[{"data":1,"prerenderedAt":3644},["ShallowReactive",2],{"cycle-doc-design-c123-intents-redline.md":3},{"cycle":4,"project":7,"path":10,"title":11,"toc":12,"ast":28},{"id":5,"title":6},"c123","Compliance Frameworks",{"id":8,"label":9},"design","Design","intents-redline.md","Redline: the two framework intents against the Oct 19 model",[13,14,15,16,17,18,19,20,21,22,23,24,25,26,17,18,19,20,21,22,23,24,25,26,17,18,19,20,22,23,24,25,26,27],"1. `observe_view-policies-and-frameworks.md` → `observe_view-frameworks.md`","2. `observe_view-a-framework-details.md`","3. A proposal for coverage states","4. Clean drafts in PR #4 style","TL;DR","User \u002F Persona","Problem","Desired Outcome","Context","Expected Behavior","Non-Goals \u002F Out of Scope","Constraints \u002F Guardrails","Open Questions","Related","5. The gap check: what his revision should settle",{"type":29,"children":30},"root",[31,63,84,127,137,308,316,427,432,436,455,495,502,586,600,683,696,752,765,878,891,1047,1060,1109,1122,1147,1160,1214,1227,1297,1310,1724,1733,1766,1779,1833,1836,1847,1860,1899,1911,2143,2156,2218,2231,2269,2281,2446,2459,2523,2536,2589,2602,2620,2632,2706,2718,2787,2799,3226,3238,3286,3289,3294,3307,3441,3446,3476,3481,3484,3489,3500,3511,3524,3535,3543,3556,3564,3567,3572,3605,3639],{"type":32,"tag":33,"props":34,"children":35},"element","blockquote",{},[36],{"type":32,"tag":37,"props":38,"children":39},"p",{},[40,47,49,61],{"type":32,"tag":41,"props":42,"children":43},"strong",{},[44],{"type":45,"value":46},"text","Closed 2026-11-05.",{"type":45,"value":48}," Peterson's revised intents landed as PR 5. Of §5's six asks: the split and version pinning landed; fit and provenance mostly landed, as rationale, limits and mapping revision; evidence as a mapping target, the four coverage states and tracking moving Off to Observe were declined. Mark's rulings then set the lab's own course: ",{"type":32,"tag":50,"props":51,"children":53},"a",{"href":52},"\u002Fcycles\u002Fdesign\u002Fc123\u002Fdoc\u002Fintents-pr5-plan",[54],{"type":32,"tag":55,"props":56,"children":58},"code",{"className":57},[],[59],{"type":45,"value":60},"intents-pr5-plan.md",{"type":45,"value":62},".",{"type":32,"tag":37,"props":64,"children":65},{},[66,68,74,76,82],{"type":45,"value":67},"c123's own reference (2026-10-26). It is not for sending. Mark Peterson is revising the framework intents himself (Mark Parson, 2026-10-26: \"let's see what he comes up with and we can always make suggestions if there are gaps\"). When his revision lands in ",{"type":32,"tag":55,"props":69,"children":71},{"className":70},[],[72],{"type":45,"value":73},"qpoint-io\u002Fintents",{"type":45,"value":75},", check it against §5 and the line notes below, and raise only what's still missing, in the style of c121's ",{"type":32,"tag":55,"props":77,"children":79},{"className":78},[],[80],{"type":45,"value":81},"feedback-intents.md",{"type":45,"value":83},". Nothing in the intents repo has been edited.",{"type":32,"tag":37,"props":85,"children":86},{},[87,89,95,97,103,105,111,113,119,121,126],{"type":45,"value":88},"Both intents were written in PR #3 (",{"type":32,"tag":55,"props":90,"children":92},{"className":91},[],[93],{"type":45,"value":94},"0889e75",{"type":45,"value":96},", 2026-10-09): ",{"type":32,"tag":55,"props":98,"children":100},{"className":99},[],[101],{"type":45,"value":102},"observe_view-policies-and-frameworks.md",{"type":45,"value":104}," (320 lines) and ",{"type":32,"tag":55,"props":106,"children":108},{"className":107},[],[109],{"type":45,"value":110},"observe_view-a-framework-details.md",{"type":45,"value":112}," (424 lines). The week of Oct 19 then changed the model they stand on. PR #4 (",{"type":32,"tag":55,"props":114,"children":116},{"className":115},[],[117],{"type":45,"value":118},"ce9ce2b",{"type":45,"value":120},", 2026-10-23) brought seven intents up to date and left these two alone. Line numbers below are at ",{"type":32,"tag":55,"props":122,"children":124},{"className":123},[],[125],{"type":45,"value":118},{"type":45,"value":62},{"type":32,"tag":37,"props":128,"children":129},{},[130,135],{"type":32,"tag":41,"props":131,"children":132},{},[133],{"type":45,"value":134},"What changed underneath them",{"type":45,"value":136},", with sources:",{"type":32,"tag":138,"props":139,"children":140},"table",{},[141,165],{"type":32,"tag":142,"props":143,"children":144},"thead",{},[145],{"type":32,"tag":146,"props":147,"children":148},"tr",{},[149,155,160],{"type":32,"tag":150,"props":151,"children":152},"th",{},[153],{"type":45,"value":154},"Then (PR #3)",{"type":32,"tag":150,"props":156,"children":157},{},[158],{"type":45,"value":159},"Now",{"type":32,"tag":150,"props":161,"children":162},{},[163],{"type":45,"value":164},"Source",{"type":32,"tag":166,"props":167,"children":168},"tbody",{},[169,202,226,244,268,286],{"type":32,"tag":146,"props":170,"children":171},{},[172,178,183],{"type":32,"tag":173,"props":174,"children":175},"td",{},[176],{"type":45,"value":177},"Policy Groups apply policies to scopes",{"type":32,"tag":173,"props":179,"children":180},{},[181],{"type":45,"value":182},"No managed groups. Exceptions vary mode by org, team or user, and \"frameworks remain the predefined policy