Governance sync

A pluggable sync service pushes confirmed findings into your GRC platform as risk records — created, updated, closed, and reopened as findings move through their lifecycle.

Providers

SimpleRisk and CISO Assistant ship today — each with its own client and mapper behind the shared GovernanceProvider interface. Additional providers register against the same interface.

Idempotency guarantees

• Race-safe row claiming — concurrent workers never double-sync a finding
• External IDs persisted before status flips — a crash mid-sync is recoverable, not duplicated
• Create / update / close / reopen mapped from workflow state transitions
• Survives crashes and replays without duplicate risk records

Running the worker

The worker runs embedded in the backend or as a standalone container (worker_main.py).

# dev stack with a provider wired end-to-end
make up GOVERNANCE_PROVIDER=simplerisk
# or: make up GOVERNANCE_PROVIDER=ciso-assistant

Source: platform/governance/ · worker_main.py · docker-compose.dev.yml · Makefile