> For the complete documentation index, see [llms.txt](https://surecloud.gitbook.io/surecloud-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://surecloud.gitbook.io/surecloud-docs/documentation/gracie/personas-skills-and-agents/skill-and-persona-reference.md).

# Skill and Persona Reference

Browse the current Gracie persona, skill, and knowledge base catalogue by category.

## Skill and Persona Reference

This page lists the Gracie personas, skills, and knowledge bases available today.

Use it as a quick catalogue.

For the product model, see [Personas, Skills and Agents](/surecloud-docs/documentation/gracie/personas-skills-and-agents.md). For tenant skill management, see [Skills](/surecloud-docs/documentation/gracie/personas-skills-and-agents/skills.md). For workflow automation, see [Agents](/surecloud-docs/documentation/gracie/personas-skills-and-agents/agents.md).

### Personas

#### Ask the Team

Routes one question to the most relevant personas and returns a single synthesised view.

Try: `ask the team`, `review this from all angles`, `get expert opinion`.

#### Specialist personas

* **Business Continuity SME** — recovery, resilience, BCP coverage, RTO, and RPO.
* **Compliance SME** — regulatory exposure, framework mapping, and control adequacy.
* **Internal Audit SME** — assurance coverage, evidence gaps, and audit readiness.
* **Privacy SME** — personal data, DPIA triggers, and breach notification.
* **Risk SME** — inherent and residual risk, appetite, and treatment trade-offs.
* **Security SME** — threat scenarios, control strength, and attack paths.
* **AI Governance SME** — AI use cases, model providers, third parties, and AI risk.

### Skills

Skills give Gracie focused capabilities for specific jobs.

Some skills advise only.

Others can create, update, or link records.

#### Create and update records

* **`create-risk`** — draft a new risk with duplicate checking and confirmation.
* **`create-action`** — creates a new Action and can link it to the source record.
* **`create-exception`** — creates a new Exception and can link it to the source record.
* **`create-record-from-source`** — create a record from text or a document.
* **`create-assessment-findings`** — turn flagged assessment gaps into findings.
* **`draft-finding-with-recommendation`** — turn an observation into a structured finding.
* **`add-comment-to-answer`** — post a comment to an assessment question.
* **`map-control-to-regulations`** — suggest library regulations and standards a control satisfies.
* **`onboard-third-party`** — create or enrich a third-party record from vendor material.
* **`plan-audit`** — draft an audit plan and link matching auditable entities.
* **`populate-assessment-from-source`** — answer assessment questions from evidence.
* **`review-contract-nst`** — flag non-standard contract terms and draft NST records.
* **`screen-project-for-pii`** — decide whether a project needs a privacy assessment.

#### Review and verify evidence

* **`cyber-essentials-review`** — validate a Cyber Essentials or CE Plus certificate.
* **`iso27001-review`** — validate an ISO 27001 certificate.
* **`review-policy`** — review a policy against its metadata and content, then flag improvements.
* **`review-compliance-doc`** — rate how far a policy or evidence file can be relied on.
* **`review-soc2-report`** — review a vendor's SOC 2 report and state how far you can rely on it.
* **`doc-confidence-check`** — run an independent second pass on a document reliance rating.
* **`review-bcp-against-bia`** — compare a BCP to BIAs and flag coverage gaps.
* **`review-risk-event`** — map a risk event to realised risks and likely-failed controls.
* **`review-assessment-gaps`** — audit an assessment for gaps, contradictions, and score issues.

#### Assess and draft

* **`assess-privacy-breach`** — apply the GDPR notification rubric to a privacy breach.
* **`draft-incident-report`** — build a grounded post-incident report from linked records.
* **`score-finding-rating`** — suggest a calibrated finding severity.
* **`suggest-risk-controls`** — rank relevant controls for the current risk.

#### Summarise and advise

* **`brief-me`** — show your task list by urgency.
* **`summarise-record`** — give a three-point overview of the open record.
* **`summarise-audit-progress`** — roll up audit progress, findings, and working papers.
* **`triage-incident`** — compare a new incident to similar cases and suggest next actions.
* **`triage-dsar`** — map likely data sources and build a DSAR response plan.
* **`find-similar-risks`** — search the risk register for duplicates or close matches.
* **`flag-failing-controls`** — show controls failing tests or self-assessments.
* **`recommend-treatment`** — advise whether to accept, mitigate, transfer, or avoid a risk.
* **`map-controls-cross-framework`** — show where a control satisfies multiple frameworks.
* **`monte-carlo-risk`** — quantify one risk using a FAIR-style loss simulation.
* **`quant-quality-check`** — independently check a quantitative risk analysis.

#### Dashboards and reports

* **`create-dashboard`** — create a new dashboard container.
* **`create-report`** — add a chart to a dashboard from plain language.
* **`copy-dashboard`** — duplicate a dashboard with its components and filters.

#### Skill authoring tools

* **`build-skill`** — shape and draft a new skill from plain language.
* **`skill-authoring-kb`** — reference rules, patterns, and quality checks for skill authors.
* **`probe-attribute-shapes`** — inspect real field shapes before creating a skill.

{% hint style="info" %}
When a skill writes data, it shows a draft first and waits for confirmation.
{% endhint %}

### Knowledge bases

Knowledge bases give Gracie structured reference material to use in answers and analysis.

* **`gdpr`** — lawful basis, DPIA triggers, breach timelines, and article mapping.
* **`ccpa`** — applicability, role classification, rights handling, and notice checks.
* **`eu-ai-act`** — risk-tier classification, role lookup, and obligation gaps.
* **`iso-22301`** — clause lookup, continuity mapping, and evidence gaps.
* **`nist-csf`** — function and subcategory mapping and gap spotting.
* **`soc-2`** — criterion lookup, control mapping, and report review support.

### Related pages

See [Write and Test Custom Skills](/surecloud-docs/documentation/gracie/personas-skills-and-agents/write-and-test-custom-skills.md) for authoring guidance and [Agents](/surecloud-docs/documentation/gracie/personas-skills-and-agents/agents.md) for how these skills are used in automation.