{"type":62,"value":1664},"Guardrail libraries for input\u002Foutput validation (e.g., ",{"type":56,"tag":258,"props":1666,"children":1668},{"className":1667},[],[1669],{"type":62,"value":839},{"type":62,"value":575},{"type":56,"tag":258,"props":1672,"children":1674},{"className":1673},[],[1675],{"type":62,"value":846},{"type":62,"value":1677},")",{"type":56,"tag":164,"props":1679,"children":1680},{},[1681,1683,1689,1690,1696],{"type":62,"value":1682},"PII detection\u002Fredaction packages (e.g., ",{"type":56,"tag":258,"props":1684,"children":1686},{"className":1685},[],[1687],{"type":62,"value":1688},"presidio-analyzer",{"type":62,"value":575},{"type":56,"tag":258,"props":1691,"children":1693},{"className":1692},[],[1694],{"type":62,"value":1695},"scrubadub",{"type":62,"value":1677},{"type":56,"tag":164,"props":1698,"children":1699},{},[1700],{"type":62,"value":1701},"Content safety classifiers",{"type":56,"tag":65,"props":1703,"children":1704},{},[1705,1710],{"type":56,"tag":71,"props":1706,"children":1707},{},[1708],{"type":62,"value":1709},"Insert code",{"type":62,"value":1711}," — offer to add:",{"type":56,"tag":160,"props":1713,"children":1714},{},[1715,1720,1725,1730],{"type":56,"tag":164,"props":1716,"children":1717},{},[1718],{"type":62,"value":1719},"AI disclosure strings in user-facing output (templates, API responses)",{"type":56,"tag":164,"props":1721,"children":1722},{},[1723],{"type":62,"value":1724},"PII redaction filters on span attributes before export to Arize",{"type":56,"tag":164,"props":1726,"children":1727},{},[1728],{"type":62,"value":1729},"Input validation\u002Fsanitisation on AI endpoints",{"type":56,"tag":164,"props":1731,"children":1732},{},[1733],{"type":62,"value":1734},"User ID attributes on trace spans for data subject request support",{"type":56,"tag":65,"props":1736,"children":1737},{},[1738,1743],{"type":56,"tag":71,"props":1739,"children":1740},{},[1741],{"type":62,"value":1742},"Create documentation templates",{"type":62,"value":1744}," — offer to scaffold:",{"type":56,"tag":160,"props":1746,"children":1747},{},[1748,1753,1758],{"type":56,"tag":164,"props":1749,"children":1750},{},[1751],{"type":62,"value":1752},"Model card template (markdown file with standard sections)",{"type":56,"tag":164,"props":1754,"children":1755},{},[1756],{"type":62,"value":1757},"Incident response plan template",{"type":56,"tag":164,"props":1759,"children":1760},{},[1761],{"type":62,"value":1762},"Data processing record template",{"type":56,"tag":65,"props":1764,"children":1765},{},[1766,1771],{"type":56,"tag":71,"props":1767,"children":1768},{},[1769],{"type":62,"value":1770},"Configure monitoring",{"type":62,"value":1772}," — offer to set up via related skills:",{"type":56,"tag":160,"props":1774,"children":1775},{},[1776,1789],{"type":56,"tag":164,"props":1777,"children":1778},{},[1779,1781,1787],{"type":62,"value":1780},"Arize evaluators for bias detection and content safety (via ",{"type":56,"tag":258,"props":1782,"children":1784},{"className":1783},[],[1785],{"type":62,"value":1786},"arize-evaluator",{"type":62,"value":1788}," skill)",{"type":56,"tag":164,"props":1790,"children":1791},{},[1792,1794,1800],{"type":62,"value":1793},"Tracing for audit trail coverage (via ",{"type":56,"tag":258,"props":1795,"children":1797},{"className":1796},[],[1798],{"type":62,"value":1799},"arize-instrumentation",{"type":62,"value":1788},{"type":56,"tag":246,"props":1802,"children":1804},{"id":1803},"remediation-rules",[1805],{"type":62,"value":1806},"Remediation rules",{"type":56,"tag":160,"props":1808,"children":1809},{},[1810,1822,1834,1839,1844],{"type":56,"tag":164,"props":1811,"children":1812},{},[1813,1815,1820],{"type":62,"value":1814},"Present each remediation as a ",{"type":56,"tag":71,"props":1816,"children":1817},{},[1818],{"type":62,"value":1819},"discrete, confirmable action",{"type":62,"value":1821},". Never batch-apply changes.",{"type":56,"tag":164,"props":1823,"children":1824},{},[1825,1827,1832],{"type":62,"value":1826},"Show exactly what will change (file, code diff concept) then use the ",{"type":56,"tag":258,"props":1828,"children":1830},{"className":1829},[],[1831],{"type":62,"value":263},{"type":62,"value":1833}," tool to get confirmation before applying.",{"type":56,"tag":164,"props":1835,"children":1836},{},[1837],{"type":62,"value":1838},"Follow existing code style and project conventions.",{"type":56,"tag":164,"props":1840,"children":1841},{},[1842],{"type":62,"value":1843},"Never embed credentials — always use environment variables.",{"type":56,"tag":164,"props":1845,"children":1846},{},[1847],{"type":62,"value":1848},"Test that the application still builds after changes.",{"type":56,"tag":89,"props":1850,"children":1852},{"id":1851},"skill-orchestration",[1853],{"type":62,"value":1854},"Skill orchestration",{"type":56,"tag":65,"props":1856,"children":1857},{},[1858,1860,1871],{"type":62,"value":1859},"When gaps identified in Phase 1 or 2 require capabilities from other Arize skills, offer to invoke them. ",{"type":56,"tag":71,"props":1861,"children":1862},{},[1863,1864,1869],{"type":62,"value":1633},{"type":56,"tag":258,"props":1865,"children":1867},{"className":1866},[],[1868],{"type":62,"value":263},{"type":62,"value":1870}," tool to ask before invoking another skill",{"type":62,"value":1872}," and explain why it is relevant to the compliance gap.",{"type":56,"tag":1176,"props":1874,"children":1875},{},[1876,1897],{"type":56,"tag":1180,"props":1877,"children":1878},{},[1879],{"type":56,"tag":1184,"props":1880,"children":1881},{},[1882,1887,1892],{"type":56,"tag":1188,"props":1883,"children":1884},{},[1885],{"type":62,"value":1886},"Gap",{"type":56,"tag":1188,"props":1888,"children":1889},{},[1890],{"type":62,"value":1891},"Skill to invoke",{"type":56,"tag":1188,"props":1893,"children":1894},{},[1895],{"type":62,"value":1896},"Why",{"type":56,"tag":1209,"props":1898,"children":1899},{},[1900,1921,1942,1964,1986],{"type":56,"tag":1184,"props":1901,"children":1902},{},[1903,1908,1916],{"type":56,"tag":1216,"props":1904,"children":1905},{},[1906],{"type":62,"value":1907},"No tracing \u002F incomplete audit trail",{"type":56,"tag":1216,"props":1909,"children":1910},{},[1911],{"type":56,"tag":258,"props":1912,"children":1914},{"className":1913},[],[1915],{"type":62,"value":1799},{"type":56,"tag":1216,"props":1917,"children":1918},{},[1919],{"type":62,"value":1920},"EU Art. 12 and NIST MAN-2.1 require event logging; Arize tracing provides this",{"type":56,"tag":1184,"props":1922,"children":1923},{},[1924,1929,1937],{"type":56,"tag":1216,"props":1925,"children":1926},{},[1927],{"type":62,"value":1928},"No bias or safety evaluation",{"type":56,"tag":1216,"props":1930,"children":1931},{},[1932],{"type":56,"tag":258,"props":1933,"children":1935},{"className":1934},[],[1936],{"type":62,"value":1786},{"type":56,"tag":1216,"props":1938,"children":1939},{},[1940],{"type":62,"value":1941},"Create LLM-as-judge evaluators for fairness, content safety, or quality monitoring",{"type":56,"tag":1184,"props":1943,"children":1944},{},[1945,1950,1959],{"type":56,"tag":1216,"props":1946,"children":1947},{},[1948],{"type":62,"value":1949},"Need trace export for compliance evidence",{"type":56,"tag":1216,"props":1951,"children":1952},{},[1953],{"type":56,"tag":258,"props":1954,"children":1956},{"className":1955},[],[1957],{"type":62,"value":1958},"arize-trace",{"type":56,"tag":1216,"props":1960,"children":1961},{},[1962],{"type":62,"value":1963},"Export spans for regulatory documentation or incident investigation",{"type":56,"tag":1184,"props":1965,"children":1966},{},[1967,1972,1981],{"type":56,"tag":1216,"props":1968,"children":1969},{},[1970],{"type":62,"value":1971},"Need human review for high-risk decisions",{"type":56,"tag":1216,"props":1973,"children":1974},{},[1975],{"type":56,"tag":258,"props":1976,"children":1978},{"className":1977},[],[1979],{"type":62,"value":1980},"arize-annotation",{"type":56,"tag":1216,"props":1982,"children":1983},{},[1984],{"type":62,"value":1985},"Set up annotation queues for human oversight per EU Art. 14",{"type":56,"tag":1184,"props":1987,"children":1988},{},[1989,1994,2003],{"type":56,"tag":1216,"props":1990,"children":1991},{},[1992],{"type":62,"value":1993},"Need