← Design · c123

initial-prompt.md

c123 — Compliance Frameworks (initial prompt)

Contents
  1. Mark's prompt (verbatim)
  2. What came back (2026-10-26)
  3. Sources this builds on

Stage 1. Raw thinking captured 2026-10-26, the Monday of "frameworks week". No CYCLE.md yet; kick-off follows the session with Mark Peterson.

Mark's prompt (verbatim)

This week we are focusing on compliance frameworks. Take a moment to review the previous relevant cycles to understand where this new work will lie. Mark Peterson is a very important source of truth and will be leading our shared understanding efforts. Here is what he will be discussing today: (quote from slack)

Here's my next focus:

Draft the View Frameworks and View Framework intents. Identify our initial frameworks and policy catalog, including mappings between them.

Here's my proposed sequence for framework support:

  1. Baseline AI governance and security assurance
    • OWASP Top 10 for LLM Applications.
    • NIST AI Risk Management Framework.
    • SOC 2 / AICPA Trust Services Criteria.
  2. Additional AI security and control frameworks
    • AIUC-1.
    • CSA AI Controls Matrix (AICM).
  3. AI management standards and regulation
    • ISO/IEC 42001.
    • EU AI Act.
  4. Add as customer needs emerge
    • ISO/IEC 27001.
    • EU Cyber Resilience Act.
    • HITRUST CSF.

These are recommended phases for supporting frameworks, with the first group as the proposed v1 scope.

We let customer demand can move individual frameworks forward. We'll also evaluate AICM early as a reference for policy mappings. For each framework, support means mapping relevant QPoint policies and evidence to specific requirements, not claiming complete coverage or compliance.

Think through what logical additions, subtractions, changes, etc (designs) follow from our emerging knowledge.

What questions should we be thinking about as we move forward?

Become an expert in the above frameworks. We'll use this knowledge to create the best representation of the framework possible in our software. We will illuminate, clarify and simplify the ideas behind the framework so the user can make the very best decisions around their compliance governance.

What points of value or visualizations are we leaving on the table. Let's think deeply about what we can do with the wealth of information that is pouring form the actors in the AI ecosystem–as it relates to compliance?

How can we quickly communicated the nature of the compliance, what's covered/what's not? Let's think through how we could use qmap; also, we have a designer actively working on the pixel pawn design. Let's give her some stories to tell so the actors (harnesses, users, LLMs, MCP servers, etc) have something to show / say.

What can we do to come prepared to the meeting?

What came back (2026-10-26)

  • meeting-prep.html: the prep page (also published as an Artifact). It covers the short version, prior cycles, the ten frameworks as of this week, an evidence × framework coverage map, design additions, changes and removals, questions for Peterson, value left on the table, qmap views, pixel-pawn stories and a meeting checklist.
  • intents-redline.md: our own gap-check, not for sending (Mark Parson, 2026-10-26: Peterson revises the intents himself; we suggest only the gaps). It redlines observe_view-policies-and-frameworks.md and observe_view-a-framework-details.md line by line against the Oct 19 model (cited at ce9ce2b). It proposes four coverage states (Enforced / Observed / Evidenced / Outside) and gives clean PR #4-style drafts of View Frameworks, View a Framework's Details and an optional new Track a Framework. The intents repo was not edited.
  • research/frameworks-dossier.md: the web-verified dossier on the ten frameworks plus the OWASP Agentic Top 10. Each claim is tagged V/S/K/UNVERIFIED, with sources.

Sources this builds on

  • Intents (Peterson): ../intents/observe_view-policies-and-frameworks.md and observe_view-a-framework-details.md (PR #3, 2026-10-09, written before the Oct 19 model). Also enforce_configure-policies-and-exceptions.md:51,58 (PR #4).
  • c65 research-frameworks.md and policy-definitions.md, which hold P1–P17 and the 12-framework matrix.
  • c114 object-model.md, surface-map.md (S4, S5) and app/data/governance-fixture.ts, which hold the 19 slug policies and 3 frameworks.
  • c118 A6 "frameworks are the entry point", Q10 (they arrive in Observe) and L6b (never drawn).
  • c121 D1–D26; frameworks were deferred as "(next)".
  • c64, c78, c79 (evidence, reports, findings vocabulary). c101 (qmap surface brief). c47 and c57 (pawns).
  • market-analyst: prove-posture-over-time (recurring), findings-resolution-workflow, fleet-scale-compliance-state. Candidate 154b2679 (Peterson, Oct 19: pick frameworks → policies populate → except what I'm not ready for). No framework problem exists in the registry yet.

Qpoint Brand Style Guide