grouping\".",{"type":32,"tag":173,"props":184,"children":185},{},[186,192,194,200],{"type":32,"tag":55,"props":187,"children":189},{"className":188},[],[190],{"type":45,"value":191},"enforce_configure-policies-and-exceptions.md:38",{"type":45,"value":193},", ",{"type":32,"tag":55,"props":195,"children":197},{"className":196},[],[198],{"type":45,"value":199},"observe_review-team-policy-posture.md:21",{"type":45,"value":201},", c121 ruling of 2026-10-21",{"type":32,"tag":146,"props":203,"children":204},{},[205,210,215],{"type":32,"tag":173,"props":206,"children":207},{},[208],{"type":45,"value":209},"Scope plus enforcement state per scope",{"type":32,"tag":173,"props":211,"children":212},{},[213],{"type":45,"value":214},"Mode on the policy: Off · Observe · Enforce, with an optional Until. Exceptions use the same control.",{"type":32,"tag":173,"props":216,"children":217},{},[218,224],{"type":32,"tag":55,"props":219,"children":221},{"className":220},[],[222],{"type":45,"value":223},"enforce_configure-policies-and-exceptions.md:28–31",{"type":45,"value":225},", c121 D6",{"type":32,"tag":146,"props":227,"children":228},{},[229,234,239],{"type":32,"tag":173,"props":230,"children":231},{},[232],{"type":45,"value":233},"\"Enable\" or \"activate\" a framework",{"type":32,"tag":173,"props":235,"children":236},{},[237],{"type":45,"value":238},"Frameworks are the entry point. Tracking one brings its policies in at Observe, and the admin backs out with Off or exceptions.",{"type":32,"tag":173,"props":240,"children":241},{},[242],{"type":45,"value":243},"c118 A6 (ruled as the mental model, Oct 19), Q10 (Oct 20)",{"type":32,"tag":146,"props":245,"children":246},{},[247,252,257],{"type":32,"tag":173,"props":248,"children":249},{},[250],{"type":45,"value":251},"Saving changes enforcement",{"type":32,"tag":173,"props":253,"children":254},{},[255],{"type":45,"value":256},"Saves go into one shared Policy Config draft. Publishing is explicit, and endpoints confirm the version they run.",{"type":32,"tag":173,"props":258,"children":259},{},[260,266],{"type":32,"tag":55,"props":261,"children":263},{"className":262},[],[264],{"type":45,"value":265},"enforce_publish-policy-configuration.md",{"type":45,"value":267},", c121 D2, D4, D11",{"type":32,"tag":146,"props":269,"children":270},{},[271,276,281],{"type":32,"tag":173,"props":272,"children":273},{},[274],{"type":45,"value":275},"A finding is open or resolved",{"type":32,"tag":173,"props":277,"children":278},{},[279],{"type":45,"value":280},"A finding's outcome, Enforced or Observed, is stamped at detection. Observed findings are hidden by default on Findings.",{"type":32,"tag":173,"props":282,"children":283},{},[284],{"type":45,"value":285},"c121 D3, D16",{"type":32,"tag":146,"props":287,"children":288},{},[289,294,299],{"type":32,"tag":173,"props":290,"children":291},{},[292],{"type":45,"value":293},"(not addressed)",{"type":32,"tag":173,"props":295,"children":296},{},[297],{"type":45,"value":298},"Do not infer that framework selection guarantees compliance or silently chooses an enforcement mode.",{"type":32,"tag":173,"props":300,"children":301},{},[302],{"type":32,"tag":55,"props":303,"children":305},{"className":304},[],[306],{"type":45,"value":307},"enforce_configure-policies-and-exceptions.md:51",{"type":32,"tag":37,"props":309,"children":310},{},[311],{"type":32,"tag":41,"props":312,"children":313},{},[314],{"type":45,"value":315},"Our main suggestions, in short:",{"type":32,"tag":317,"props":318,"children":319},"ol",{},[320,365,391,409],{"type":32,"tag":321,"props":322,"children":323},"li",{},[324,329,331,337,339,345,347,352,354,363],{"type":32,"tag":41,"props":325,"children":326},{},[327],{"type":45,"value":328},"Split the work by object, not by page.",{"type":45,"value":330}," Policies now live in ",{"type":32,"tag":55,"props":332,"children":334},{"className":333},[],[335],{"type":45,"value":336},"enforce_configure-policies-and-exceptions.md",{"type":45,"value":338}," (\"the catalog is the control board\", ",{"type":32,"tag":55,"props":340,"children":342},{"className":341},[],[343],{"type":45,"value":344},":23",{"type":45,"value":346},"). So ",{"type":32,"tag":55,"props":348,"children":350},{"className":349},[],[351],{"type":45,"value":102},{"type":45,"value":353}," becomes ",{"type":32,"tag":41,"props":355,"children":356},{},[357],{"type":32,"tag":55,"props":358,"children":360},{"className":359},[],[361],{"type":45,"value":362},"observe_view-frameworks.md",{"type":45,"value":364},": the framework listing alone. This matches the two intents you named on Slack (\"View Frameworks and View Framework\").",{"type":32,"tag":321,"props":366,"children":367},{},[368,373,375,381,383,389],{"type":32,"tag":41,"props":369,"children":370},{},[371],{"type":45,"value":372},"Give tracking its own short intent:",{"type":45,"value":374}," ",{"type":32,"tag":55,"props":376,"children":378},{"className":377},[],[379],{"type":45,"value":380},"enforce_track-a-framework.md",{"type":45,"value":382},". Tracking is a configuration edit: it stages policies at Observe into the shared draft. Keeping it out of the two Observe intents protects their \"informational and evidentiary\" property (",{"type":32,"tag":55,"props":384,"children":386},{"className":385},[],[387],{"type":45,"value":388},"observe_view-a-framework-details.md:8",{"type":45,"value":390},"). Drafted at