1. Connect your assistant first, open the screens second
Everything the Sovaign interface can do, an MCP or API client can do, with the same
credential and the same rules. Add https://app.sovaign.com/mcp as a
connector in Claude or ChatGPT (it signs you in with OAuth), or in Claude Code with
your own token. Then ask the questions you would ask a colleague:
“Am I compliant with ISO 27001? Give me the top three gaps, and which document closes each.”
The answer comes back structured, with citations into your own approved documents — not a chat transcript you have to trust. The screens are where you decide; your assistant is where you ask.
2. Your assistant proposes. You decide — in person
A connector acts on your behalf, but it cannot become you. It can read, and it can propose: a document, a register entry, a correction. Everything it writes lands as a suggestion. Approving, rejecting and signing need you present, signed in with your passkey. This is not friction for its own sake: it is what lets an auditor trust that a named person — not a model — stood behind every evidenced statement.
When the queue is long, you do not need to click through it one item at a time: approve a batch in one decision, with each item still pinned to the exact content you saw.
3. Upload what you have, not what you think an auditor wants
AI-natives tend to over-prepare: generating a fresh policy set before uploading anything. Don’t. Sovaign reads your whole approved document set for every requirement, and it finds evidence in documents that were never written for a standard — the employee handbook, the onboarding checklist, the IT setup guide, the supplier contract. Upload those first. The gap list then tells you which documents are genuinely missing, and which existing one would close each gap.
4. Ask for the plan, not the list of reds
A list of ninety red controls is not a plan. Ask your assistant for the work overview or the remediation plan instead: the smallest set of actions that most raises your defensible coverage, ordered by your own risk register. “Do these five things” is something you — or an agent — can actually act on.
5. Read grey as information
Sovaign will tell you when it cannot evaluate something: the evidence is missing, too old, or too weak to judge. That is a first-class answer, never rounded to green and never to zero. And because no reading is perfect — we publish our measured recall — a gap means “not yet found”, not “absent”. Teach your agents the same habit: an answer that says cannot evaluate or not answerable is a reason to ask a person, never permission to proceed.
6. Let your agents ask before they act
This is the newest and, we think, the most important use. Before an agent does something consequential — changes a system, moves data, deploys a model — it can ask Sovaign what your organisation has written about that action. The answer quotes only your own approved documents, and every quote is checked to occur literally in the document it names before the agent sees it. Ask which rules apply to a named system in your asset register, and it says which, and what evidence each expects.
Two cautions, both built into the answers. Commentary the model adds about the quotes is labelled as unverified — relay the quotes, not the commentary. And the answer is advisory: it is your policy, read back to the agent, not a licence to act.
7. Give your own systems a voice — and keep the gate
The management system lives on dated records: risks, objectives and their measurements, management reviews, nonconformities. Your systems and agents can keep those current. Give an agent its own propose-only credential in Sovaign and it can report that last night’s backup ran, that a review is due, or submit a revised procedure for review. Nothing it sends counts until a person approves it. When an agent has earned trust, an administrator can approve it as a source, and its routine records are then cleared in batches — with a sample still held for individual review.
And let Sovaign tell you, rather than asking it: subscribe a webhook and you hear before evidence lapses, instead of polling for it.
One habit to keep from all of this
The AI-native instinct is to let the agent finish the job. For compliance, finish it one step earlier: let the agent read, find, draft and propose — then decide yourself. That single boundary is what turns a fast answer into one you can sign, and defend.
In your first week, also do one thing most people skip: get the full export of your organisation — run it yourself if you self-host, or ask us for it on app.sovaign.com — and check that it rebuilds from the export alone. Your assistant can already fetch the audit package and the OSCAL export at any time. Trust you can verify beats trust you are asked for.