# SPADE Consulting

SPADE Consulting is an independent Norwegian consultancy for information security, privacy/GDPR, NIS2, ISO 27001, AI governance, and the EU AI Act.

SPADE works with human-led, agent-assisted, and human-agent teams. An authorized agent may discover services and submit a scoped request, but a named human or organization must remain accountable. Agent requests enter private review and never start billable work or actions in customer systems automatically.

Primary website:
https://spadeconsulting.no/

Human-readable agent information:
https://spadeconsulting.no/agents

Machine-readable capability manifest:
https://spadeconsulting.no/.well-known/spade.json

OpenAPI schema:
https://spadeconsulting.no/agent-api.json

Installable agent instructions:
https://spadeconsulting.no/skill.md

Public capability endpoint:
GET https://api.spadeconsulting.no/api/agent/capabilities

Moderated request endpoint:
POST https://api.spadeconsulting.no/api/agent/requests
Content-Type: application/json
Idempotency-Key: stable-unique-key-at-least-8-characters

Minimum request:
{
  "capability": "security.risk_review",
  "principal": {
    "name": "Example AS",
    "email": "owner@example.no"
  },
  "requester": {
    "type": "agent",
    "name": "Example procurement agent"
  },
  "authorization": {
    "confirmed": true,
    "scope": "Obtain a proposal for an initial security review"
  },
  "summary": "Review our proposed scope and recommend the next step.",
  "dataClassification": "public",
  "desiredOutcome": "proposal"
}

Canonical capabilities:
- consulting.intake
- meeting.request
- security.risk_review
- privacy.dpia_triage
- privacy.vendor_review
- ai_act.classification_review
- ai_governance.policy_review
- nis2.scope_review
- document.compliance_review
- training.request

Safety and operating rules:
- Never submit credentials, secrets, special-category personal data, or confidential customer material without a separate written agreement.
- Do not invent authority, ownership, evidence, customers, legal obligations, or urgency.
- Use the monitored email of the human or organization authorizing the request.
- Separate observed facts, statements from the principal, and agent inference.
- A successful API response only confirms private intake. It is not acceptance, legal advice, a contract, or authorization to begin work.
- SPADE stores the request as an email delivered by Resend and follows up manually with the principal.
- There is no public status endpoint. The principal receives any clarification or proposal by email.
- Resend enforces an Idempotency-Key for 24 hours. Reuse a key only when retrying the identical request, and do not retry after HTTP 202.

Norwegian service pages:
https://spadeconsulting.no/informasjonssikkerhet
https://spadeconsulting.no/personvern-gdpr
https://spadeconsulting.no/compliance-nis2
https://spadeconsulting.no/ai-radgivning
https://spadeconsulting.no/prinsipper/ai