Operational management #

The /operations route brings daily execution into one workspace without replacing the original business registers.

My tasks and responsibilities #

My tasks aggregates items assigned to the signed-in user with status and due date. Responsibilities formalizes assignment rules and their data model. Administrators and risk managers can create and update records; other roles see authorized information.

Compliance trajectories #

A trajectory compares current progress, expected progress at the current date and the target. RiskPilot highlights programmes that are falling behind. Due date, owner and versioned JSON configuration remain attached to the record.

Questionnaires, campaigns and packs #

Questionnaire templates describe reusable questions, campaigns organize distribution and monitoring, and reference packs group reusable organization configurations. The creation form provides a guided initial model for each record type.

Governance #

Data remains organization-scoped. Assign an explicit owner and verifiable due date, and keep configuration structured. The server reminder command can support operational follow-up without changing case content automatically.

Guided editing in the interface #

The Operational tasks tab distinguishes records created here from actions and assessments aggregated under My tasks. Each aggregated task card opens its source module. Risk managers can create and edit title, owner, due date and configuration; owners are selected from organization users rather than entered as numeric IDs.

The form provides templates for compliance programmes, responsibility rules, evidence collection, internal campaigns and governed packs. Advanced JSON remains available and invalid syntax blocks saving. Structured objects are rendered as readable labels, lists and values rather than raw JSON blocks.

Detailed procedure #

1. Open My tasks to aggregate unfinished actions, open assessments and assigned operational records.
2. Filter by Responsibilities, Trajectories, Questionnaires, Campaigns or Packs.
3. With the Risk manager role, create a record with type, title, owner, due date and a details object.
4. Revise status, due date or owner without changing the original type.
5. For a trajectory, supply startDate, currentScore and targetScore; the service calculates expected progress and marks it at risk when current progress trails by more than five points.

Tasks are sorted by due date. overdue signals lateness without replacing the stored business status. System-managed types, including annual snapshots, cannot be created or edited through this API.

Operations API #

{"type":"COMPLIANCE_PROGRAM","title":"NIS2 trajectory","ownerId":42,"dueAt":"2026-12-15","details":{"startDate":"2026-08-01","currentScore":35,"targetScore":90}}

An unknown or cross-organization owner is rejected. SYSTEM_MANAGED_TYPE returns HTTP 403 on creation and IMMUTABLE_RECORD returns HTTP 409 on update.