matheuscr000/sistema-sgsi-itgc ? reverse-engineered prompt

Build me a web app for managing a fake company’s security governance program, with a demo mode and a practice mode.

It should let someone work through information security controls in a simple way, starting from a requirement and following the chain to risk, control, evidence, test, finding, and action. The app is for ISO 27001 style management, with ITGC and LGPD controls mixed in, and all data should be clearly fictional for a company called Orbis Comércio Digital S.A.

I want a clean internal dashboard where an admin can seed sample data in demo mode, but practice mode stays empty and guides the user through the steps they need to complete. Include roles like admin and auditor, with auditors only able to view things. Keep a strong audit trail for changes, and make sure the log can’t be edited or deleted.

If useful, look up current docs online while building it, and make sure it runs locally with simple commands and good tests.