SDK Quick Start — GRC, ESG & Enterprise Risk Management

Getting started: GRC, ESG & Enterprise Risk Management

Control what your AI can do. The core SDK checks policy before your workflow runs an action and again before its result is released. Denied actions stop. Actions that need human review stay paused until a signed outcome arrives.

Catalog context. Connect each reported result to its scope, owner, and evidence. Keep risk estimates, measured outcomes, and unresolved findings distinct in executive reports. Framework mapping is not certification. Record which requirements were assessed and what evidence supports the conclusion; do not infer compliance from a vocabulary match.

Use industry fields with the core SDK

Industry vocabularies supply typed values that the SDK sends as policy fields and evidence attributes with one governed call. Choose values that describe the actual workflow. Adding a vocabulary does not activate rules or assign regulatory requirements.

If you need the cross-industry baseline first, open the core SDK reference, Python core, or .NET core before continuing here.

Step 1 — Install the approved packages

In the customer portal, open Tools and SDKs. Select your language and adapters, then follow the installation instructions shown there.

VeriProof SDKs are distributed through customer-gated GitLab packages, not public registries. See SDK access for workstation and CI guidance.

VeriProof packages used here: @veriproof/sdk-core (TypeScript), veriproof-sdk (Python), Veriproof.Sdk.Core (.NET).

Step 2 — Configure

Store the application SDK key as VERIPROOF_API_KEY and create one client when the application starts. Publish the policy you want to enforce, then confirm its field contract against the facts and industry values your application supplies.

Copy the application ID and key from Set up SDK. The application ID is not its display name. Try a live demo  to see a governed workflow, or request an evaluation  if you need a workspace.

Step 3 — Govern the action

Put the protected business action inside govern. The SDK checks policy before it calls the action and before it releases the result. Deny and human-review decisions stop execution here.

import { Veriproof } from '@veriproof/sdk-core';
import type { GovernedResult, IndustryFact, JsonValue } from '@veriproof/sdk-core';

const veriproof = Veriproof.fromEnv();

export async function runProtectedAction<TInput extends JsonValue, TValue>(
  request: TInput,
  action: (input: TInput, signal: AbortSignal) => Promise<TValue>,
): Promise<GovernedResult<TValue, TInput>> {
  // Catalog values for this vertical. Replace them with facts from the current workflow.
  const industry: IndustryFact[] = [
    { attribute: "grc.risk.assessment_method", policyInput: "grc_risk_assessment_method", value: "qualitative" },
    { attribute: "grc.risk.treatment_strategy", policyInput: "grc_risk_treatment_strategy", value: "avoid" },
    { attribute: "grc.risk.appetite_status", policyInput: "grc_risk_appetite_status", value: "within_appetite" },
  ];

  // Policy runs before action() and again before the result is released.
  // A deny or review decision means action() never runs.
  return veriproof.govern(
    "grc.esg.enterprise.risk.evaluate",
    request,
    ({ input, signal }) => action(input, signal),
    { industry },
  );
}

Only completed, completed_with_warning, and transformed results carry a released value. Handle every other status with its safe message, reason code, and evidence reference. For review decisions, save the checkpoint and continue through the human review workflow.

Add typed industry values

Each core SDK ships this vertical's vocabulary as generated types. A typed value becomes one policy field and one evidence attribute when you pass it to the governed call. Use application facts for values that are specific to your workflow.

Find this workflow's vocabulary in the GRC, ESG & Enterprise Risk Management reference. Use the attribute names below and verify their policy-field mapping before using them in a rule. Sample values show the format; they are not recommended outcomes for your application.