deep link to share compliance evidence",{"type":56,"tag":1216,"props":1995,"children":1996},{},[1997],{"type":56,"tag":258,"props":1998,"children":2000},{"className":1999},[],[2001],{"type":62,"value":2002},"arize-link",{"type":56,"tag":1216,"props":2004,"children":2005},{},[2006],{"type":62,"value":2007},"Generate URLs to specific traces, spans, or evaluations for stakeholder review",{"type":56,"tag":89,"props":2009,"children":2011},{"id":2010},"instrumentation-cross-reference",[2012],{"type":62,"value":2013},"Instrumentation cross-reference",{"type":56,"tag":65,"props":2015,"children":2016},{},[2017],{"type":62,"value":2018},"If Arize tracing is already set up, verify it meets compliance requirements:",{"type":56,"tag":1176,"props":2020,"children":2021},{},[2022,2043],{"type":56,"tag":1180,"props":2023,"children":2024},{},[2025],{"type":56,"tag":1184,"props":2026,"children":2027},{},[2028,2033,2038],{"type":56,"tag":1188,"props":2029,"children":2030},{},[2031],{"type":62,"value":2032},"Compliance need",{"type":56,"tag":1188,"props":2034,"children":2035},{},[2036],{"type":62,"value":2037},"Required trace data",{"type":56,"tag":1188,"props":2039,"children":2040},{},[2041],{"type":62,"value":2042},"What to check",{"type":56,"tag":1209,"props":2044,"children":2045},{},[2046,2064,2090,2120,2138,2156],{"type":56,"tag":1184,"props":2047,"children":2048},{},[2049,2054,2059],{"type":56,"tag":1216,"props":2050,"children":2051},{},[2052],{"type":62,"value":2053},"Audit trail for AI decisions",{"type":56,"tag":1216,"props":2055,"children":2056},{},[2057],{"type":62,"value":2058},"All LLM spans with input\u002Foutput",{"type":56,"tag":1216,"props":2060,"children":2061},{},[2062],{"type":62,"value":2063},"Verify all LLM client calls are instrumented, not just some",{"type":56,"tag":1184,"props":2065,"children":2066},{},[2067,2072,2077],{"type":56,"tag":1216,"props":2068,"children":2069},{},[2070],{"type":62,"value":2071},"Data subject access requests",{"type":56,"tag":1216,"props":2073,"children":2074},{},[2075],{"type":62,"value":2076},"User ID attribute on spans",{"type":56,"tag":1216,"props":2078,"children":2079},{},[2080,2082,2088],{"type":62,"value":2081},"Check for ",{"type":56,"tag":258,"props":2083,"children":2085},{"className":2084},[],[2086],{"type":62,"value":2087},"user.id",{"type":62,"value":2089}," or custom user identifier attribute",{"type":56,"tag":1184,"props":2091,"children":2092},{},[2093,2098,2115],{"type":56,"tag":1216,"props":2094,"children":2095},{},[2096],{"type":62,"value":2097},"PII in traces",{"type":56,"tag":1216,"props":2099,"children":2100},{},[2101,2103,2108,2110],{"type":62,"value":2102},"Sensitive data in ",{"type":56,"tag":258,"props":2104,"children":2106},{"className":2105},[],[2107],{"type":62,"value":720},{"type":62,"value":2109},"\u002F",{"type":56,"tag":258,"props":2111,"children":2113},{"className":2112},[],[2114],{"type":62,"value":728},{"type":56,"tag":1216,"props":2116,"children":2117},{},[2118],{"type":62,"value":2119},"Check if PII passes through unredacted — flag if so",{"type":56,"tag":1184,"props":2121,"children":2122},{},[2123,2128,2133],{"type":56,"tag":1216,"props":2124,"children":2125},{},[2126],{"type":62,"value":2127},"Incident investigation",{"type":56,"tag":1216,"props":2129,"children":2130},{},[2131],{"type":62,"value":2132},"Error spans with full context",{"type":56,"tag":1216,"props":2134,"children":2135},{},[2136],{"type":62,"value":2137},"Check for exception tracking and error status on spans",{"type":56,"tag":1184,"props":2139,"children":2140},{},[2141,2146,2151],{"type":56,"tag":1216,"props":2142,"children":2143},{},[2144],{"type":62,"value":2145},"Retention requirements",{"type":56,"tag":1216,"props":2147,"children":2148},{},[2149],{"type":62,"value":2150},"Trace data retained for required period",{"type":56,"tag":1216,"props":2152,"children":2153},{},[2154],{"type":62,"value":2155},"EU: appropriate period (min 6 months for high-risk); HIPAA: 6 