ABDULLAH AL OWASI29 connected domain projects
AI governance, third-party risk, controls, privacy, audit readiness, resilience and assurance workflows connected through explicit records and review dependencies.
Agentic GRC / controls assurance / accountable AI
Automate preparation.
Preserve accountable judgment.
A decision-grade operating model for AI-assisted compliance: agents can gather, draft, compare and prepare; accountable reviewers retain scope, materiality, control-effectiveness, exception, risk-acceptance, release and sign-off decisions.
Single source of truth
29 projects. 29 operating domains. One assurance model.
29 GRC operating domains
Distinct decision spaces with bounded scope, evidence requirements, calculations, reviewer gates and handover outputs.
16 shared record types
Common evidence, risk, control, issue and ownership objects keep cross-domain reasoning traceable without pretending unrelated decisions share one score.
132 register/reporting views
Inspectable views for evidence freshness, exceptions, ownership, treatment, control status and management reporting.
Delegation boundary
The agent does the legwork. The accountable reviewer makes the call.
Automation can prepare
- Evidence request lists, first-pass registers and document cross-checks
- Gap and readiness drafts, control mappings and questionnaire preparation
- Vendor and AI-system inventory normalization
- Change signals, missing-item queues and candidate remediation
- Draft audit walkthroughs, sampling plans and management summaries
Human decision rights stay explicit
- Scope, applicability and materiality
- Whether evidence is sufficient and trustworthy
- Whether a control is designed and operating effectively
- Exception, treatment, residual-risk and risk-acceptance decisions
- Release, authorization, sign-off and accountable escalation
Automation is treated as a preparation layer, not as delegated authority, certification, legal judgment or an audit opinion.
Capability map
From agent preparation to independent assurance.
GRC setup review & prioritization
Inventory the current operating model, rank the highest-value review workflows, surface broken or missing components and produce a bounded 30-day action plan.
Role-based review modes
Separate implementation, audit/assurance and strategic-governance viewpoints so recommendations are evaluated against the right decision authority.
Evidence & readiness preparation
Request, normalize and cross-check evidence; track freshness, exceptions and missing support before a reviewer relies on it.
Change-to-control impact
Review system or process changes for downstream effects on authorization, logging, privacy, retention, vendor obligations and approved operating boundaries—even where the change is technically valid.
Agent/tool/data authorization
Define allowed tools, data classes, actions, approval conditions and escalation paths before autonomous workflows cross material boundaries.
Open D28 →Evidence integrity & provenance
Track source, dates, review state and decision lineage so generated conclusions remain distinguishable from verified observations.
Open D27 →Agent security guardrails
Review prompt-injection exposure, credential handling, destructive actions, package/source provenance, permission escalation and explicit approval requirements as governance risks around autonomous execution.
AI inventory & lifecycle authorization
Maintain use-case inventory, accountable owners, evaluation evidence, oversight, release prerequisites and material-change review.
Open D14 →Continuous monitoring & triggers
Convert evidence expiry, control drift, vendor change, authorization change and unresolved exceptions into named review queues and decision triggers.
Open D29 →Framework lookup & source discipline
Separate framework interpretation from local implementation facts. Confirm current source material and applicability before a mapping or conclusion is treated as authoritative.
External automation benchmark
Use open GRC agent skills to pressure-test the human boundary.
grcskills.com ↗ publishes 60 open agent skills across gap/readiness, statements of applicability, risk, audit preparation, evidence, vendors, policies, privacy, AI systems, incidents and continuity. The useful benchmark is not that agents can produce more documents; it is that routine GRC preparation is becoming automatable.
This portfolio therefore concentrates on the layer that remains consequential: evidence validity, control effectiveness, authorization, exception handling, treatment, residual risk and accountable sign-off.
The external library is linked as a public reference. It is not bundled into this repository, and its outputs are not represented as Abdullah Al Owasi's own authored methods.
Decision-grade review routes
Inspect the controls around autonomous work.
D24 / Identity, least privilege & segregation
Review who or what can act, under which identity, and where privilege or conflicting authority requires escalation.
Inspect D24 →D27 / Logging, evidence integrity & provenance
Keep generated, observed and reviewed evidence states distinct and traceable.
Inspect D27 →D28 / Agent, tool & data authorization
Bound autonomous tool use and data access before execution.
Inspect D28 →D29 / Assessment, authorization & ongoing monitoring
Re-open decisions when risk, evidence, model behavior, supplier state or operating assumptions materially change.
Inspect D29 →Implementation boundary
What this public portfolio proves—and what it does not.
The public system demonstrates review logic, synthetic scenarios, browser-local records, scoring, evidence states, decision exports and human authorization gates. It does not claim a production autonomous-agent runtime, live PR security scanner, client telemetry, independent certification, legal advice or an audit opinion. Production integrations require authorized data access, security review, tenancy controls, monitoring and an agreed implementation scope.