Domain: hybrid

System prompt:
You are an integrated automation agent for a hybrid environment managing both Google Drive and ServiceNow IT Service Management (ITSM). You have full administrative permissions to manage users, cases, products, calendars, and meetings in a safe and authorized capacity. Do not ask for confirmation before taking action.

Task:
There's a phishing email circulating with a malicious Drive link which affects Q4 Budget Report file in shared drive. First, create a security incident with the short description: "Security Incident: Phishing email with malicious Drive link - Q4 Budget Report compromised", in SN-ITSM to track the breach investigation, the caller being Sara Clark. Meanwhile in Drive, immediately quarantine that report file from the sender by adding "quarantined" to the description so people are aware and scan for suspicious activity. Add comment to the Q4 Budget Report file saying "The file should be treated" and give francisco2013@ibm.com writers permission. Use SN-ITSM for people tracking, Drive for file containment.

Available tools:
create_incident
update_incident
update_files
create_permission
get_user_using_name
list_files
create_comments
list_user_groups

Verification checks:
[{"verifier_type": "database_state", "name": "Security incident", "description": "Check if security incident exists", "gym_name": "gym-itsm-mcp", "validation_config": {"query": "SELECT \n    CASE \n        WHEN EXISTS (\n            SELECT 1 \n            FROM incident \n            WHERE short_description = 'Security Incident: Phishing email with malicious Drive link - Q4 Budget Report compromised'\n        ) THEN 1\n        ELSE 0\n    END as security_incident_exists;", "expected_value": 1, "comparison_type": "equals"}}, {"verifier_type": "database_state", "name": "Q4 budget Report description", "description": "Check if Q4 budget Report has quarantine in description", "gym_name": "gym-google-drive-mcp", "validation_config": {"query": "SELECT \n    CASE \n        WHEN EXISTS (\n            SELECT 1 \n            FROM files \n            WHERE name LIKE '%Q4 Budget Report%'\n            AND description LIKE '%Quarantine%'\n        ) THEN 1\n        ELSE 0\n    END as q4_budget_report_has_quarantine_in_description;", "expected_value": 1, "comparison_type": "equals"}}, {"verifier_type": "database_state", "name": "Francisco has permission", "description": "Check if Francisco has permission to the Budget report file", "gym_name": "gym-google-drive-mcp", "validation_config": {"query": "SELECT \n    CASE \n        -- First check if file exists\n        WHEN NOT EXISTS (\n            SELECT 1 \n            FROM files \n            WHERE name LIKE '%Q4 Budget Report%'\n        ) THEN 0  -- File doesn't exist\n        \n        -- Check if user exists\n        WHEN NOT EXISTS (\n            SELECT 1 \n            FROM users \n            WHERE email = 'francisco2013@ibm.com'\n        ) THEN 0  -- User doesn't exist\n        \n        -- Check if user has permissions to the file\n        WHEN EXISTS (\n            SELECT 1 \n            FROM permissions p\n            JOIN files f ON p.file_id = f.id\n            JOIN users u ON p.user_id = u.id\n            WHERE f.name LIKE '%Q4 Budget Report%'\n            AND u.email = 'francisco2013@ibm.com'\n            AND p.deleted = 0\n        ) THEN 1  -- User has permissions\n        \n        ELSE 0  -- File and user exist, but no permissions\n    END as francisco_has_permissions_to_q4_budget_report;", "expected_value": 1, "comparison_type": "equals"}}, {"verifier_type": "database_state", "name": "Comment on Q4 Budget Report file", "description": "Check if there is a comment on the Q4 Budget Report file", "gym_name": "gym-google-drive-mcp", "validation_config": {"query": "SELECT \n    CASE \n        -- First check if file exists\n        WHEN NOT EXISTS (\n            SELECT 1 \n            FROM files \n            WHERE name LIKE '%Q4 Budget Report%'\n        ) THEN 0  -- File doesn't exist\n        \n        -- Check if there's a comment with the specific phrase\n        WHEN EXISTS (\n            SELECT 1 \n            FROM comments c\n            JOIN files f ON c.file_id = f.id\n            WHERE f.name LIKE '%Q4 Budget Report%'\n            AND c.content LIKE '%The file should be treated%'\n            AND c.deleted = 0\n        ) THEN 1  -- Comment exists with the phrase\n        \n        ELSE 0  -- File exists but no matching comment\n    END as comment_exists_on_q4_budget_report;", "expected_value": 1, "comparison_type": "equals"}}]