Use when creating a draw.io diagram for high-level GRC program architecture, continuous compliance operating models, three lines of defense, and executive program maps in a GRC, security, audit, compliance, privacy, cloud, or risk context.
SkillScore23Maintained
Automatic
◆FinServ Compliance pack
Last verified 8/23/2026
What it changes
Passed 5 of 22 test cases with the skill, and 3 of 22 without it.
Without skill14%
With skill23%
Checks it passed that the model alone missed
Trust boundaries are designated using dashed containers.
Telemetry feeds and continuous collectors are colored blue.
Manual review steps and out-of-scope elements are styled in gray.
2 fixed3 passed either way17 still failing0 broke
Pass-rate lift
+9 pp
Tokens
+27%
Agent turns
0%
Response time
+17%
Model gemini-3.6-flashMeasured 8/23/2026v15 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 2
Prompt
Create a draw.io architecture diagram for our SOC 2 Trust Services Criteria ecosystem showing how Jira, AWS Security Hub, Datadog, and Vanta connect to process evidence. We want to see implemented controls, manual review steps, and out-of-scope third-party tools.
What was checked, without and with the skill
Checked
Without skill
With skill
The output includes raw mxGraphModel XML tags.
Passed
Passed
Implemented controls and verified evidence are styled in green.
Passed
Passed
Manual review steps and out-of-scope elements are styled in gray.
Missed
Passed
case-04 · gemini-3.6-flash · 8/23/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md58 linessingle file
GRC compliance operating model diagram
Use this skill to structure the GRC content and visual pattern for high-level GRC program architecture, continuous compliance operating models, three lines of defense, and executive program maps. Then use the drawio skill to generate the native editable .drawio file and optional PNG/SVG/PDF export.
Common Requests
continuous compliance model
three lines of defense
GRC platform ecosystem
policy-control-evidence-risk-audit lifecycle
Recommended Elements
Include these when relevant:
program capabilities
systems of record
governance bodies
owners
feedback loops
maturity phases
automation coverage
Recommended Output Pattern
Produce a Executive capability map, lifecycle, or GRC ecosystem diagram. Choose a layout that matches the audience:
Executive: compact lifecycle/capability view with business impact labels.
Auditor/assessor: explicit evidence, owner, control, cadence, and scope labels.
Practitioner/engineering: operational systems, data paths, automation, failure/exception paths, and implementation detail.
draw.io Instructions
Load and follow the drawio skill.
Generate native mxGraphModel XML directly. Do not generate Mermaid as the final artifact.
Use descriptive lowercase hyphenated filenames.
Include a legend when colors, edge styles, or containers have compliance meaning.
Validate XML well-formedness before finalizing.
If PNG/SVG/PDF is requested, export with embedded diagram XML when the draw.io CLI is available.