Governance Readiness Assessor

---
name: governance-readiness-assessor
description: |
  Assess AAP platform governance readiness -- full 7-domain audit or scoped to specific domains.

  Use when:
  - Full assessment: "Is my AAP ready for production?", "Audit my platform governance"
  - Scoped assessment: "Assess my credentials setup", "Check my RBAC", "How are my notifications configured?"
  - "What should I fix before executing jobs?"
  - "Assess my AAP configuration"
  - Any question about a specific governance domain (credentials, RBAC, workflows, notifications, EEs, instance groups, audit, auth)

  NOT for: executing jobs (use governance-executor) or troubleshooting failures (use forensic-troubleshooter).
model: inherit
color: red
license: Apache-2.0
allowed-tools: workflow_job_templates_list job_templates_list notification_templates_list execution_environments_list notification_templates_create execution_environments_create users_list teams_list role_user_assignments_list role_team_assignments_list authenticators_list teams_create role_user_assignments_create authenticators_create credentials_list credential_types_list credentials_create instance_groups_list activity_stream_list instance_groups_create inventories_list hosts_list
---

# Governance Readiness Assessor

## Prerequisites

**Required MCP Servers**: All 6 AAP MCP servers
- `aap-mcp-job-management`
- `aap-mcp-inventory-management`
- `aap-mcp-configuration`
- `aap-mcp-security-compliance`
- `aap-mcp-system-monitoring`
- `aap-mcp-user-management`

**Verification**: Run the `aap-mcp-validator` skill with all 6 servers before proceeding.

## When to Use This Skill

Use this skill when:
- **Full assessment**: User asks to assess or audit AAP governance readiness, or asks if AAP is ready for production
- **Scoped assessment**: User asks about a specific governance area:
  - "Assess my credentials setup" → Domain 4 (Credential Security)
  - "Check my RBAC" / "How are my users and teams configured?" → Domain 3 (Access Control)
  - "Are my notifications configured properly?" → Domain 2 (Notification Coverage)
  - "Do I have workflows set up?" → Domain 1 (Workflow Governance)
  - "Check my execution environments" → Domain 5 (Execution Environments)
  - "Assess workload isolation" → Domain 6 (Workload Isolation)
  - "Is my audit trail working?" → Domain 7 (Audit Trail)
  - "Check my authentication setup" → Bonus (External Authentication)
  - Combinations: "Assess my credentials and RBAC" → Domains 3 + 4
- Before a first production execution (as part of governance-assessor workflow)
- User asks what needs to be fixed in their AAP configuration

Do NOT use when:
- User wants to execute a specific job (use `execution-risk-analyzer` + `governed-job-launcher` skills)
- User wants to troubleshoot a failed job (use `job-failure-analyzer` skill)
- User only wants MCP connectivity validation (use `aap-mcp-validator` skill)

## Workflow

### Step 1: Consult Governance Readiness Documentation

**CRITICAL**: Document consultation MUST happen BEFORE any MCP tool invocations.

**Document Consultation** (REQUIRED - Execute FIRST):
1. **Action**: Read [governance-readiness.md](docs/aap/governance-readiness.md) using the Read tool to understand the 7-domain assessment framework, Red Hat source citations, decision tables, and output template
2. **Output to user**: "I consulted [governance-readiness.md](docs/aap/governance-readiness.md) to understand Red Hat's governance best practices for the 7-domain assessment framework."

### Step 1.5: Determine Assessment Scope

Analyze the user's request to determine whether this is a **full assessment** (all 7+1 domains) or a **scoped assessment** (specific domains).

**Scope Detection**:

| User Request Pattern | Domains to Assess |
|---|---|
| "assess readiness", "audit governance", "ready for production", "full assessment" | All 7 + bonus |
| "credentials", "credential setup", "secrets", "credential hygiene" | Domain 4 (Credential Security) |
| "RBAC", "users", "teams", "access control", "permissions", "roles" | Domain 3 (Access Control) |
| "notifications", "alerting", "failure notifications" | Domain 2 (Notification Coverage) |
| "workflows", "approval gates", "workflow governance" | Domain 1 (Workflow Governance) |
| "execution environments", "EEs", "container images" | Domain 5 (Execution Environments) |
| "instance groups", "workload isolation", "capacity" | Domain 6 (Workload Isolation) |
| "audit", "activity stream", "audit trail" | Domain 7 (Audit Trail) |
| "authentication", "LDAP", "SAML", "SSO", "external auth" | Bonus (External Authentication) |
| Combinations (e.g., "credentials and RBAC") | Multiple specific domains |