TypeScript

import { Industry } from '@veriproof/sdk-core';
import { RiskAssessmentMethod, RiskAssessmentMethodMeta, RiskTreatmentStrategy, RiskTreatmentStrategyMeta, RiskAppetiteStatus, RiskAppetiteStatusMeta } from '@veriproof/sdk-core/industries/grc-esg';

// Replace sample values with facts from the current workflow.
// Each value becomes one policy field and one evidence attribute.
const industry = [
  Industry.fact(RiskAssessmentMethodMeta, RiskAssessmentMethod.Qualitative),
  Industry.fact(RiskTreatmentStrategyMeta, RiskTreatmentStrategy.Avoid),
  Industry.fact(RiskAppetiteStatusMeta, RiskAppetiteStatus.WithinAppetite),
];

const result = await veriproof.govern(actionName, request, runWorkflow, { industry });

Python

from veriproof_sdk.verticals.grc_esg import RiskAssessmentMethod, RiskTreatmentStrategy, RiskAppetiteStatus

# Replace sample values with facts from the current workflow.
# Each value becomes one policy field and one evidence attribute.
industry = (
    RiskAssessmentMethod.qualitative.fact(),
    RiskTreatmentStrategy.avoid.fact(),
    RiskAppetiteStatus.within_appetite.fact(),
)

result = await vp.govern(action_name, request, run_workflow, industry=industry)

.NET

using Veriproof.Sdk.Core.Industries.GrcEsg;

// Replace sample values with facts from the current workflow.
// Each value becomes one policy field and one evidence attribute.
var options = new GovernOptions
{
    Industry =
    [
        RiskAssessmentMethod.Qualitative.Fact(),
        RiskTreatmentStrategy.Avoid.Fact(),
        RiskAppetiteStatus.WithinAppetite.Fact(),
    ],
};

var result = await veriproof.GovernAsync(actionName, request, RunWorkflowAsync, options);

Workflow examples from the catalog

• Enterprise Risk Assessment & Treatment: Risk Assessment Method. AI GRC agent selects risk assessment method based on risk category and materiality. Tier 4 critical AI systems require at minimum 'red_team_exercise' and 'threat_modeling_stride'. OPA policy enforces that any new high-risk AI deployment must have a completed risk assessment with a documented method before receiving production ATO. (Eu AI Act Art9: EU AI Act Article 9, High-risk AI risk management system requires documented risk identification and evaluation; the chosen risk assessment method must be recorded and reproducible)
• Enterprise Risk Assessment & Treatment: Risk Treatment Strategy. AI risk agent assigns a treatment strategy to each identified risk. OPA policy blocks 'accept_retain' treatment for any AI risk rated above the board-approved risk appetite threshold without explicit Risk Committee or CRO HITL authorisation. (Eu AI Act Art9: Article 9 requires assessment and management of risks for high-risk AI. The organization's risk policy assigns approval authority for accepting remaining risks.)
• Enterprise Risk Assessment & Treatment: Risk Appetite Status. AI risk monitoring agent continuously recalculates risk scores. 'Exceeds_tolerance' status on any material risk triggers immediate CIRO/CRO HITL notification and initiates the board escalation workflow. AI agent cannot autonomously resolve an 'exceeds_tolerance' status, only the Risk Committee can. (Coso Erm 2017: COSO ERM 2017 Principle 6, Board defines risk oversight and appetite; 'exceeds_tolerance' requires board notification)
• Enterprise Risk Assessment & Treatment: Compliance Action Status. AI compliance agent tracks all open remediation actions against their deadlines. 'Overdue' items trigger management escalation. OPA policy enforces that 'escalated_to_regulator' and 'regulatory_breach_confirmed' status transitions require CCO and General Counsel HITL, AI cannot self-escalate to regulatory authorities. (Eu AI Act Art62: EU AI Act Article 73, Serious incident reporting: 'escalated_to_regulator' status for AI serious incidents must be filed without undue delay)

Next steps

• Open the full GRC, ESG & Enterprise Risk Management governance reference for all 21 enum categories, policy patterns, and source standards.
• Review TypeScript SDK core for stop handling, human review continuation, and the OpenAI Agents adapter.
• Review Python SDK core for stop handling, human review continuation, and the Microsoft Agent Framework adapter.
• Review .NET SDK core for stop handling, human review continuation, and the Microsoft Agent Framework adapter.
• Browse all vertical references to understand how the core governance vocabulary layers underneath vertical-specific attribute sets.
• Compare this guide with the public industry pages  for a business overview of the same workflows.