the end of this doc. Folding it into View Frameworks is the alternative, and a fine one if you prefer fewer files.",{"type":32,"tag":321,"props":392,"children":393},{},[394,399,401,407],{"type":32,"tag":41,"props":395,"children":396},{},[397],{"type":45,"value":398},"Let requirements map to evidence that isn't a policy.",{"type":45,"value":400}," Inventory, retained activity logs and exports are where Qpoint is strongest (NIST AI RMF GV 1.6, ISO 27001 5.9, ISO 42001 A.4, EU AI Act Art. 26(6), AIUC-1 E015). As written, a requirement with no mapped policy reads \"Not currently addressable\" (",{"type":32,"tag":55,"props":402,"children":404},{"className":403},[],[405],{"type":45,"value":406},"observe_view-a-framework-details.md:262–268",{"type":45,"value":408},"), so our best coverage would show as a gap.",{"type":32,"tag":321,"props":410,"children":411},{},[412,417,419,425],{"type":32,"tag":41,"props":413,"children":414},{},[415],{"type":45,"value":416},"Make framework kind and version part of the model, not metadata.",{"type":45,"value":418}," Kind changes how coverage reads (",{"type":32,"tag":55,"props":420,"children":422},{"className":421},[],[423],{"type":45,"value":424},":343",{"type":45,"value":426}," already asks for that). Version matters now: OWASP renumbered the LLM Top 10 on 2026-08-03, and AIUC-1 releases quarterly.",{"type":32,"tag":37,"props":428,"children":429},{},[430],{"type":45,"value":431},"Clean drafts of all three intents, in PR #4's compact style, follow the line-by-line redline.",{"type":32,"tag":433,"props":434,"children":435},"hr",{},[],{"type":32,"tag":437,"props":438,"children":440},"h2",{"id":439},"_1-observe_view-policies-and-frameworksmd-observe_view-frameworksmd",[441,443,448,450],{"type":45,"value":442},"1. ",{"type":32,"tag":55,"props":444,"children":446},{"className":445},[],[447],{"type":45,"value":102},{"type":45,"value":449}," → ",{"type":32,"tag":55,"props":451,"children":453},{"className":452},[],[454],{"type":45,"value":362},{"type":32,"tag":37,"props":456,"children":457},{},[458,460,465,467,472,474,479,481,486,488,493],{"type":45,"value":459},"Marks: ",{"type":32,"tag":41,"props":461,"children":462},{},[463],{"type":45,"value":464},"Strike",{"type":45,"value":466}," removes text. ",{"type":32,"tag":41,"props":468,"children":469},{},[470],{"type":45,"value":471},"Replace",{"type":45,"value":473}," gives new text. ",{"type":32,"tag":41,"props":475,"children":476},{},[477],{"type":45,"value":478},"Move",{"type":45,"value":480}," names where the content now lives. ",{"type":32,"tag":41,"props":482,"children":483},{},[484],{"type":45,"value":485},"Add",{"type":45,"value":487}," is new. ",{"type":32,"tag":41,"props":489,"children":490},{},[491],{"type":45,"value":492},"Keep",{"type":45,"value":494}," means it holds as written and is worth saying so.",{"type":32,"tag":496,"props":497,"children":499},"h3",{"id":498},"title-and-tldr",[500],{"type":45,"value":501},"Title and TL;DR",{"type":32,"tag":503,"props":504,"children":505},"ul",{},[506,522,554,577],{"type":32,"tag":321,"props":507,"children":508},{},[509,520],{"type":32,"tag":41,"props":510,"children":511},{},[512,514],{"type":45,"value":513},"Replace ",{"type":32,"tag":55,"props":515,"children":517},{"className":516},[],[518],{"type":45,"value":519},":1",{"type":45,"value":521}," \"Intent: View Policies and Frameworks\" → \"Intent: View Frameworks\".",{"type":32,"tag":321,"props":523,"children":524},{},[525,536,538,544,546,552],{"type":32,"tag":41,"props":526,"children":527},{},[528,530],{"type":45,"value":529},"Move ",{"type":32,"tag":55,"props":531,"children":533},{"className":532},[],[534],{"type":45,"value":535},":6–7",{"type":45,"value":537}," (Policy as testable rule; recommended severity, override and reset). The configure intent covers both: \"organization severity alongside Qpoint's recommendation\" (",{"type":32,"tag":55,"props":539,"children":541},{"className":540},[],[542],{"type":45,"value":543},"enforce_configure-policies-and-exceptions.md:27",{"type":45,"value":545},") and \"Severity expresses risk independently of mode\" (",{"type":32,"tag":55,"props":547,"children":549},{"className":548},[],[550],{"type":45,"value":551},":29",{"type":45,"value":553},").",{"type":32,"tag":321,"props":555,"children":556},{},[557,568,570,575],{"type":32,"tag":41,"props":558,"children":559},{},[560,562],{"type":45,"value":561},"Keep ",{"type":32,"tag":55,"props":563,"children":565},{"className":564},[],[566],{"type":45,"value":567},":8",{"type":45,"value":569},", extended: \"Framework requirements map to one or more Policies ",{"type":32,"tag":41,"props":571,"children":572},{},[573],{"type":45,"value":574},"or other Qpoint evidence",{"type":45,"value":576},", so practitioners can see what Qpoint can observe, enforce or evidence, and where gaps remain.\"",{"type":32,"tag":321,"props":578,"children":579},{},[580,584],{"type":32,"tag":41,"props":581,"children":582},{},[583],{"type":45,"value":485},{"type":45,"value":585}," a TL;DR line: \"Tracking a framework is the starting point for governance: its mapped policies come into the draft at Observe (see Track a Framework).