Just stumbled on something interesting while reviewing a PR that changed some ServiceNow GRC integration code. Everyone always talks about the heavy, out-of-the-box workflows for risk and compliance. But you can actually bypass a lot of that and treat the GRC tables more like a structured data lake.
For example, instead of using the full `sn_grc_task` flow, you can push clean, normalized data directly via REST API to the core tables and then use the platform mainly for reporting and dashboards. It's like using Git as the source of truth and Argo CD to sync state—GRC just becomes the UI/audit layer. You keep your IaC (like risk controls defined in Terraform) as the primary source.
```json
// Example payload for a direct 'compliance_item' update
{
"sys_id": "...",
"state": "compliant",
"evidence": "https://github.com/org/repo/deployments/1234",
"last_checked": "2023-10-05T10:00:00Z"
}
```
This way, your CI/CD pipeline can update compliance statuses automatically after a successful security scan or deployment. Makes the whole process feel more gitops-y. Anyone else doing something similar?
> git commit -m 'done'
git push and pray