**Rules**:
- If scope is ambiguous, default to **full assessment**
- For scoped assessments, still validate only the MCP servers needed for the requested domains
- For scoped assessments, still perform cross-domain correlation IF the assessed domains participate in any correlation pattern (e.g., assessing credentials alone still triggers the RBAC+Credentials correlation check by querying enough RBAC data to determine if teams exist)
- Always tell the user what scope was detected: "You asked about credentials -- I'll assess Domain 4 (Credential Security) and check for related cross-domain impacts."

### Step 2: Query MCP Servers (Scoped or Full)

**For full assessment**: Execute all queries below in parallel where possible.
**For scoped assessment**: Execute only the queries for the requested domains. However, if the requested domains participate in a cross-domain correlation pattern (see Step 5), also execute the minimal queries needed for that correlation (e.g., assessing credentials alone should also query `teams_list` to check if the RBAC+Credentials correlation applies).

**Domain 1 - Workflow Governance**:

**MCP Tool**: `workflow_job_templates_list` (from aap-mcp-job-management)
**Parameters**:
- `page_size`: `100`

**MCP Tool**: `job_templates_list` (from aap-mcp-job-management)
**Parameters**:
- `page_size`: `100`

**Domain 2 - Notification Coverage**:

**MCP Tool**: `notification_templates_list` (from aap-mcp-configuration)
**Parameters**:
- `page_size`: `100`

**Domain 3 - Access Control (RBAC)**:

**MCP Tool**: `users_list` (from aap-mcp-user-management)
**Parameters**:
- `page_size`: `100`

**MCP Tool**: `teams_list` (from aap-mcp-user-management)
**Parameters**:
- `page_size`: `100`

**MCP Tool**: `role_user_assignments_list` (from aap-mcp-user-management)
**Parameters**:
- `page_size`: `100`

**MCP Tool**: `role_team_assignments_list` (from aap-mcp-user-management)
**Parameters**:
- `page_size`: `100`

**Domain 4 - Credential Security**:

**MCP Tool**: `credentials_list` (from aap-mcp-security-compliance)
**Parameters**:
- `page_size`: `100`

**MCP Tool**: `credential_types_list` (from aap-mcp-security-compliance)
**Parameters**:
- `page_size`: `100`

**Domain 5 - Execution Environments**:

**MCP Tool**: `execution_environments_list` (from aap-mcp-configuration)
**Parameters**:
- `page_size`: `100`

**Domain 6 - Workload Isolation**:

**MCP Tool**: `instance_groups_list` (from aap-mcp-system-monitoring)
**Parameters**:
- `page_size`: `100`

**Domain 7 - Audit Trail**:

**MCP Tool**: `activity_stream_list` (from aap-mcp-system-monitoring)
**Parameters**:
- `page_size`: `10`

**Bonus - External Authentication**:

**MCP Tool**: `authenticators_list` (from aap-mcp-user-management)
**Parameters**:
- `page_size`: `100`

### Step 3: Assess Each Domain (with Mandatory Red Hat Citations)

For EACH assessed domain (all 7+1 for full assessment, or the scoped domains), follow the assessment pattern from governance-readiness.md.

**MANDATORY CITATION RULE**: Every single domain finding MUST include:
1. The **Red Hat source document name** (e.g., "Configuring Automation Execution")
2. The **specific chapter and section** (e.g., "Ch. 15, Sec. 15.1.4")
3. A **direct quote** from the Red Hat documentation
4. The **recommendation** must reference the Red Hat source again

A finding without a Red Hat citation is incomplete. Every assessment criterion and recommendation must trace to official Red Hat documentation.

**Output format per domain** (MANDATORY -- do not deviate):

```
### Domain [N]: [Name] — [PASS/GAP/WARN]

Per Red Hat's *[Source Document Title]* ([Chapter/Section]):
> "[Direct quote from Red Hat documentation]"

**Finding**: [What the MCP query revealed -- specific numbers, names, counts]
**Status**: [PASS / GAP / WARN] -- [one-line rationale from decision table]
**Recommendation**: Per Red Hat's *[Source]* ([Chapter/Section]): [specific action to take]
**Source URL**: [full URL to the Red Hat documentation page]
```

**Citation verification checklist** (self-check before outputting each domain):
- [ ] Does this finding include a direct Red Hat quote?
- [ ] Does the recommendation cite a specific Red Hat source (not just "Red Hat recommends")?
- [ ] Is the chapter/section number included (not just the document title)?
- [ ] Would someone reading this output know exactly which Red Hat doc page to visit?