\"",{"type":32,"tag":496,"props":587,"children":589},{"id":588},"desired-outcome-3043",[590,592,598],{"type":45,"value":591},"Desired Outcome (",{"type":32,"tag":55,"props":593,"children":595},{"className":594},[],[596],{"type":45,"value":597},":30–43",{"type":45,"value":599},")",{"type":32,"tag":503,"props":601,"children":602},{},[603,619,640,655,665,674],{"type":32,"tag":321,"props":604,"children":605},{},[606,617],{"type":32,"tag":41,"props":607,"children":608},{},[609,611],{"type":45,"value":610},"Strike ",{"type":32,"tag":55,"props":612,"children":614},{"className":613},[],[615],{"type":45,"value":616},":32–36",{"type":45,"value":618}," (available policies, active policies, what each tests, severity, override). This is now the configure intent's catalog.",{"type":32,"tag":321,"props":620,"children":621},{},[622,632,634,639],{"type":32,"tag":41,"props":623,"children":624},{},[625,626],{"type":45,"value":610},{"type":32,"tag":55,"props":627,"children":629},{"className":628},[],[630],{"type":45,"value":631},":37",{"type":45,"value":633}," \"Which Policies belong to operational Policy Groups\". Groups are no longer managed (",{"type":32,"tag":55,"props":635,"children":637},{"className":636},[],[638],{"type":45,"value":191},{"type":45,"value":553},{"type":32,"tag":321,"props":641,"children":642},{},[643,653],{"type":32,"tag":41,"props":644,"children":645},{},[646,647],{"type":45,"value":513},{"type":32,"tag":55,"props":648,"children":650},{"className":649},[],[651],{"type":45,"value":652},":39",{"type":45,"value":654}," \"Which Frameworks are currently relevant or enabled\" → \"Which Frameworks the organization tracks, and at which version\".",{"type":32,"tag":321,"props":656,"children":657},{},[658,663],{"type":32,"tag":41,"props":659,"children":660},{},[661],{"type":45,"value":662},"Add:",{"type":45,"value":664}," \"What kind of framework each one is (a risk taxonomy, a risk-management framework, attestation criteria, a certifiable standard, a controls matrix, a certification or a law), because kind changes what coverage means.\"",{"type":32,"tag":321,"props":666,"children":667},{},[668,672],{"type":32,"tag":41,"props":669,"children":670},{},[671],{"type":45,"value":662},{"type":45,"value":673}," \"For each tracked framework: how many requirements are Enforced, Observed, Evidenced and Outside Qpoint, as counts\" (see §3 on coverage states).",{"type":32,"tag":321,"props":675,"children":676},{},[677,681],{"type":32,"tag":41,"props":678,"children":679},{},[680],{"type":45,"value":662},{"type":45,"value":682}," \"Open findings through mapped policies, split by outcome (Enforced or Observed)\" (c121 D16).",{"type":32,"tag":496,"props":684,"children":686},{"id":685},"context-4570",[687,689,695],{"type":45,"value":688},"Context (",{"type":32,"tag":55,"props":690,"children":692},{"className":691},[],[693],{"type":45,"value":694},":45–70",{"type":45,"value":599},{"type":32,"tag":503,"props":697,"children":698},{},[699,714,729],{"type":32,"tag":321,"props":700,"children":701},{},[702,712],{"type":32,"tag":41,"props":703,"children":704},{},[705,706],{"type":45,"value":513},{"type":32,"tag":55,"props":707,"children":709},{"className":708},[],[710],{"type":45,"value":711},":49–52",{"type":45,"value":713}," journey stage. Viewing stays Observe. The configure intent's journey reads \"Observe → Investigate Findings → Configure Policies and Exceptions → Publish Configuration\". Suggest: \"Observe → View Frameworks → Track a Framework → Configure Policies and Exceptions → Publish Configuration\".",{"type":32,"tag":321,"props":715,"children":716},{},[717,727],{"type":32,"tag":41,"props":718,"children":719},{},[720,721],{"type":45,"value":513},{"type":32,"tag":55,"props":722,"children":724},{"className":723},[],[725],{"type":45,"value":726},":59–64",{"type":45,"value":728}," downstream journey. \"Enable \u002F Disable Policy Enforcement\", \"Enable \u002F Disable Policy Group's Enforcement\" and \"Manage Surface Area Exceptions\" → \"Track a Framework\", \"Configure Policies and Exceptions\", \"Publish Policy Configuration\".",{"type":32,"tag":321,"props":730,"children":731},{},[732,742,744,750],{"type":32,"tag":41,"props":733,"children":734},{},[735,736],{"type":45,"value":561},{"type":32,"tag":55,"props":737,"children":739},{"className":738},[],[740],{"type":45,"value":741},":70",{"type":45,"value":743}," (\"Frameworks do not directly generate Findings… mapped to Policies that provide evidence, monitoring, or enforcement\"). It already says ",{"type":32,"tag":745,"props":746,"children":747},"em",{},[748],{"type":45,"value":749},"evidence",{"type":45,"value":751},", which supports suggestion 3.",{"type":32,"tag":496,"props":753,"children":755},{"id":754},"core-concepts-72137",[756,758,764],{"type":45,"value":757},"Core Concepts (",{"type":32,"tag":55,"props":759,"children":761},{"className":760},[],[762],{"type":45,"value":763},":72–137",{"type":45,"value":599},{"type":32,"tag":503,"props":766,"children":767},{},[768,783,824,839,862],{"type":32,"tag":321,"props":769,"children":770},{},[771,781],{"type":32,"tag":41,"props":772,"children":773},{},[774,775],{"type":45,"value":529},{"type":32,"tag":55,"props":776,"children":778},{"className":777},[],[779],{"type":45,"value":780},":74–107",{"type":45,"value":782}," (Policy, Finding, Policy Severity) to the configure intent. Keep a single line here: \"A Policy is the testable unit; see Configure Policies and Exceptions.