A mode sets two things at once: the instructions the model works under, and the tools it is allowed to use. Picking the right one is the difference between a wall of prose and something you can paste into a report.
The seven modes
Conversation
Free-form questions about your data, with all eleven tools available. Use it for exploration, and whenever a specialized mode turned out to lack a tool you needed.
- "Which users have the most critical risks?"
- "Show me all risks related to financial posting"
- "What roles are assigned to user SMITH?"
Remediation Advisor
Suggests concrete remediation steps for a risk, triaging by execution evidence, department concentration, and role coverage.
- "How should we remediate this risk?"
- "What is the safest way to resolve this conflict?"
- "Which users should we address first?"
Root Cause Analysis
Looks for the structural cause behind a spread of findings instead of treating each one separately, and identifies high-leverage fix points such as a shared role or a concentrated department.
- "Why do so many users have this risk?"
- "Which role is the main contributor?"
- "Is this a structural or an assignment issue?"
Recommendation Advisor
Ranks remediation actions that already exist, by criticality, ease of implementation, and breadth of impact. Use this one after you have generated a remediation report, and Remediation Advisor before.
- "Rank the remediation actions by priority"
- "What gives us the most risk reduction for the least effort?"
Changelog Analysis
Assesses risk against what was actually changed in the system, using transaction changelog data. It is the only specialized mode with access to get_did_do_changelog, so it needs Did-Do analysis enabled on the run and CDHDR/CDPOS loaded on the data source.
- "Did this user actually post anything with the conflicting access?"
- "What did they change, and when?"
Audit Finding
Drafts a formal finding backed by the data, structured as Condition, Criteria, Cause, Effect, and Recommendations.
- "Draft an audit finding for this risk"
- "Summarize the compliance exposure"
Executive Summary
Management-ready summary in non-technical language, focused on business impact. The narrowest toolset of the seven, which is what keeps it short.
- "Summarize the overall risk posture for management"
- "What are the top priorities?"
Choosing a mode
| You want | Mode |
|---|---|
| To explore, or you are not sure | Conversation |
| Steps to fix one risk | Remediation Advisor |
| To know why a risk is widespread | Root Cause Analysis |
| To sequence work you have already planned | Recommendation Advisor |
| Evidence that access was exercised, not just held | Changelog Analysis |
| Wording for an audit report | Audit Finding |
| A slide for management | Executive Summary |
Modes are not a one-way door. Switching keeps the conversation, so a common pattern is Root Cause Analysis to understand a cluster, then Remediation Advisor on the role it points at, then Audit Finding to write it up.
A note on data scope
Opening the assistant on a data source rather than on an analysis result leaves only two tools available, and the specialized modes have nothing to work with. Run an analysis first, then open the assistant on the result. See Available Tools.