years",{"type":56,"tag":1184,"props":2157,"children":2158},{},[2159,2164,2169],{"type":56,"tag":1216,"props":2160,"children":2161},{},[2162],{"type":62,"value":2163},"Bias monitoring",{"type":56,"tag":1216,"props":2165,"children":2166},{},[2167],{"type":62,"value":2168},"Demographic or group attributes",{"type":56,"tag":1216,"props":2170,"children":2171},{},[2172],{"type":62,"value":2173},"Check for metadata attributes that enable fairness analysis",{"type":56,"tag":65,"props":2175,"children":2176},{},[2177,2179,2183,2185,2190],{"type":62,"value":2178},"If Arize tracing is ",{"type":56,"tag":71,"props":2180,"children":2181},{},[2182],{"type":62,"value":137},{"type":62,"value":2184}," set up, this is a significant compliance gap. Offer: \"Shall I run the ",{"type":56,"tag":258,"props":2186,"children":2188},{"className":2187},[],[2189],{"type":62,"value":1799},{"type":62,"value":2191}," skill to set up audit-trail tracing? Regulatory frameworks (EU AI Act Art. 12, NIST AI RMF MAN-2.1) require event logging for AI systems.\"",{"type":56,"tag":89,"props":2193,"children":2195},{"id":2194},"reference-links",[2196],{"type":62,"value":2197},"Reference links",{"type":56,"tag":1176,"props":2199,"children":2200},{},[2201,2217],{"type":56,"tag":1180,"props":2202,"children":2203},{},[2204],{"type":56,"tag":1184,"props":2205,"children":2206},{},[2207,2212],{"type":56,"tag":1188,"props":2208,"children":2209},{},[2210],{"type":62,"value":2211},"Resource",{"type":56,"tag":1188,"props":2213,"children":2214},{},[2215],{"type":62,"value":2216},"URL",{"type":56,"tag":1209,"props":2218,"children":2219},{},[2220,2238,2255,2272,2289,2306,2323,2340,2357],{"type":56,"tag":1184,"props":2221,"children":2222},{},[2223,2228],{"type":56,"tag":1216,"props":2224,"children":2225},{},[2226],{"type":62,"value":2227},"EU AI Act full text",{"type":56,"tag":1216,"props":2229,"children":2230},{},[2231],{"type":56,"tag":309,"props":2232,"children":2236},{"href":2233,"rel":2234},"https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2024\u002F1689\u002Foj",[2235],"nofollow",[2237],{"type":62,"value":2233},{"type":56,"tag":1184,"props":2239,"children":2240},{},[2241,2246],{"type":56,"tag":1216,"props":2242,"children":2243},{},[2244],{"type":62,"value":2245},"GPAI Code of Practice",{"type":56,"tag":1216,"props":2247,"children":2248},{},[2249],{"type":56,"tag":309,"props":2250,"children":2253},{"href":2251,"rel":2252},"https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Fpolicies\u002Fcontents-code-gpai",[2235],[2254],{"type":62,"value":2251},{"type":56,"tag":1184,"props":2256,"children":2257},{},[2258,2263],{"type":56,"tag":1216,"props":2259,"children":2260},{},[2261],{"type":62,"value":2262},"Code of Practice portal",{"type":56,"tag":1216,"props":2264,"children":2265},{},[2266],{"type":56,"tag":309,"props":2267,"children":2270},{"href":2268,"rel":2269},"https:\u002F\u002Fcode-of-practice.ai\u002F",[2235],[2271],{"type":62,"value":2268},{"type":56,"tag":1184,"props":2273,"children":2274},{},[2275,2280],{"type":56,"tag":1216,"props":2276,"children":2277},{},[2278],{"type":62,"value":2279},"NIST AI RMF",{"type":56,"tag":1216,"props":2281,"children":2282},{},[2283],{"type":56,"tag":309,"props":2284,"children":2287},{"href":2285,"rel":2286},"https:\u002F\u002Fwww.nist.gov\u002Fartificial-intelligence\u002Fai-risk-management-framework",[2235],[2288],{"type":62,"value":2285},{"type":56,"tag":1184,"props":2290,"children":2291},{},[2292,2297],{"type":56,"tag":1216,"props":2293,"children":2294},{},[2295],{"type":62,"value":2296},"Colorado AI Act (SB24-205)",{"type":56,"tag":1216,"props":2298,"children":2299},{},[2300],{"type":56,"tag":309,"props":2301,"children":2304},{"href":2302,"rel":2303},"https:\u002F\u002Fleg.colorado.gov\u002Fbills\u002Fsb24-205",[2235],[2305],{"type":62,"value":2302},{"type":56,"tag":1184,"props":2307,"children":2308},{},[2309,2314],{"type":56,"tag":1216,"props":2310,"children":2311},{},[2312],{"type":62,"value":2313},"NYC Local Law 