\"",{"type":32,"tag":321,"props":784,"children":785},{},[786,796,798,802,804],{"type":32,"tag":41,"props":787,"children":788},{},[789,790],{"type":45,"value":610},{"type":32,"tag":55,"props":791,"children":793},{"className":792},[],[794],{"type":45,"value":795},":109–119",{"type":45,"value":797}," (Policy Group). ",{"type":32,"tag":41,"props":799,"children":800},{},[801],{"type":45,"value":471},{"type":45,"value":803}," with:\n",{"type":32,"tag":33,"props":805,"children":806},{},[807],{"type":32,"tag":37,"props":808,"children":809},{},[810,815,817,822],{"type":32,"tag":41,"props":811,"children":812},{},[813],{"type":45,"value":814},"Grouping.",{"type":45,"value":816}," Frameworks are the only predefined grouping of policies (",{"type":32,"tag":55,"props":818,"children":820},{"className":819},[],[821],{"type":45,"value":199},{"type":45,"value":823},"). A team's posture is derived from policies and exceptions; it is not a managed group.",{"type":32,"tag":321,"props":825,"children":826},{},[827,837],{"type":32,"tag":41,"props":828,"children":829},{},[830,831],{"type":45,"value":513},{"type":32,"tag":55,"props":832,"children":834},{"className":833},[],[835],{"type":45,"value":836},":125–131",{"type":45,"value":838}," examples. The list names NIST CSF, which isn't on the v1 sequence. Suggest the v1 group: \"OWASP Top 10 for LLM Applications, NIST AI Risk Management Framework, SOC 2 Trust Services Criteria.\" Then name the later phases.",{"type":32,"tag":321,"props":840,"children":841},{},[842,846,848,853,855,860],{"type":32,"tag":41,"props":843,"children":844},{},[845],{"type":45,"value":485},{"type":45,"value":847}," to Framework: \"A Framework has a ",{"type":32,"tag":41,"props":849,"children":850},{},[851],{"type":45,"value":852},"kind",{"type":45,"value":854}," and a ",{"type":32,"tag":41,"props":856,"children":857},{},[858],{"type":45,"value":859},"version",{"type":45,"value":861},". Tracking pins a version. A new edition is a separate framework version that the admin moves to; it doesn't rewrite the one being tracked.\"",{"type":32,"tag":321,"props":863,"children":864},{},[865,869,871,876],{"type":32,"tag":41,"props":866,"children":867},{},[868],{"type":45,"value":485},{"type":45,"value":870}," a concept: ",{"type":32,"tag":41,"props":872,"children":873},{},[874],{"type":45,"value":875},"Evidence source.",{"type":45,"value":877}," \"Qpoint evidence that is not a policy evaluation: the AI inventory, activity-log retention and exports. A requirement may map to an evidence source as well as, or instead of, a policy.\"",{"type":32,"tag":496,"props":879,"children":881},{"id":880},"expected-behavior-139162",[882,884,890],{"type":45,"value":883},"Expected Behavior (",{"type":32,"tag":55,"props":885,"children":887},{"className":886},[],[888],{"type":45,"value":889},":139–162",{"type":45,"value":599},{"type":32,"tag":503,"props":892,"children":893},{},[894,916,937,952,967,997,1006,1022],{"type":32,"tag":321,"props":895,"children":896},{},[897,907,909,914],{"type":32,"tag":41,"props":898,"children":899},{},[900,901],{"type":45,"value":513},{"type":32,"tag":55,"props":902,"children":904},{"className":903},[],[905],{"type":45,"value":906},":141",{"type":45,"value":908}," \"a common Policies & Frameworks area\" → \"a Frameworks view, reachable from Policies and from a policy's header (which lists its frameworks, ",{"type":32,"tag":55,"props":910,"children":912},{"className":911},[],[913],{"type":45,"value":543},{"type":45,"value":915},")\".",{"type":32,"tag":321,"props":917,"children":918},{},[919,929,931,935],{"type":32,"tag":41,"props":920,"children":921},{},[922,923],{"type":45,"value":610},{"type":32,"tag":55,"props":924,"children":926},{"className":925},[],[927],{"type":45,"value":928},":143",{"type":45,"value":930}," \"View Policies by category or Policy Group\". ",{"type":32,"tag":41,"props":932,"children":933},{},[934],{"type":45,"value":485},{"type":45,"value":936}," instead: \"Filter the policy catalog by framework,\" which belongs in the configure intent.",{"type":32,"tag":321,"props":938,"children":939},{},[940,950],{"type":32,"tag":41,"props":941,"children":942},{},[943,944],{"type":45,"value":529},{"type":32,"tag":55,"props":945,"children":947},{"className":946},[],[948],{"type":45,"value":949},":144–153",{"type":45,"value":951}," (policy fields, severity indicator, reset) to the configure intent, which has most of them already.",{"type":32,"tag":321,"props":953,"children":954},{},[955,965],{"type":32,"tag":41,"props":956,"children":957},{},[958,959],{"type":45,"value":513},{"type":32,"tag":55,"props":960,"children":962},{"className":961},[],[963],{"type":45,"value":964},":147",{"type":45,"value":966}," \"Current state\" (if any of it stays) → \"Mode (Off · Observe · Enforce) and Until\".",{"type":32,"tag":321,"props":968,"children":969},{},[970,980,982,988,990,995],{"type":32,"tag":41,"props":971,"children":972},{},[973,974],{"type":45,"value":561},{"type":32,"tag":55,"props":975,"children":977},{"className":976},[],[978],{"type":45,"value":979},":155–162",{"type":45,"value":981},", the many-to-many mapping and derived coverage. Amend ",{"type":32,"tag":55,"props":983,"children":985},{"className":984},[],[986],{"type":45,"value":987},":162",{"type":45,"value":989},": \"Framework coverage is derived from the mapped Policies' ",{"type":32,"tag":41,"props":991,"children":992},{},[993],{"type":45,"value":994},"mode, as published and confirmed on endpoints",{"type":45,"value":996},", and from mapped evidence sources.