Workflows

A workflow is a staged assessment the gateway drives through your agent: scripted stages, required fields the agent can't skip, user-review gates, and a report whose factual findings cite served evidence or remain unresolved. The concept is covered in Tools vs workflows; this page is the catalogue and the lifecycle; several families also have product pages under ansvar.eu/workflows. Free includes 1 run a month and Solo 2, picked from seven types — STRIDE threat model, gap analysis (generic or NIS2, DORA, CRA, EU AI Act) and DPIA — on a system you describe, with the report as a watermarked render or JSON. Premium includes 5 runs a month across the full interview-grounded catalogue with the report as structured JSON; workflows grounded in your own documents and unwatermarked rendered exports are Team (20 runs per seat a month) and Company (custom allowance).

The lifecycle — six tools

list_workflow_types()                    # what can I run?
start_workflow(workflow_type="dpia")     # returns workflow_id + first step
get_current_step(workflow_id)            # what the workflow needs next
submit_response(workflow_id, response)   # answer; repeat until stages pass
get_progress(workflow_id)                # where am I?
generate_report(workflow_id)             # the final deliverable

State persists on every submit_response — resume_workflow(workflow_id) picks an active run back up days later, and list_workflows / cancel_workflow manage the set. A completed workflow is immutable; rerun it as a new one when circumstances change. Evidence documents attach via the document library (see Cite your documents) and bind to a run with register_document.

Receive the report and its delivery receipt

generate_report returns the typed report and a server-authored delivery_receipt. Your agent displays delivery_receipt.display_markdown unchanged: it includes the report's summary, integrity state, items requiring attention and artifact information. A receipt preview is not the full findings set. For a JSON run, receive the complete structured report; for a rendered run, use the artifact link and retain its hash and expiry information.

Free and Solo teaser runs can produce a watermarked render or JSON. Premium receives JSON. Team and Company add unwatermarked HTML, PDF and DOCX exports. Check the returned artifacts rather than assuming that a requested render succeeded. When present, depends_on records the declared obligation and library dependencies used by the report. This workflow delivery receipt is separate from the Company audit ledger's signed query receipts.

Risk assessments and TARA, DPIA/FRIA and gap analyses can include an optional system data-flow diagram. Follow the current step's instructions to review it or explicitly skip it. Keep any unresolved evidence visible in the final report; adding a diagram does not resolve missing legal or customer evidence.

The catalogue

Every served type, grouped by family — a variant reuses its base type's machinery with a jurisdiction- or domain-specific stage set. The table derives from a snapshot of the served registry (2026-09-07); list_workflow_types is the live contract and also carries each type's required parameters. "Free + (metered)" marks the seven included types Free and Solo may spend their monthly runs on; the same types run interview-grounded from Premium.

Walkthroughs and family pages

• Your first gap analysis — the full tutorial, including the search-driven Premium alternative. Family page: gap analysis.
• DPIA — stages and the report you get back. Family page: DPIA.
• Threat modeling — the STRIDE workflow, DFD-first. Family page: threat model.
• Run a TARA — scope, risk criteria, attack paths, treatments and report delivery. Family page: TARA.
• Product guides for vulnerability decisions.

Before your first walk: workflows are where client and model choice matter most — see Clients and models for what a workflow demands of your client and which models we have tested.