A mode sets two things at once: the instructions the model works under, and the tools it is allowed to use. Picking the right one is the difference between a wall of prose and something you can paste into a report.
The seven modes
Conversation
Free-form questions about your data, with all sixteen tools available. Use it for exploration, and whenever a specialized mode turned out to lack a tool you needed.
- "Which users have the most critical risks?"
- "Show me all risks related to financial posting"
- "What roles are assigned to user SMITH?"
- "Who can execute FB01?"
- "Why does user SMITH have this risk?"
- "Which transactions did user SMITH actually execute?"
Answers are short unless you ask for a report.
Remediation Advisor
Suggests concrete remediation steps for a risk. It starts with the entities that executed the risky actions, finds which roles grant the conflicting actions, and compares them with what the users actually execute. It then looks for roles shared by many entities, where one role change clears the risk for all of them. When a remediation report exists, it uses its recommendations.
Answer structure: Summary, Priority actions (a table of entity or role, action, and evidence), Batch fixes, Open points.
- "How should we remediate this risk?"
- "What is the safest way to resolve this conflict?"
- "Which users should we address first?"
Root Cause Analysis
Looks for the structural cause behind a spread of findings instead of treating each one separately, and identifies high-leverage fix points such as a shared role or a concentrated department.
Answer structure: Key causes (3 to 5, each with supporting numbers), High-leverage fixes (a table of fix, risks removed, entities affected, and effort), Other observations.
- "Why do so many users have this risk?"
- "Which role is the main contributor?"
- "Is this a structural or an assignment issue?"
Recommendation Advisor
Ranks remediation actions that already exist, by risk level, ease of implementation, and breadth of impact. Use this one after you have generated a remediation report, and Remediation Advisor before.
Answer structure: one section per priority tier, each with a table of recommendation, risks, entities, and complexity.
- "Rank the remediation actions by priority"
- "What gives us the most risk reduction for the least effort?"
Changelog Analysis
Assesses risk against what was actually changed in the system, using transaction changelog data. It is the only specialized mode with access to get_did_do_changelog, so it needs Did-Do analysis enabled on the run and CDHDR/CDPOS loaded on the data source.
It reads the field-level changes and looks for patterns: repeated changes to the same objects, suspicious value changes such as raised limits or changed bank details, and changes on both sides of an SoD conflict.
Answer structure: findings in order of severity. First, confirmed violations with sensitive field changes. Then confirmed violations, execution of one side only, and access only.
- "Did this user actually post anything with the conflicting access?"
- "What did they change, and when?"
Audit Finding
Drafts a formal finding backed by the data, structured as Condition, Criteria, Cause, Effect, and Recommendation. The Criteria come from the ruleset definition of the risk. The assistant names an external framework, such as SOX, only if you give one. Each recommendation has a priority and a responsible party.
- "Draft an audit finding for this risk"
- "Summarize the compliance exposure"
Executive Summary
Management-ready summary in non-technical language, focused on business impact. The narrowest toolset of the seven, which is what keeps it short. It starts from the analysis overview and calls tools only for details the overview does not have.
Answer structure: Overall posture, at most 5 key findings, at most 5 recommendations, in about 400 words or fewer.
- "Summarize the overall risk posture for management"
- "What are the top priorities?"
Choosing a mode
| You want | Mode |
|---|---|
| To explore, or you are not sure | Conversation |
| Steps to fix one risk | Remediation Advisor |
| To know why a risk is widespread | Root Cause Analysis |
| To sequence work you have already planned | Recommendation Advisor |
| Evidence that access was exercised, not just held | Changelog Analysis |
| Wording for an audit report | Audit Finding |
| A slide for management | Executive Summary |
Modes are not a one-way door. Switching keeps the conversation, so a common pattern is Root Cause Analysis to understand a cluster, then Remediation Advisor on the role it points at, then Audit Finding to write it up.
A note on data scope
Opening the assistant on a data source rather than on an analysis result leaves five tools available. Use Conversation there for access questions before you run an analysis: role assignments, role details, who can execute a transaction, and what a user actually executed. There is no risk data, so the specialized modes have nothing to work with. For those, run an analysis first, then open the assistant on the result. See Available Tools.