\" This is the c114 D3 \u002F c121 D11 distinction between configured and confirmed.",{"type":32,"tag":321,"props":998,"children":999},{},[1000,1004],{"type":32,"tag":41,"props":1001,"children":1002},{},[1003],{"type":45,"value":662},{"type":45,"value":1005}," \"Each framework shows whether it is tracked, at which version, and when tracking began.\" The tracking history is itself audit evidence for a SOC 2 Type 2 period.",{"type":32,"tag":321,"props":1007,"children":1008},{},[1009,1013,1015,1020],{"type":32,"tag":41,"props":1010,"children":1011},{},[1012],{"type":45,"value":662},{"type":45,"value":1014}," \"Untracked frameworks stay browsable. Their coverage reads as what ",{"type":32,"tag":745,"props":1016,"children":1017},{},[1018],{"type":45,"value":1019},"would",{"type":45,"value":1021}," be covered, using the same counts.\"",{"type":32,"tag":321,"props":1023,"children":1024},{},[1025,1029,1031,1037,1039,1045],{"type":32,"tag":41,"props":1026,"children":1027},{},[1028],{"type":45,"value":662},{"type":45,"value":1030}," \"No single compliance percentage.\" Counts by coverage state only. A percentage reads as a compliance claim, which the guardrails at ",{"type":32,"tag":55,"props":1032,"children":1034},{"className":1033},[],[1035],{"type":45,"value":1036},":235",{"type":45,"value":1038}," and ",{"type":32,"tag":55,"props":1040,"children":1042},{"className":1041},[],[1043],{"type":45,"value":1044},"observe_view-a-framework-details.md:335",{"type":45,"value":1046}," rule out. This is c114 S5.4, still unruled.",{"type":32,"tag":496,"props":1048,"children":1050},{"id":1049},"example-164197",[1051,1053,1059],{"type":45,"value":1052},"Example (",{"type":32,"tag":55,"props":1054,"children":1056},{"className":1055},[],[1057],{"type":45,"value":1058},":164–197",{"type":45,"value":599},{"type":32,"tag":503,"props":1061,"children":1062},{},[1063,1094],{"type":32,"tag":321,"props":1064,"children":1065},{},[1066,1076,1078,1084,1086,1092],{"type":32,"tag":41,"props":1067,"children":1068},{},[1069,1070],{"type":45,"value":561},{"type":32,"tag":55,"props":1071,"children":1073},{"className":1072},[],[1074],{"type":45,"value":1075},":166–193",{"type":45,"value":1077},", with one note at ",{"type":32,"tag":55,"props":1079,"children":1081},{"className":1080},[],[1082],{"type":45,"value":1083},":168–172",{"type":45,"value":1085},": OWASP published a 2026 edition on 2026-08-03. LLM02 is still Sensitive Information Disclosure there, so the example holds, but Excessive Agency moved from LLM06 to LLM03. Requirement ids should carry the edition, as ",{"type":32,"tag":55,"props":1087,"children":1089},{"className":1088},[],[1090],{"type":45,"value":1091},"LLM02:2025",{"type":45,"value":1093}," already does.",{"type":32,"tag":321,"props":1095,"children":1096},{},[1097,1107],{"type":32,"tag":41,"props":1098,"children":1099},{},[1100,1101],{"type":45,"value":513},{"type":32,"tag":55,"props":1102,"children":1104},{"className":1103},[],[1105],{"type":45,"value":1106},":195",{"type":45,"value":1108}," \"If enforcement is enabled for the Policy, Qcontrol may sanitize…\" → \"If the policy's effective mode for that person is Enforce, and the published configuration has reached their endpoint, Qcontrol sanitizes the value before transmission. The resulting finding's outcome is Enforced (c121 D16).\"",{"type":32,"tag":496,"props":1110,"children":1112},{"id":1111},"severity-override-example-199217",[1113,1115,1121],{"type":45,"value":1114},"Severity Override Example (",{"type":32,"tag":55,"props":1116,"children":1118},{"className":1117},[],[1119],{"type":45,"value":1120},":199–217",{"type":45,"value":599},{"type":32,"tag":503,"props":1123,"children":1124},{},[1125],{"type":32,"tag":321,"props":1126,"children":1127},{},[1128,1132,1134,1140,1141,1146],{"type":32,"tag":41,"props":1129,"children":1130},{},[1131],{"type":45,"value":478},{"type":45,"value":1133}," the whole section to the configure intent, or strike it. Its content is already there at ",{"type":32,"tag":55,"props":1135,"children":1137},{"className":1136},[],[1138],{"type":45,"value":1139},":27",{"type":45,"value":1038},{"type":32,"tag":55,"props":1142,"children":1144},{"className":1143},[],[1145],{"type":45,"value":551},{"type":45,"value":62},{"type":32,"tag":496,"props":1148,"children":1150},{"id":1149},"non-goals-219230",[1151,1153,1159],{"type":45,"value":1152},"Non-Goals (",{"type":32,"tag":55,"props":1154,"children":1156},{"className":1155},[],[1157],{"type":45,"value":1158},":219–230",{"type":45,"value":599},{"type":32,"tag":503,"props":1161,"children":1162},{},[1163,1178,1193],{"type":32,"tag":321,"props":1164,"children":1165},{},[1166,1176],{"type":32,"tag":41,"props":1167,"children":1168},{},[1169,1170],{"type":45,"value":610},{"type":32,"tag":55,"props":1171,"children":1173},{"className":1172},[],[1174],{"type":45,"value":1175},":224",{"type":45,"value":1177}," \"Defining Policy Group creation and scope assignment\". The objects no longer