144",{"type":56,"tag":1216,"props":2315,"children":2316},{},[2317],{"type":56,"tag":309,"props":2318,"children":2321},{"href":2319,"rel":2320},"https:\u002F\u002Fwww.nyc.gov\u002Fsite\u002Fdca\u002Fabout\u002Fautomated-employment-decision-tools.page",[2235],[2322],{"type":62,"value":2319},{"type":56,"tag":1184,"props":2324,"children":2325},{},[2326,2331],{"type":56,"tag":1216,"props":2327,"children":2328},{},[2329],{"type":62,"value":2330},"HIPAA",{"type":56,"tag":1216,"props":2332,"children":2333},{},[2334],{"type":56,"tag":309,"props":2335,"children":2338},{"href":2336,"rel":2337},"https:\u002F\u002Fwww.hhs.gov\u002Fhipaa\u002Findex.html",[2235],[2339],{"type":62,"value":2336},{"type":56,"tag":1184,"props":2341,"children":2342},{},[2343,2348],{"type":56,"tag":1216,"props":2344,"children":2345},{},[2346],{"type":62,"value":2347},"ISO\u002FIEC 42001:2023",{"type":56,"tag":1216,"props":2349,"children":2350},{},[2351],{"type":56,"tag":309,"props":2352,"children":2355},{"href":2353,"rel":2354},"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F42001.html",[2235],[2356],{"type":62,"value":2353},{"type":56,"tag":1184,"props":2358,"children":2359},{},[2360,2365],{"type":56,"tag":1216,"props":2361,"children":2362},{},[2363],{"type":62,"value":2364},"Arize AX Docs",{"type":56,"tag":1216,"props":2366,"children":2367},{},[2368],{"type":56,"tag":309,"props":2369,"children":2372},{"href":2370,"rel":2371},"https:\u002F\u002Farize.com\u002Fdocs\u002Fax",[2235],[2373],{"type":62,"value":2370},{"type":56,"tag":89,"props":2375,"children":2377},{"id":2376},"reference-files",[2378],{"type":62,"value":2379},"Reference files",{"type":56,"tag":160,"props":2381,"children":2382},{},[2383,2392,2401,2410],{"type":56,"tag":164,"props":2384,"children":2385},{},[2386,2390],{"type":56,"tag":309,"props":2387,"children":2388},{"href":311},[2389],{"type":62,"value":311},{"type":62,"value":2391}," — EU AI Act and GPAI Code of Practice developer guide",{"type":56,"tag":164,"props":2393,"children":2394},{},[2395,2399],{"type":56,"tag":309,"props":2396,"children":2397},{"href":328},[2398],{"type":62,"value":328},{"type":62,"value":2400}," — US compliance landscape (NIST AI RMF, Colorado, NYC LL144, HIPAA)",{"type":56,"tag":164,"props":2402,"children":2403},{},[2404,2408],{"type":56,"tag":309,"props":2405,"children":2406},{"href":344},[2407],{"type":62,"value":344},{"type":62,"value":2409}," — ISO\u002FIEC 42001:2023 AI Management Systems developer guide (technically-auditable controls only)",{"type":56,"tag":164,"props":2411,"children":2412},{},[2413,2417],{"type":56,"tag":309,"props":2414,"children":2415},{"href":1432},[2416],{"type":62,"value":1432},{"type":62,"value":2418}," — Reusable checklist template for Phase 2 output",{"items":2420,"total":2517},[2421,2437,2459,2472,2480,2496,2505],{"slug":2422,"name":2422,"fn":2423,"description":2424,"org":2425,"tags":2426,"stars":29,"repoUrl":30,"updatedAt":2436},"arize-admin","manage Arize enterprise user access","Manages Arize users, organizations, spaces, projects, roles, role bindings, resource restrictions, and API keys via the ax CLI. Use for enterprise admin workflows: inviting and offboarding users, onboarding new teams, creating custom roles for SAML\u002FSSO mappings, assigning roles to users, restricting project-level access, and managing service keys for multi-tenant architectures. Covers ax users, ax organizations, ax spaces, ax projects, ax roles, ax role-bindings, and ax api-keys.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2427,2430,2433],{"name":2428,"slug":2429,"type":16},"CLI","cli",{"name":2431,"slug":2432,"type":16},"Operations","operations",{"name":2434,"slug":2435,"type":16},"Permissions","permissions","2026-07-22T05:37:21.991338",{"slug":2438,"name":2438,"fn":2439,"description":2440,"org":2441,"tags":2442,"stars":29,"repoUrl":30,"updatedAt":2458},"arize-ai-provider-integration","manage Arize AI provider integrations","Creates, reads, updates, and deletes Arize AI integrations that store LLM provider credentials used by evaluators and other Arize features. Supports any LLM provider (e.g. OpenAI, Anthropic, Azure OpenAI, AWS Bedrock, Vertex AI, Gemini, NVIDIA NIM). Use when the user mentions AI integration, LLM provider credentials, create integration, list integrations, update credentials, delete integration, or connecting an LLM provider to Arize.