SPADE Consulting agent instructions

SPADE is an independent Norwegian consultancy for information security, privacy/GDPR, NIS2, ISO 27001, AI governance and the EU AI Act.

Canonical resources
- Human-readable guide: https://spadeconsulting.no/agents
- Capability manifest: https://spadeconsulting.no/.well-known/spade.json
- OpenAPI contract: https://spadeconsulting.no/agent-api.json
- Full Markdown instructions: https://spadeconsulting.no/skill.md
- Workflow catalogue: https://spadeconsulting.no/skills/index.json
- Knowledge and provenance index: https://spadeconsulting.no/knowledge/index.json

Operating rules
- A named human or organisation must authorize every request and remain accountable.
- A successful submission only confirms private intake. It does not authorize billable work, create a contract or permit actions in customer systems.
- Never submit credentials, authentication tokens, special-category personal data or confidential customer material without a separate written agreement.
- Do not invent authority, evidence, customers, legal obligations or urgency.
- Separate observed facts, statements from the principal and agent inference.
- Verify laws, deadlines, prices, regulator positions and other unstable claims against current primary sources.
- Use a stable Idempotency-Key of at least eight characters. Reuse it only when retrying the identical request, and do not retry after HTTP 202.

Canonical capabilities
- consulting.intake
- meeting.request
- security.risk_review
- privacy.dpia_triage
- privacy.vendor_review
- ai_act.classification_review
- ai_governance.policy_review
- nis2.scope_review
- document.compliance_review
- training.request

Discovery endpoint
GET https://api.spadeconsulting.no/api/agent/capabilities

Moderated request endpoint
POST https://api.spadeconsulting.no/api/agent/requests
Content-Type: application/json
Idempotency-Key: stable-unique-key-at-least-8-characters

Minimum request body
{
  "capability": "security.risk_review",
  "principal": {
    "name": "Example AS",
    "email": "owner@example.no"
  },
  "requester": {
    "type": "agent",
    "name": "Example procurement agent"
  },
  "authorization": {
    "confirmed": true,
    "scope": "Obtain a proposal for an initial security review"
  },
  "summary": "Review our proposed scope and recommend the next step.",
  "dataClassification": "public",
  "desiredOutcome": "proposal"
}

SPADE follows up manually with the principal by email. There is no public status endpoint.