Use when creating a draw.io diagram for cloud/SaaS shared responsibility, inherited controls, provider controls, customer controls, and evidence ownership in a GRC, security, audit, compliance, privacy, cloud, or risk context.
NewMaintained
Automatic
◆Security & AppSec pack
Last verified 8/23/2026
What it changes
Passed 9 of 22 test cases with the skill, and 15 of 22 without it.
Without skill67%
With skill42%
Checks it passed that the model alone missed
The diagram is delivered in native mxGraphModel XML format.
Green fill styling is used for implemented DLP policy controls.
1 fixed3 passed either way14 still failing4 broke
Pass-rate lift
-25 pp
Tokens
+87%
Agent turns
0%
Response time
+53%
Model gemini-3.6-flashMeasured 8/23/2026v14 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
A test case the skill fixed. Same model, same prompt, with and without the skill.
Prompt
Generate a visual model of shared data protection responsibilities for Google Workspace users implementing DLP policies.
What was checked, without and with the skill
Checked
Without skill
With skill
Green fill styling is used for implemented DLP policy controls.
Missed
Passed
The diagram is delivered in native mxGraphModel XML format.
Missed
Passed
case-22 · gemini-3.6-flash · 8/23/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md57 linessingle file
GRC shared responsibility diagram
Use this skill to structure the GRC content and visual pattern for cloud/SaaS shared responsibility, inherited controls, provider controls, customer controls, and evidence ownership. Then use the drawio skill to generate the native editable .drawio file and optional PNG/SVG/PDF export.
Common Requests
AWS/FedRAMP split
SaaS provider/customer control split
inherited cloud controls
Recommended Elements
Include these when relevant:
provider
customer
shared
inherited
excluded zones
control ownership
evidence ownership
Recommended Output Pattern
Produce a Split responsibility, layered stack, or inherited evidence map. Choose a layout that matches the audience:
Executive: compact lifecycle/capability view with business impact labels.
Auditor/assessor: explicit evidence, owner, control, cadence, and scope labels.
Practitioner/engineering: operational systems, data paths, automation, failure/exception paths, and implementation detail.
draw.io Instructions
Load and follow the drawio skill.
Generate native mxGraphModel XML directly. Do not generate Mermaid as the final artifact.
Use descriptive lowercase hyphenated filenames.
Include a legend when colors, edge styles, or containers have compliance meaning.
Validate XML well-formedness before finalizing.
If PNG/SVG/PDF is requested, export with embedded diagram XML when the draw.io CLI is available.