Vanta Companion
Vanta Companion coordinates a SOC 2 program around canonical Vanta records. It helps a team organize remediation, evidence, audit requests, and recurring work without copying source-system ownership into the miniapp.
Why It Was Made
An enterprise integration should not become a second system of record. This example shows how The AI Platform can coordinate specialists, channels, and workflows around Vanta while Vanta remains authoritative for controls, evidence, tests, risks, and audit data.
Surface Map
The code uses sdk.authorization, sdk.channels, sdk.credentials, sdk.http, sdk.specialist, sdk.storage, and sdk.workflows. Permission actions separate viewing, coordination, analysis, credential use, network access, channel work, and workflow execution.
Design Boundaries to Notice
- The onboarding copy says where credentials live and does not ask the miniapp to collect secrets.
- Read operations and consequential operations use different action contracts.
- A specialist can analyze approved context, but writes back to Vanta remain governed by the source connection and current human authority.
- Workspace coordination state can outlive a surface mount without pretending to be canonical Vanta data.
What to Read in the Code
- Package descriptor for external effects, host APIs, specialists, and permission actions.
- Vanta API boundary for host-mediated network access.
- Specialist integration for governed analysis.
- Webhook client and the separate companion API worker for signed event ingestion.
Run It Locally
Link apps/vanta-companion/.tap-build/desktop once. Local UI development does not require Vanta credentials. Connected behavior still requires the host-managed Vanta authority declared by the package.
Browse the source or return to the example gallery.