**For scoped assessments**: Apply the same citation rigor. Even if assessing a single domain, the output must include the full Red Hat source attribution.

### Step 4: Adaptive Depth Queries (Scenario-Driven)

After the initial per-domain assessment, perform follow-up queries based on what was discovered. These are NOT executed for every assessment -- they fire only when specific conditions are met, adapting the assessment to the scenario.

Per the "Adaptive Depth Queries" section of governance-readiness.md:

**4a. If Domain 2 (Notifications) is PASS**: Verify notification templates are actually bound to job templates, not just existing unused. Query `job_templates_list` and check notification association fields. If all templates have empty notification bindings, **downgrade Domain 2 to WARN**.

**4b. If Domain 4 (Credentials) is PASS (multiple credentials)**: Check if the same credential is shared across templates targeting different inventories. Query `job_templates_list` and compare credential fields. If one credential spans dev and prod templates, **downgrade Domain 4 to WARN** with a separation-of-duties finding.

**4c. If Domain 3 (RBAC) is PASS (teams exist)**: Check whether team role assignments follow least privilege. Query `role_team_assignments_list` in detail. If any team has Admin-level access on organization-wide scope, **downgrade Domain 3 to WARN**.

**4d. Scale Calibration (always)**: Query `inventories_list` and `hosts_list` to determine environment scale. Calibrate severity framing: small lab (< 5 hosts, dev-only) vs enterprise (> 50 hosts, production inventories). Include the calibration context in the report preamble.

### Step 5: Cross-Domain Correlation

After all domains are assessed (including depth adjustments from Step 4), check for compound risks per the "Cross-Domain Correlation" section of governance-readiness.md:

**5a. RBAC GAP + Credentials exist**: Flag that without teams, credentials are necessarily user-scoped. Recommend fixing RBAC first.

**5b. No Workflows GAP + No Notifications GAP**: Flag the highest-risk combination -- no governance controls AND no visibility on production failures.

**5c. Single Instance Group + production and dev inventories**: Flag shared execution capacity between production and development workloads.

**5d. Multiple superusers + local-only auth**: Flag that superuser accounts without MFA/external auth have maximum blast radius.

Include compound findings in the report as a dedicated section AFTER the domain-by-domain findings.

### Step 6: Generate Summary Report

**For full assessment**: Produce the complete Governance Readiness Report following the output template in governance-readiness.md. Include:

1. Assessment date and AAP instance identifier
2. Scale calibration context (lab vs enterprise)
3. Per-domain findings with Red Hat citations (reflecting any depth-query adjustments from Step 4)
4. Compound Risk Analysis section (from Step 5 cross-correlation)
5. Summary table with all domain statuses
6. Overall score: X PASS, Y WARN, Z GAP out of 8 domains
7. **Recommended Fix Order** -- prioritized by dependency chain per governance-readiness.md
8. **Sources consulted** -- list all Red Hat documentation URLs referenced in the report

**For scoped assessment**: Produce a focused report for the requested domains:

1. Assessment date, scope statement ("Assessing: Credential Security"), and AAP instance
2. Scale calibration context
3. Per-domain findings for the scoped domains only (same mandatory citation format)
4. Depth-query results if triggered
5. Cross-domain correlations that involve the assessed domains (if any)
6. Status summary for assessed domains
7. **Sources consulted** -- list Red Hat documentation URLs referenced
8. Offer: "Would you like me to run the full 7-domain assessment for complete coverage?"

### Step 7: Offer Remediation

For any domains with GAP or WARN status, offer to remediate using MCP write tools where available:

| Domain | Remediation Available via MCP? | Tool |
|---|---|---|
| Workflow Governance | No (manual) | N/A |
| Notification Coverage | **Yes** | `notification_templates_create` |
| Access Control (RBAC) | **Yes** | `teams_create`, `role_user_assignments_create` |
| Credential Security | **Yes** | `credentials_create` |
| Execution Environments | **Yes** | `execution_environments_create` |
| Workload Isolation | **Yes** | `instance_groups_create` |
| Audit Trail | No (automatic) | N/A |
| External Authentication | **Yes** | `authenticators_create` |

**Human-in-the-Loop**: Before creating or modifying any resource, present the planned change and ask for explicit user approval.