exist.",{"type":32,"tag":321,"props":1179,"children":1180},{},[1181,1191],{"type":32,"tag":41,"props":1182,"children":1183},{},[1184,1185],{"type":45,"value":513},{"type":32,"tag":55,"props":1186,"children":1188},{"className":1187},[],[1189],{"type":45,"value":1190},":226",{"type":45,"value":1192}," \"Defining Framework activation or configuration workflows\" → \"Defining framework tracking (see Track a Framework)\".",{"type":32,"tag":321,"props":1194,"children":1195},{},[1196,1206,1208,1212],{"type":32,"tag":41,"props":1197,"children":1198},{},[1199,1200],{"type":45,"value":561},{"type":32,"tag":55,"props":1201,"children":1203},{"className":1202},[],[1204],{"type":45,"value":1205},":230",{"type":45,"value":1207},", \"compliance reporting or certification claims\". ",{"type":32,"tag":41,"props":1209,"children":1210},{},[1211],{"type":45,"value":662},{"type":45,"value":1213}," \"Auditor evidence packages are a Report-stage intent, which does not exist yet\" (c114 G5).",{"type":32,"tag":496,"props":1215,"children":1217},{"id":1216},"constraints-232243",[1218,1220,1226],{"type":45,"value":1219},"Constraints (",{"type":32,"tag":55,"props":1221,"children":1223},{"className":1222},[],[1224],{"type":45,"value":1225},":232–243",{"type":45,"value":599},{"type":32,"tag":503,"props":1228,"children":1229},{},[1230,1258,1273,1288],{"type":32,"tag":321,"props":1231,"children":1232},{},[1233,1243,1244,1250,1251,1257],{"type":32,"tag":41,"props":1234,"children":1235},{},[1236,1237],{"type":45,"value":561},{"type":32,"tag":55,"props":1238,"children":1240},{"className":1239},[],[1241],{"type":45,"value":1242},":234–237",{"type":45,"value":193},{"type":32,"tag":55,"props":1245,"children":1247},{"className":1246},[],[1248],{"type":45,"value":1249},":240",{"type":45,"value":1038},{"type":32,"tag":55,"props":1252,"children":1254},{"className":1253},[],[1255],{"type":45,"value":1256},":242–243",{"type":45,"value":62},{"type":32,"tag":321,"props":1259,"children":1260},{},[1261,1271],{"type":32,"tag":41,"props":1262,"children":1263},{},[1264,1265],{"type":45,"value":529},{"type":32,"tag":55,"props":1266,"children":1268},{"className":1267},[],[1269],{"type":45,"value":1270},":238–239",{"type":45,"value":1272}," (severity reset; overrides don't change the canonical policy) to the configure intent.",{"type":32,"tag":321,"props":1274,"children":1275},{},[1276,1280,1282,1287],{"type":32,"tag":41,"props":1277,"children":1278},{},[1279],{"type":45,"value":662},{"type":45,"value":1281}," \"Tracking a framework never claims compliance and never sets a mode without showing it first\" (restating ",{"type":32,"tag":55,"props":1283,"children":1285},{"className":1284},[],[1286],{"type":45,"value":307},{"type":45,"value":553},{"type":32,"tag":321,"props":1289,"children":1290},{},[1291,1295],{"type":32,"tag":41,"props":1292,"children":1293},{},[1294],{"type":45,"value":662},{"type":45,"value":1296}," \"Mappings carry provenance: who mapped them, against which framework version, and when reviewed.\" In the Oct 12 session you said \"we need to somehow map it to the frameworks and be correct\".",{"type":32,"tag":496,"props":1298,"children":1300},{"id":1299},"open-questions-245261",[1301,1303,1309],{"type":45,"value":1302},"Open Questions (",{"type":32,"tag":55,"props":1304,"children":1306},{"className":1305},[],[1307],{"type":45,"value":1308},":245–261",{"type":45,"value":599},{"type":32,"tag":138,"props":1311,"children":1312},{},[1313,1334],{"type":32,"tag":142,"props":1314,"children":1315},{},[1316],{"type":32,"tag":146,"props":1317,"children":1318},{},[1319,1324,1329],{"type":32,"tag":150,"props":1320,"children":1321},{},[1322],{"type":45,"value":1323},"Line",{"type":32,"tag":150,"props":1325,"children":1326},{},[1327],{"type":45,"value":1328},"Question",{"type":32,"tag":150,"props":1330,"children":1331},{},[1332],{"type":45,"value":1333},"Status now",{"type":32,"tag":166,"props":1335,"children":1336},{},[1337,1359,1380,1414,1454,1476,1511,1537,1567,1589,1618,1650,1672,1702],{"type":32,"tag":146,"props":1338,"children":1339},{},[1340,1349,1354],{"type":32,"tag":173,"props":1341,"children":1342},{},[1343],{"type":32,"tag":55,"props":1344,"children":1346},{"className":1345},[],[1347],{"type":45,"value":1348},":247",{"type":32,"tag":173,"props":1350,"children":1351},{},[1352],{"type":45,"value":1353},"What sets Qpoint's recommended severity?",{"type":32,"tag":173,"props":1355,"children":1356},{},[1357],{"type":45,"value":1358},"Open. Belongs to the configure intent.",{"type":32,"tag":146,"props":1360,"children":1361},{},[1362,1371,1376],{"type":32,"tag":173,"props":1363,"children":1364},{},[1365],{"type":32,"tag":55,"props":1366,"children":1368},{"className":1367},[],[1369],{"type":45,"value":1370},":248",{"type":32,"tag":173,"props":1372,"children":1373},{},[1374],{"type":45,"value":1375},"Does finding severity always inherit?",{"type":32,"tag":173,"props":1377,"children":1378},{},[1379],{"type":45,"value":1358},{"type":32,"tag":146,"props":1381,"children":1382},{},[1383,1392,1397],{"type":32,"tag":173,"props":1384,"children":1385},{},[1386],{"type":32,"tag":55,"props":1387,"children":1389},{"className":1388},[],[1390],{"type":45,"value":1391},":249",{"type":32,"tag":173,"props":1393,"children":1394},{},[1395],{"type":45,"value":1396},"Severity overrides scoped by group or