Scope the client environment

Help me scope [CLIENT NAME]'s environment for [FRAMEWORK]. Ask me, one area at a time, about:
- People: departments, headcount, who holds admin access
- Technology: identity provider, email, endpoints, servers, cloud, backup, security tools
- Data: what sensitive data they hold and where it lives
- Facilities: offices, remote work, data centers
- Third parties: key vendors with access to systems or data

First, collect the assets ControlMap already knows about: they appear as asset codes (for example AST-2) in the mappings on the client's risks and action items. Then summarize the scope in a table, mark which systems already exist as ControlMap assets, and call out anything that expands the audit boundary.

Assets can't be created through the API, so finish with a list of new assets for me to add in ControlMap. Before you create, update or delete anything, show me exactly what you plan to change in a table and wait for my approval. After approval, link the existing assets to the relevant risks.

How to work with the ControlMap API (ScalePad MCP):
- Find the client with GET /controlmap/v1/clients/health and use its tenant ID (for example "dundmif") in every request. Some clients have no UUID.
- Send the header Content-Type: application/json on every POST, PUT and PATCH, including searches.
- Use page_size of 50 or less and follow next_cursor. The "fields" parameter is ignored, so responses are large.
- Judge controls by "status", not the "compliant" flag. Objective lists include sub-objectives, so take totals from objective_summary.
- Use framework-level scores and labels. The overall score_label on client health can be wrong.
- Older policy sections may be URL-encoded twice: decode them and use the highest version of each section.
- If a call returns 502 or fails to connect, wait a few seconds and retry once. If it still fails, tell me exactly which data is missing.

When writing to ControlMap:
- Update policies one field per request. review_date must include milliseconds (2027-01-01T00:00:00.000Z) and policy status must be draft, in_progress, in_review or approved.
- Risk scores and treatment can't be changed through the API. A new risk takes one impact and likelihood, which sets inherent, current and target together. List any score or treatment changes for me to make in ControlMap.
- Write evidence request notes to the "notes" field and assignees to "assigned_to".
- Files can't be uploaded through the MCP. Attach a link to where the file lives (SharePoint, Google Drive) and list any files I need to upload in ControlMap.
- Department and risk category must match existing values (GET /risks/departments and /risks/categories).
- Action item effort is capped at 8 hours, so put larger estimates in the description.
- A 500 error can still save part of a change. Read the record back before retrying.