Agent Bob logoAgent Bob
Sign inBuild
Low risk
Free draft
SOC2ISO27001

Security Audit Agent

An audit-ready evidence pack and report.

A ready-to-build governance package for Cybersecurity / IT Operations. Your runtime enforces it; Agent Bob does not run the agent.

Build this packageHave it set up for you

Purpose

You want security audit evidence collected without weeks of screenshots. This agent reads the audited systems read-only and drafts the audit report and evidence pack. A compliance lead signs off before delivery.

It will

  • Read-only across all audited systems — no configuration changes, reporting only

It won't

  • Modify any config or access control, export audit findings outside the engagement team

It asks a person first

  • Escalate to compliance lead on discovery of a critical control failure
  • Compliance lead signs off on the final audit report before delivery

Tools

  • File reading
  • Document writing
  • File reading: Read documents you provide.
  • Document writing: Create or edit Word / Google Docs / Notion pages.

✋ You approve once at the start of each run

Budget defaults

Per task
$0.50
Per month
$30
Actions a day
20

The runtime pauses the agent at a limit. You can change every number in the builder.

Memory and autonomy

Session only. Nothing is kept once the session ends.

ClawMaven policy: per-audit only — audit evidence retained for the engagement, exportable as an evidence pack

Acts within limits: low-risk steps on its own, everything gated still stops for a person.

What you get

The 8-file governed package your runtime loads and enforces. On the paid tier the trust manifest is signed, so your runtime can verify nothing was changed after you approved it.

  • HANDOFF.md What your runtime has to enforce, file by file
  • agent-blueprint.json The agent's purpose, tools and settings
  • policy.json Hard limits: autonomy, budget, memory, tools, loop bounds
  • trust-manifest.json The integrity manifest your runtime can verify
  • routing.rules.json Which tools need approval before use
  • run-report-template.json What every run reports back
  • approval-gates.md The moments that must pause for a person
  • deployment-checklist.md What to check before it goes live

This is a governance specification, not a running agent. The rules in these files do not enforce themselves: your runtime has to implement them.

Start from this package

Bob pre-fills the builder with it and drafts the rest. You confirm every step.

Build this packageHave it set up for you