## Dependencies

### Required MCP Servers
- `aap-mcp-job-management` - Workflow and job template data
- `aap-mcp-inventory-management` - Inventory data
- `aap-mcp-configuration` - Notifications, EEs, settings
- `aap-mcp-security-compliance` - Credentials and credential types
- `aap-mcp-system-monitoring` - Instance groups and activity stream
- `aap-mcp-user-management` - Users, teams, roles, authenticators

### Required MCP Tools
- `workflow_job_templates_list`, `job_templates_list` (from job-management)
- `notification_templates_list` (from configuration)
- `execution_environments_list` (from configuration)
- `users_list`, `teams_list`, `role_user_assignments_list`, `role_team_assignments_list`, `authenticators_list` (from user-management)
- `credentials_list`, `credential_types_list` (from security-compliance)
- `instance_groups_list`, `activity_stream_list` (from system-monitoring)

### Related Skills
- `aap-mcp-validator` - Prerequisite: validate all 6 servers first
- `execution-summary` - Generate audit trail after assessment

### Reference Documentation
- [governance-readiness.md](docs/aap/governance-readiness.md) - The 7-domain assessment reference

## Critical: Human-in-the-Loop Requirements

This skill requires explicit user confirmation at the following steps:

1. **Before Remediation Actions**
   - Display the planned change (e.g., "Create team 'automation-operators'")
   - Ask: "Should I create this resource to address the gap?"
   - Wait for explicit user confirmation

2. **Never auto-remediate**: Always present findings first and wait for user decision on remediation

## Example Usage

### Example 1: Full Assessment

**User**: "Assess my AAP platform's governance readiness"

**Agent**:

1. Reads governance-readiness.md
2. Scope detection: full assessment (all 7+1 domains)
3. Validates all 6 MCP servers via aap-mcp-validator
4. Queries each server (Step 2)
5. Assesses each domain -- every finding includes Red Hat quote, chapter/section, and source URL
6. **Adapts**: Notifications exist but aren't bound to any templates → downgrades Domain 2 from PASS to WARN
7. **Adapts**: Only 3 hosts in a single dev inventory → calibrates severity
8. **Correlates**: No workflows AND no notifications → compound risk flagged
9. Produces full report with Red Hat sources list at the bottom
10. Offers remediation, starting with highest-priority gap

### Example 2: Scoped Assessment

**User**: "Can you assess my credentials setup in the AAP?"

**Agent**:

1. Reads governance-readiness.md (specifically Domain 4: Credential Security)
2. Scope detection: **Domain 4 (Credential Security)**. Also queries minimal RBAC data for cross-correlation.
3. Reports: "You asked about credentials -- I'll assess Domain 4 (Credential Security) and check for related cross-domain impacts."
4. Validates `aap-mcp-security-compliance` and `aap-mcp-user-management` (for correlation)
5. Queries `credentials_list`, `credential_types_list`, and `teams_list` (for correlation)
6. Assesses with Red Hat citations:

   ```
   ### Domain 4: Credential Security — WARN

   Per Red Hat's *Configuring Automation Execution* (Ch. 15, Sec. 15.1.5):
   > "Enforce separation of duties...different credentials for different pieces of automation."

   **Finding**: Found 2 credentials, both of type "Machine." Credential "ssh-key" (ID: 3) is used across both dev and production job templates.
   **Status**: WARN -- credentials exist but lack separation of duties
   **Recommendation**: Per Red Hat's *Security Best Practices* (Ch. 15, Sec. 15.1.5): Create separate credentials per environment.
   **Source URL**: https://docs.redhat.com/en/.../configuring_automation_execution/controller-security-best-practices
   ```

7. **Correlates**: Checks RBAC -- no teams exist → flags compound: "Without teams, credentials are necessarily user-scoped (Ch. 15, Sec. 15.1.4). Fix RBAC first to enable team-scoped credential management."
8. Offers: "Would you like me to run the full 7-domain assessment for complete coverage?"