> ## Documentation Index > Fetch the complete documentation index at: https://docs.clarion.cantina.xyz/llms.txt > Use this file to discover all available pages before exploring further. # Vanta > Connect a Manage Vanta Application so Clarion agents can read live compliance and vendor-risk data and perform separately approved writes. Clarion's native Vanta integration uses the [Manage Vanta REST API](https://developer.vanta.com/reference/manage-vanta/overview). It queries your Vanta tenant live; it does not copy Vanta vulnerabilities, assets, issues, tests, controls, frameworks, discovered vendors, managed vendors, or documents into Clarion. You need Vanta administrator access to create a **Manage Vanta Application**. This connection is for automating your own Vanta tenant, not the Vanta public marketplace OAuth flow. ## Create a Manage Vanta Application 1. In Vanta, create a Manage Vanta Application for Clarion. 2. Set the application's **Access level** to **Read and write**. Clarion requests `vanta-api.all:read`, `vanta-api.all:write`, and `vanta-api.documents:upload` during token exchange; Vanta does not ask you to select those scopes individually. See Vanta's [document upload guide](https://developer.vanta.com/docs/guides/upload-a-document). 3. Copy the client ID and client secret. Clarion requests all three scopes when it validates or refreshes a token. Vanta remains the authority that grants or rejects those scopes. Vanta issues one one-hour token per application and revokes the prior token when another is issued, so use a dedicated Manage Vanta Application for each Clarion workspace and do not reuse it in another token-minting service. ## Connect Vanta in Clarion 1. Open **Integrations → Compliance & GRC → Vanta**. 2. Enter the client ID and client secret. 3. Click **Connect Vanta**. Clarion validates the credentials server-side before completing setup. The client secret and cached access token are encrypted in Clarion and are never returned to the browser, put in schedule prompts, or sent to agent sandboxes. Use **Verify connection** to run a bounded live health check. ## Agent tools Connected chats, agents, and scheduled agent runs can read bounded, cursor-paginated pages of Vanta vulnerabilities, vulnerability remediations, tests, documents, controls, frameworks, issues, discovered vendors, discovered-vendor accounts, and managed vendors. They can also inspect managed-vendor risk attributes, assessments, security reviews, findings, and document metadata. Vendor-document tools do not download or return document content or document URLs. Detail tools accept exact opaque Vanta IDs. Evidence delivery has two separate tools: * `upload_document_evidence` uploads a trusted Clarion knowledge artifact or server-built issue export to an existing Vanta document as a draft. * `submit_document` submits that document and makes the evidence auditor-visible. Both are external writes and require human approval in Clarion, even though the Vanta application has write scopes. Upload never submits implicitly, and a submission requires its own approval. Agents cannot upload from arbitrary URLs, host filesystem paths, or inline base64 data. `add_discovered_vendor_to_managed` is another separate external write. It converts one exact discovered vendor into a managed Vanta vendor and always requires human approval. Reviewing or recommending a vendor never invokes it implicitly. ## New Vendor Risk Reviewer The built-in **New Vendor Risk Reviewer** handles operational vendor-risk review. It reads Vanta's live `NEEDS_REVIEW` discovered-vendor queue, gathers bounded account and device usage context, checks for existing managed-vendor duplicates, and includes available risk attributes, assessments, security reviews, findings, and document metadata. It returns an evidence-backed digest and prioritized investigation queue. For each discovery, the reviewer presents account coverage and pagination completeness in a compact summary table, then lists every distinct associated user's display name and email address in a per-vendor contact table. A separate device table maps each computer display name to the owner's name and email when Vanta provides them; computers without an owner are marked accordingly. The reviewer follows account cursors to completion and does not silently replace the full result with a first-page sample. These contacts show who is associated with the discovery so reviewers can follow up, but they are not treated as confirmed vendor business owners. The reviewer identifies contacts only and never messages them automatically. This differs from the **SOC 2 Evidence Collector**, which samples Clarion vulnerability issues and delivers approved draft compliance evidence. The vendor reviewer does not collect SOC 2 evidence and does not synchronize Vanta vendors into Clarion. The reviewer includes a user-editable weekly schedule for Monday at 08:00 UTC. The schedule is pinned to the installed agent, operates live against Vanta, and is strictly read-only: it never converts, ignores, or rejects vendors and never creates tickets or other external records. Deactivating the agent prevents its scheduled runs. Adding a discovery to managed status is a separate, approval-required action. The current [Manage Vanta OpenAPI specification](https://developer.vanta.com/reference/manage-vanta.json) does not expose mutations for ignoring or rejecting discovered vendors, so those recommendations must be completed manually in Vanta. Richer risk data can also be absent until a discovery becomes a managed vendor; missing Vanta risk data is not proof that a vendor is safe. The reusable **Review newly discovered Vanta vendors** skill is available independently in Clarion's skill catalog, so it can be attached to custom agents as well as the built-in reviewer. ## SOC 2 Evidence Collector The built-in **SOC 2 Evidence Collector** runs monthly on the first day of the month at 09:00 UTC. Its schedule is pinned to the created agent and remains editable in Clarion. Deactivating the agent prevents scheduled execution. The agent samples Clarion vulnerability issues, verifies linked remediation pull requests with the existing GitHub tools, lists Vanta documents live, and asks for clarification if several documents could be the target. An approved upload creates draft evidence. The monthly schedule never submits the document automatically. If Vanta is disconnected before a run, its tools are omitted and either built-in agent reports the missing integration instead of receiving credentials or repeatedly calling a broken endpoint. ## Disconnect or rotate credentials Use **Update credentials** after rotating the Vanta client secret. Clarion validates the replacement before persisting it. Use **Disconnect** to delete the workspace's Vanta integration and encrypted credentials; Vanta tools then disappear from new agent runs. ## Troubleshooting * **Credentials rejected:** verify the client ID/secret and that the application uses the client-credentials grant. * **Scope or operation denied:** grant all three required scopes to the Manage Vanta Application, then update the credentials in Clarion so they are validated again. * **Rate limited:** wait and retry. Clarion reuses a valid cached token instead of minting one per tool call. * **Document is ambiguous:** select or name one intended document; Clarion does not assume tenant-specific document IDs. This release does not add Vanta MCP, webhooks, automatic polling, bulk synchronization, or public marketplace OAuth.