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2443,2446,2449,2452,2455],{"name":2444,"slug":2445,"type":16},"Anthropic","anthropic",{"name":2447,"slug":2448,"type":16},"Azure","azure",{"name":2450,"slug":2451,"type":16},"Integrations","integrations",{"name":2453,"slug":2454,"type":16},"LLM","llm",{"name":2456,"slug":2457,"type":16},"OpenAI","openai","2026-07-22T05:37:23.90468",{"slug":1980,"name":1980,"fn":2460,"description":2461,"org":2462,"tags":2463,"stars":29,"repoUrl":30,"updatedAt":2471},"manage Arize annotation workflows","Creates and manages annotation configs (categorical, continuous, freeform label schemas) and annotation queues (human review workflows) on Arize. Applies human annotations to project spans via the Python SDK. Use when the user mentions annotation config, annotation queue, label schema, human feedback, bulk annotate spans, update_annotations, labeling queue, annotate record, or human review.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2464,2467,2468],{"name":2465,"slug":2466,"type":16},"Data Analysis","data-analysis",{"name":2453,"slug":2454,"type":16},{"name":2469,"slug":2470,"type":16},"Observability","observability","2026-07-22T05:37:19.010776",{"slug":4,"name":4,"fn":5,"description":6,"org":2473,"tags":2474,"stars":29,"repoUrl":30,"updatedAt":31},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2475,2476,2477,2478,2479],{"name":24,"slug":25,"type":16},{"name":21,"slug":22,"type":16},{"name":18,"slug":19,"type":16},{"name":27,"slug":28,"type":16},{"name":14,"slug":15,"type":16},{"slug":2481,"name":2481,"fn":2482,"description":2483,"org":2484,"tags":2485,"stars":29,"repoUrl":30,"updatedAt":2495},"arize-dataset","manage Arize datasets and examples","Creates, manages, and queries Arize datasets and examples. Covers dataset CRUD, appending examples, exporting data, and file-based dataset creation using the ax CLI. Use when the user needs test data, evaluation examples, or mentions create dataset, list datasets, export dataset, append examples, dataset version, golden dataset, or test set.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2486,2489,2491,2494],{"name":2487,"slug":2488,"type":16},"Data Engineering","data-engineering",{"name":2490,"slug":41,"type":16},"Datasets",{"name":2492,"slug":2493,"type":16},"Evals","evals",{"name":2453,"slug":2454,"type":16},"2026-07-22T05:37:20.943718",{"slug":1786,"name":1786,"fn":2497,"description":2498,"org":2499,"tags":2500,"stars":29,"repoUrl":30,"updatedAt":2504},"configure and run Arize evaluations","Handles LLM-as-judge and code evaluator workflows on Arize including creating\u002Fupdating evaluators, running evaluations on spans or experiments, managing tasks, trigger-run operations, column mapping, and continuous monitoring. Use when the user mentions create evaluator, LLM judge, code evaluator, hallucination, faithfulness, correctness, relevance, run eval, score spans, score experiment, trigger-run, column mapping, continuous monitoring, or improve evaluator prompt.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2501,2502,2503],{"name":2492,"slug":2493,"type":16},{"name":2453,"slug":2454,"type":16},{"name":2469,"slug":2470,"type":16},"2026-07-25T05:32:37.552903",{"slug":2506,"name":2506,"fn":2507,"description":2508,"org":2509,"tags":2510,"stars":29,"repoUrl":30,"updatedAt":2516},"arize-experiment","run and analyze Arize experiments","Creates, runs, and analyzes Arize experiments for evaluating and comparing model performance. Covers experiment CRUD, exporting runs, comparing results, and evaluation workflows using the ax CLI. Use when the user mentions create experiment, run experiment, compare models, model performance, evaluate AI, experiment results, benchmark, A\u002FB test models, or measure accuracy.