Framework knowledge

Why the ISMS Copilot API is not any model: curated framework modules injected before the answer, with auto/none/pin controls and a public catalog.

The ISMS Copilot API is OpenAI-compatible on the wire. That is how you call it. The product is framework knowledge: curated modules assembled into the prompt before generation, so completions about ISO 27001, SOC 2, GDPR, and the rest of the catalog are grounded in a maintained reference instead of training recall plus a persona you wrote.

Marketing argument: Why the ISMS Copilot API instead of any model.

Why this is not any model

A generic completions API gives you tokens. If you need a compliance-literate answer you must:

Write a system prompt that pretends the model is a specialist.
Retrieve and maintain your own corpus of standards, transpositions, and edition notes.
Guess, after the fact, which source (if any) the model used.

This API does those three jobs server-side. You keep the OpenAI request shape. You do not keep a standards RAG stack.

The model can still be wrong. Knowledge injection grounds the answer when a module is selected. It is not a claim that hallucinations are impossible, and it is not an audit opinion.

What gets injected

When a module is selected, the server appends that module's curated reference to the assembled prompt (after your system/developer messages when the published server prompt is active). Modules carry identifiers, concise titles, and original reference notes. They are not a dump of copyrighted ISO or AICPA text.

Intellectual-property rules live in the published Reference Integrity suffix: identifiers and concise titles may be used; explanations must be original phrasing; verbatim copyrighted standard text is declined.

Your own documents (policies, evidence, risk registers) are not in this catalog. Send them in messages, or retrieve them yourself and pass them in.

How selection works

The ismscopilot request extension controls injection. Omission uses the defaults.

{
  "model": "isms-fast",
  "messages": [{ "role": "user", "content": "List ISO 27001 access control themes." }],
  "ismscopilot": { "frameworks": "auto" }
}

Value	Effect
`"auto"` (default)	Detection over user messages and the last assistant turn selects matching modules.
`"none"`	No knowledge injected. No knowledge tokens billed.
`["ISO_27001", "SOC_2"]`	Pin exactly these modules (max 8), regardless of detection.

Valid ids come from the public catalog:

GET https://api.ismscopilot.com/v1/frameworks

The catalog listed 92 modules on 2026-08-17. Treat the live endpoint as authoritative. Do not hard-code the count.

Full schema, opt-out of the persona (ismscopilot.system: "none"), and the verbatim prompt text: The API system prompt, in full.

What the response tells you

Successful completions disclose what ran:

Header x-isms-frameworks: injected module ids
Body ismscopilot object: module ids, knowledge_characters, and a labelled token estimate (knowledge_tokens_method: "chars_div_3_v1")

The estimate is not a billed-token delta. Billing truth stays usage.prompt_tokens. Everything added server-side (persona, labels, knowledge, policies) is part of the prompt and is billed as input.

Honest limits

Detection is name-level in auto. A bare control id such as 5.23, with no framework name, can inject nothing. Pin the module when you already know the framework.
Selection is not a search over the full standard. The injected text is the curated module, not a retrieved paragraph from a private PDF of the standard.
This API is not the chat app. Workspaces, uploads, memories, and audit-shaped tools are chat features. Completions do not create hosted files.
Guidance, not legal advice. Recommend human review where the stakes require it. Do not put that caveat inside a user-requested artefact unless asked.

If you send the ismscopilot field while extensions are disabled on a deployment, the API returns a deterministic 400 with code ismscopilot_extension_disabled. It does not silently ignore "none".

First request that should trigger knowledge

curl https://api.ismscopilot.com/v1/chat/completions \
  -H "Authorization: Bearer sk-isms-..." \
  -H "Content-Type: application/json" \
  -d '{
    "model": "isms-fast",
    "messages": [
      {"role": "user", "content": "What does ISO 27001 say about supplier relationships?"}
    ]
  }'

Check x-isms-frameworks on the response. If you already know the module, pin it:

{ "ismscopilot": { "frameworks": ["ISO_27001"] } }