# snow_grc_audit_manage

Unified tool for ServiceNow GRC Audit Management: engagements, audits, findings, and evidence. Wraps the sn_audit_audit, sn_audit_finding, sn_audit_engagement, and sn_audit_evidence tables that ship with the GRC: Audit Management plugin. Actions: - list — list audits, optionally filtered by engagement, state, or auditor - get — retrieve a single audit by sys_id - create_audit — open a new audit inside an existing engagement - update_audit — patch fields on an existing audit (state, scope, lead auditor, dates) - add_finding — log a finding against an audit with severity and recommendation - list_findings — list findings, optionally filtered by audit, severity, or state - attach_evidence — attach an evidence record (or external URL) to an audit or finding Use when: the agent needs to drive an audit engagement end to end — opening individual audits, logging the findings that come out of them, and attaching the evidence collected during fieldwork. For policy and control evidence outside an audit context, use snow_compliance_manage; for risk register operations, use snow_grc_risk_manage. Returns: audit rows with sys_id, engagement, state, lead auditor, planned and actual dates; finding rows with severity, recommendation, target remediation date; evidence rows with type and reference link. GRC plugin gating: the first call against the audit tables will surface a clear error if the GRC: Audit Management plugin is not active on the target instance.

Agent View of the PolicyLayer registry record for `snow_grc_audit_manage`. HTML page: https://policylayer.com/tools/serac/snow-grc-audit-manage

## Facts

- Tool: `snow_grc_audit_manage`
- Server: Serac (`serac-labs/serac`) — https://policylayer.com/tools/serac.md
- Homepage: https://github.com/serac-labs/serac
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "snow_grc_audit_manage",
    "arguments": {}
  }
}
```

## Why snow_grc_audit_manage is rated Medium

While the tool includes read operations (list, get), the presence of create_audit and update_audit places it in the Write category. The severity is high because misuse could create false audit records, add misleading findings, or modify critical compliance documentation in ServiceNow, affecting governance and audit trails.

From the tool's own definition: "Tool performs create_audit, update_audit, and add_finding operations that create or modify data in ServiceNow GRC audit tables (sn_audit_audit, sn_audit_finding, sn_audit_engagement, sn_audit_evidence). These are reversible write operations."

## Use case

AI agents use snow_grc_audit_manage to create or update resources in Serac, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Serac environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Serac:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "snow_grc_audit_manage": {
      "limits": [
        {
          "counter": "snow_grc_audit_manage_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Serac (431)

- `snow_cleanup_test_artifacts` — Destructive — https://policylayer.com/tools/serac/snow-cleanup-test-artifacts.md
- `snow_delete_attachment` — Destructive — https://policylayer.com/tools/serac/snow-delete-attachment.md
- `snow_inbound_email_action` — Destructive — https://policylayer.com/tools/serac/snow-inbound-email-action.md
- `snow_pa_indicator_manage` — Destructive — https://policylayer.com/tools/serac/snow-pa-indicator-manage.md
- `snow_rollback_deployment` — Destructive — https://policylayer.com/tools/serac/snow-rollback-deployment.md
- `snow_workflow_transition` — Destructive — https://policylayer.com/tools/serac/snow-workflow-transition.md
- `enterprise_tool_execute` — Execute — https://policylayer.com/tools/serac/enterprise-tool-execute.md
- `snow_auto_resolve_incident` — Execute — https://policylayer.com/tools/serac/snow-auto-resolve-incident.md
- `snow_automate_threat_response` — Execute — https://policylayer.com/tools/serac/snow-automate-threat-response.md
- `snow_batch_request` — Execute — https://policylayer.com/tools/serac/snow-batch-request.md
- `snow_change_manage` — Execute — https://policylayer.com/tools/serac/snow-change-manage.md
- `snow_cicd_deploy` — Execute — https://policylayer.com/tools/serac/snow-cicd-deploy.md
- `snow_collect_metric` — Execute — https://policylayer.com/tools/serac/snow-collect-metric.md
- `snow_confirm_script_execution` — Execute — https://policylayer.com/tools/serac/snow-confirm-script-execution.md
- `snow_convert_es6_to_es5` — Execute — https://policylayer.com/tools/serac/snow-convert-es6-to-es5.md
- `snow_convert_to_es5` — Execute — https://policylayer.com/tools/serac/snow-convert-to-es5.md
- `snow_create_mobile_action` — Execute — https://policylayer.com/tools/serac/snow-create-mobile-action.md
- `snow_create_vulnerability_scan` — Execute — https://policylayer.com/tools/serac/snow-create-vulnerability-scan.md
- `snow_custom_api` — Execute — https://policylayer.com/tools/serac/snow-custom-api.md
- `snow_elevate_role` — Execute — https://policylayer.com/tools/serac/snow-elevate-role.md
- `snow_employee_offboarding` — Execute — https://policylayer.com/tools/serac/snow-employee-offboarding.md
- `snow_employee_onboarding` — Execute — https://policylayer.com/tools/serac/snow-employee-onboarding.md
- `snow_execute_atf_test` — Execute — https://policylayer.com/tools/serac/snow-execute-atf-test.md
- `snow_execute_script` — Execute — https://policylayer.com/tools/serac/snow-execute-script.md
- `snow_execute_security_playbook` — Execute — https://policylayer.com/tools/serac/snow-execute-security-playbook.md
- `snow_execute_transform` — Execute — https://policylayer.com/tools/serac/snow-execute-transform.md
- `snow_fluent_build` — Execute — https://policylayer.com/tools/serac/snow-fluent-build.md
- `snow_fluent_install` — Execute — https://policylayer.com/tools/serac/snow-fluent-install.md
- `snow_fluent_transform` — Execute — https://policylayer.com/tools/serac/snow-fluent-transform.md
- `snow_github_deploy` — Execute — https://policylayer.com/tools/serac/snow-github-deploy.md
- …and 401 more: https://policylayer.com/tools/serac.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=serac · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/serac