Auditborb · Prototype

GRC Evidence Collection

Three workflow approaches, mocked up locally for visual comparison. Each option has 3 steps. Click into any to walk through the flow.

Option A
Auto-collected with exception review
Integrations pull evidence on a schedule. Owner only sees the gaps.
1 Connect a source
2 Inbox — exceptions queue
3 Review & sign off on an exception
Scenario performance
S1Wrapper Era
S2SoR Premium
S3Commodity Hell
S4AI-Native Newcomers
← platformsapplications →

Wins in Scenarios 1 + 2. Vulnerable in Scenario 3. Integration breadth is a moat foundation models cannot replicate without per-tenant data plumbing. Loses defensibility if Controllers bypass the platform entirely (Commodity Hell trigger fires).

Full strategic analysis
No-regret context
This is a candidate implementation of no-regret move #2 (audit-grade output layer). The evaluation question is not "which scenario does this hedge" but "does this win or hold position across all four scenarios."
What this prototype proves
  • Integration breadth (NetSuite, Okta, AWS, GitHub) is a moat foundation models cannot replicate without per-tenant plumbing.
  • Exception-queue UX is a defensible workflow pattern — owner only sees the gaps.
  • Auto-collected evidence has clear data lineage from source system to control mapping.
What it does not address
  • Customers who skip the GRC platform entirely (S3 Commodity Hell — the integration moat becomes irrelevant).
  • Long-tail integration overhead beyond the top 10 systems.
  • Big 4 acceptance of auto-collected vs manually-curated evidence — the audit-acceptance loop is unresolved.
Per-scenario performance
S1 ✓Wins. Integration plumbing is exactly the moat foundation models lack. Anthropic ships SOX agents — they still need our tenant connectors to produce evidence.
S2 ✓Wins. Workflow ownership and data lineage are the value layer in this scenario; integration breadth deepens both.
S3 ✗Vulnerable. If Controllers use Claude / ChatGPT directly and skip GRC platforms entirely, integration breadth has no audience.
S4 ~Mixed. Newcomers can match integrations over time but face cold-start; Optro's incumbent integration library is a transitional moat.
Recommendation
Defensible secondary direction if Option C (data graph) is too engineering-expensive. Not the no-regret play, but the strongest "ship now" candidate.
Moat: integration breadthDefensible
▶ Start tour📊 PM analysis
Option B
Conversational evidence request
Auditor asks in chat; owner replies. AI ties the thread to controls.
1 Auditor composes a request
2 Owner replies in thread
3 Resolved & linked to control
Scenario performance
S1Wrapper Era
S2SoR Premium
S3Commodity Hell
S4AI-Native Newcomers
← platformsapplications →

Vulnerable across all four scenarios. Wrapper risk: every foundation model ships conversational evidence collection natively. Demo-friendly today; does not survive a Wrapper Era or Commodity Hell trigger. Not the no-regret move.

Full strategic analysis
No-regret context
Candidate implementation of no-regret move #2. The evaluation finds this option does not satisfy the no-regret criterion — it is vulnerable in every scenario. Documented anyway as a discipline signal: Optro labels its own work honestly.
What this prototype proves
  • It is demo-friendly and easy to mock — auditor-to-owner conversation maps to a familiar chat UX.
  • AI-tied-to-control mapping looks magical in a short demo.
  • The "wrapper risk" is structural, not implementation-dependent.
What it does not address
  • Foundation models ship conversational evidence collection natively — the workflow is reproducible without Optro.
  • There is no defensible structural moat at the workflow layer alone.
  • The control-mapping layer is the only Optro-specific element; it is data, not workflow.
Per-scenario performance
S1 ✗Vulnerable. Anthropic ships conversational SOX agents with native control mapping. The workflow has no defensible Optro layer.
S2 ✗Vulnerable. The data + workflow moat the SoR Premium scenario requires is absent — chat is portable.
S3 ✗Vulnerable. Controllers running Claude / ChatGPT directly already have this workflow built-in.
S4 ✗Vulnerable. Newcomers ship this in their first sprint; no incumbent moat.
Recommendation
Not the production direction. Useful as a strategy-review contrast option and for the "what NOT to ship" narrative — the explicit weak-option discipline is itself a board-friendly signal.
Moat: weak (wrapper risk)Demo-friendly
▶ Start tour📊 PM analysis
Option C recommended
Evidence reuse / freshness graph
Every artifact is a node. New requests auto-find existing evidence across frameworks.
1 Smart match — find existing evidence
2 Artifact detail — see the graph
3 Library & freshness dashboard
No-regret move #2 · cross-scenario
S1Wrapper Era
S2SoR Premium
S3Commodity Hell
S4AI-Native Newcomers
← platformsapplications →

No-regret across all four scenarios. Compounding data graph IS the audit-grade output layer named in the scenario plan as no-regret move #2. Wins under data-decisive futures (S1, S2); provides the defensibility floor under commoditizing futures (S3, S4).

Full strategic analysis
No-regret context
This option satisfies the no-regret criterion — it wins or holds defensibility in all four scenarios. Aligns with both no-regret move #1 (deepen the system of record) and no-regret move #2 (audit-grade output layer).
What this prototype proves
  • The data graph compounds — every new artifact strengthens the moat (network effect within the tenant).
  • Cross-framework matching (SOC 2 ↔ ISO ↔ NIST) is structurally hard to replicate without Optro's tenant graph.
  • Freshness dashboard IS the audit-grade output layer named in the scenario plan.
  • Operating model is "data graph that compounds," not "workflow that automates."
What it does not address
  • Cold-start problem for new tenants — graph value scales with accumulated data.
  • Legal review for any cross-customer data implications (if any).
  • Engineering complexity of the graph data model and matching algorithms — significantly higher than Options A or B.
Per-scenario performance
S1 ✓Wins. Data graph is exactly what Anthropic-shipped agents cannot replicate — it is the substance underneath the surface.
S2 ✓Wins. The compounding-data-as-moat thesis IS the SoR Premium scenario — this is the canonical artifact.
S3 ~Holds. Even in Commodity Hell, the data graph is the differentiator: customers who self-serve foundation models still need audit-defensible evidence chains.
S4 ~Holds. Newcomers face the cold-start problem; Optro's tenant-graph head-start is a transitional moat that gives time to defend.
Recommendation
Recommended production direction. Higher engineering effort than A or B, but the only option that satisfies the no-regret criterion across all four scenarios.
Moat: compounding data graphStrongest fit
▶ Start tour📊 PM analysis
Chrome lifted from /Users/sanderson/Optro-Agentic-Platform/client/src/components/layout/. 9 prototype screens + this index.