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2511,2514,2515],{"name":2512,"slug":2513,"type":16},"Analytics","analytics",{"name":2492,"slug":2493,"type":16},{"name":2453,"slug":2454,"type":16},"2026-07-31T05:53:44.725539",13,{"items":2519,"total":2638},[2520,2534,2543,2555,2567,2577,2589,2599,2610,2616,2624,2630],{"slug":2521,"name":2521,"fn":2522,"description":2523,"org":2524,"tags":2525,"stars":2531,"repoUrl":2532,"updatedAt":2533},"annotate-spans","annotate LLM spans and traces","Write effective, consistent annotations on LLM\u002Fagent spans and traces, and coach the user on annotation practice. Load this whenever you are about to record structured feedback with the `batch_span_annotate` tool, or when the user asks how to annotate, label, score, or review spans\u002Ftraces, build a failure taxonomy, or set up human\u002FLLM review. Do NOT load for: pure analysis with no intent to save feedback (use debug-trace), latency or cost statistics, or prompt authoring (use playground).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2526,2527,2528,2529],{"name":2492,"slug":2493,"type":16},{"name":2453,"slug":2454,"type":16},{"name":2469,"slug":2470,"type":16},{"name":2530,"slug":44,"type":16},"Tracing",10513,"https:\u002F\u002Fgithub.com\u002FArize-ai\u002Fphoenix","2026-07-12T08:08:14.140984",{"slug":41,"name":41,"fn":2535,"description":2536,"org":2537,"tags":2538,"stars":2531,"repoUrl":2532,"updatedAt":2542},"reason about Phoenix dataset structure","Understand what a Phoenix dataset is and reason well about its examples, outputs, splits, and how it feeds evaluators and experiments. Load this whenever a dataset is in view or the user asks what a dataset is, how splits work, what an output \"means\", or how datasets relate to experiments and evals. This skill governs the judgment; any tool descriptions govern the mechanics.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2539,2540,2541],{"name":2465,"slug":2466,"type":16},{"name":2490,"slug":41,"type":16},{"name":2492,"slug":2493,"type":16},"2026-07-12T08:08:21.695457",{"slug":2544,"name":2544,"fn":2545,"description":2546,"org":2547,"tags":2548,"stars":2531,"repoUrl":2532,"updatedAt":2554},"debug-trace","diagnose failures using trace investigation","Diagnose failure modes by systematically investigating traces. Trigger when the user explicitly asks for cross-trace diagnosis: \"what's going wrong?\", \"were there errors?\", \"debug this\", \"where is my agent struggling?\". Do NOT trigger on: (1) advice questions (\"what should I do?\"), (2) statistical questions (\"what's the average latency?\"), (3) summarize requests, (4) trace filtering (\"show me traces with errors\"), (5) vague questions (\"is there a problem?\"), (6) unrelated requests.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2549,2552,2553],{"name":2550,"slug":2551,"type":16},"Debugging","debugging",{"name":2469,"slug":2470,"type":16},{"name":2530,"slug":44,"type":16},"2026-07-12T08:08:10.44243",{"slug":2556,"name":2556,"fn":2557,"description":2558,"org":2559,"tags":2560,"stars":2531,"repoUrl":2532,"updatedAt":2566},"evaluators","author and refine Phoenix evaluators","Author or refine a Phoenix evaluator — code or LLM-as-a-judge — that scores a run's output. Trigger when the user wants to create a new evaluator, improve an existing one's logic or rubric, choose labels, or decide what to measure on a dataset or experiment. Do NOT trigger on: (1) manual prompt drafting (use `playground`), (2) running or comparing experiments themselves (use `experiments`), (3) cross-trace failure diagnosis with no evaluator in scope (use `debug-trace`).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2561,2562,2563],{"name":2492,"slug":2493,"type":16},{"name":2453,"slug":2454,"type":16},{"name":2564,"slug":2565,"type":16},"Testing","testing","2026-07-31T05:58:09.13624",{"slug":42,"name":42,"fn":2568,"description":2569,"org":2570,"tags":2571,"stars":2531,"repoUrl":2532,"updatedAt":2576},"run and compare dataset-backed experiments","Run, read, and compare dataset-backed experiments to find evidence that a prompt or pipeline is improving. Trigger when the user wants to iterate over a dataset with experiments, compare experiment runs, read experiment quality\u002Flatency\u002Fcost, or decide whether a change actually helped. Running a prompt over a dataset is implicitly an experiment — load this skill when dataset-backed work begins, before authoring evaluators for the experiment and before starting the recorded run, not only when reading results. Do NOT trigger on: (1) manual prompt drafting with no dataset-backed evaluation in scope (use `playground`), (2) authoring or refining an evaluator's logic or rubric (use `evaluators`), (3) cross-trace failure diagnosis with no experiment in scope (use `debug-trace`).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2572,2573,2574,2575],{"name":2490,"slug":41,"type":16},{"name":2492,"slug":2493,"type":16},{"name":2453,"slug":2454,"type":16},{"name":2564,"slug":2565,"type":16},"2026-07-12T08:08:11.691477",{"slug":2578,"name":2578,"fn":2579,"description":2580,"org":2581,"tags":2582,"stars":2531,"repoUrl":2532,"updatedAt":2588},"phoenix-graphql","query Phoenix API with GraphQL","Write efficient GraphQL queries against the Phoenix API. Load this skill in two cases: (1) before composing any non-trivial GraphQL query yourself for data analysis (via the `phoenix-gql` bash command) — it contains schema entrypoints and patterns that eliminate the need for introspection; (2) when the user asks for help writing GraphQL queries for their own scripts, tools, or integrations against Phoenix — it covers the endpoint, authentication, and client examples.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2583,2584,2585],{"name":2512,"slug":2513,"type":16},{"name":2465,"slug":2466,"type":16},{"name":2586,"slug":2587,"type":16},"GraphQL","graphql","2026-07-12T08:08:17.163493",{"slug":2590,"name":2590,"fn":2591,"description":2592,"org":2593,"tags":2594,"stars":2531,"repoUrl":2532,"updatedAt":2598},"playground","author and iterate on prompts in Phoenix","Author, edit, or iterate on prompts in the Phoenix prompt playground, including running experiments over a dataset. Load before any playground tool call, including single-shot prompt rewrites.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2595,2596,2597],{"name":2492,"slug":2493,"type":16},{"name":2453,"slug":2454,"type":16},{"name":2564,"slug":2565,"type":16},"2026-07-12T08:08:12.920792",{"slug":2600,"name":2600,"fn":2601,"description":2602,"org":2603,"tags":2604,"stars":2531,"repoUrl":2532,"updatedAt":2609},"span-coding","analyze and code Phoenix spans","Open-code Phoenix spans with PXI-owned notes, recover those notes for axial coding, and promote stable categories into structured annotations. Load this when analyzing spans to discover failure patterns before a taxonomy exists.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2605,2606,2607,2608],{"name":2550,"slug":2551,"type":16},{"name":2453,"slug":2454,"type":16},{"name":2469,"slug":2470,"type":16},{"name":2530,"slug":44,"type":16},"2026-07-12T08:08:19.597239",{"slug":2422,"name":2422,"fn":2423,"description":2424,"org":2611,"tags":2612,"stars":29,"repoUrl":30,"updatedAt":2436},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2613,2614,2615],{"name":2428,"slug":2429,"type":16},{"name":2431,"slug":2432,"type":16},{"name":2434,"slug":2435,"type":16},{"slug":2438,"name":2438,"fn":2439,"description":2440,"org":2617,"tags":2618,"stars":29,"repoUrl":30,"updatedAt":2458},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2619,2620,2621,2622,2623],{"name":2444,"slug":2445,"type":16},{"name":2447,"slug":2448,"type":16},{"name":2450,"slug":2451,"type":16},{"name":2453,"slug":2454,"type":16},{"name":2456,"slug":2457,"type":16},{"slug":1980,"name":1980,"fn":2460,"description":2461,"org":2625,"tags":2626,"stars":29,"repoUrl":30,"updatedAt":2471},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2627,2628,2629],{"name":2465,"slug":2466,"type":16},{"name":2453,"slug":2454,"type":16},{"name":2469,"slug":2470,"type":16},{"slug":4,"name":4,"fn":5,"description":6,"org":2631,"tags":2632,"stars":29,"repoUrl":30,"updatedAt":31},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2633,2634,2635,2636,2637],{"name":24,"slug":25,"type":16},{"name":21,"slug":22,"type":16},{"name":18,"slug":19,"type":16},{"name":27,"slug":28,"type":16},{"name":14,"slug":15,"type":16},23]