team?",{"type":32,"tag":173,"props":1398,"children":1399},{},[1400,1405,1407,1413],{"type":32,"tag":41,"props":1401,"children":1402},{},[1403],{"type":45,"value":1404},"Answered.",{"type":45,"value":1406}," Exceptions override mode, not severity (",{"type":32,"tag":55,"props":1408,"children":1410},{"className":1409},[],[1411],{"type":45,"value":1412},"enforce_configure-policies-and-exceptions.md:31",{"type":45,"value":553},{"type":32,"tag":146,"props":1415,"children":1416},{},[1417,1426,1431],{"type":32,"tag":173,"props":1418,"children":1419},{},[1420],{"type":32,"tag":55,"props":1421,"children":1423},{"className":1422},[],[1424],{"type":45,"value":1425},":250",{"type":32,"tag":173,"props":1427,"children":1428},{},[1429],{"type":45,"value":1430},"Policy states beyond active\u002Finactive?",{"type":32,"tag":173,"props":1432,"children":1433},{},[1434,1438,1440,1446,1447,1453],{"type":32,"tag":41,"props":1435,"children":1436},{},[1437],{"type":45,"value":1404},{"type":45,"value":1439}," Off · Observe · Enforce, with Until (",{"type":32,"tag":55,"props":1441,"children":1443},{"className":1442},[],[1444],{"type":45,"value":1445},":28",{"type":45,"value":193},{"type":32,"tag":55,"props":1448,"children":1450},{"className":1449},[],[1451],{"type":45,"value":1452},":30",{"type":45,"value":553},{"type":32,"tag":146,"props":1455,"children":1456},{},[1457,1466,1471],{"type":32,"tag":173,"props":1458,"children":1459},{},[1460],{"type":32,"tag":55,"props":1461,"children":1463},{"className":1462},[],[1464],{"type":45,"value":1465},":251",{"type":32,"tag":173,"props":1467,"children":1468},{},[1469],{"type":45,"value":1470},"What makes a requirement fully \u002F partially \u002F not addressable?",{"type":32,"tag":173,"props":1472,"children":1473},{},[1474],{"type":45,"value":1475},"Open. §3 below proposes an answer.",{"type":32,"tag":146,"props":1477,"children":1478},{},[1479,1488,1493],{"type":32,"tag":173,"props":1480,"children":1481},{},[1482],{"type":32,"tag":55,"props":1483,"children":1485},{"className":1484},[],[1486],{"type":45,"value":1487},":252",{"type":32,"tag":173,"props":1489,"children":1490},{},[1491],{"type":45,"value":1492},"Does activation only track, or also activate recommended policies?",{"type":32,"tag":173,"props":1494,"children":1495},{},[1496,1501,1503,1509],{"type":32,"tag":41,"props":1497,"children":1498},{},[1499],{"type":45,"value":1500},"Answered in the room, not yet in writing.",{"type":45,"value":1502}," A6 and Q10: tracking brings mapped policies in at Observe. This needs reconciling with ",{"type":32,"tag":55,"props":1504,"children":1506},{"className":1505},[],[1507],{"type":45,"value":1508},":51",{"type":45,"value":1510}," of the configure intent (\"not… silently chooses an enforcement mode\"). Our suggestion is a preview before the change is staged (c118 L6b).",{"type":32,"tag":146,"props":1512,"children":1513},{},[1514,1523,1528],{"type":32,"tag":173,"props":1515,"children":1516},{},[1517],{"type":32,"tag":55,"props":1518,"children":1520},{"className":1519},[],[1521],{"type":45,"value":1522},":253–254",{"type":32,"tag":173,"props":1524,"children":1525},{},[1526],{"type":45,"value":1527},"Policy Groups: administrative or scope? Overlap resolution?",{"type":32,"tag":173,"props":1529,"children":1530},{},[1531,1535],{"type":32,"tag":41,"props":1532,"children":1533},{},[1534],{"type":45,"value":1404},{"type":45,"value":1536}," No managed groups. Overlap: narrowest wins, and ties go to the stricter mode (c121 D15).",{"type":32,"tag":146,"props":1538,"children":1539},{},[1540,1549,1554],{"type":32,"tag":173,"props":1541,"children":1542},{},[1543],{"type":32,"tag":55,"props":1544,"children":1546},{"className":1545},[],[1547],{"type":45,"value":1548},":255",{"type":32,"tag":173,"props":1550,"children":1551},{},[1552],{"type":45,"value":1553},"Do requirements expose findings, or only coverage?",{"type":32,"tag":173,"props":1555,"children":1556},{},[1557,1559,1565],{"type":45,"value":1558},"Open. Suggest both: counts by outcome, linking to Findings filtered ",{"type":32,"tag":55,"props":1560,"children":1562},{"className":1561},[],[1563],{"type":45,"value":1564},"?fw=",{"type":45,"value":1566}," (c121).",{"type":32,"tag":146,"props":1568,"children":1569},{},[1570,1579,1584],{"type":32,"tag":173,"props":1571,"children":1572},{},[1573],{"type":32,"tag":55,"props":1574,"children":1576},{"className":1575},[],[1577],{"type":45,"value":1578},":256",{"type":32,"tag":173,"props":1580,"children":1581},{},[1582],{"type":45,"value":1583},"Versioning when a framework publishes a new revision",{"type":32,"tag":173,"props":1585,"children":1586},{},[1587],{"type":45,"value":1588},"Open, and urgent. OWASP 2026 and AIUC-1's quarterly releases. §3 has a suggestion.",{"type":32,"tag":146,"props":1590,"children":1591},{},[1592,1601,1606],{"type":32,"tag":173,"props":1593,"children":1594},{},[1595],{"type":32,"tag":55,"props":1596,"children":1598},{"className":1597},[],[1599],{"type":45,"value":1600},":257",{"type":32,"tag":173,"props":1602,"children":1603},{},[1604],{"type":45,"value":1605},"Versioning when Qpoint changes a policy's logic",{"type":32,"tag":173,"props":1607,"children":1608},{},[1609,1611,1616],{"type":45,"value":1610},"Partly answered. Policy Config versions are whole-file integers (c121 D2). A policy's ",{"type":32,"tag":745,"props":1612,"children":1613},{},[1614],{"type":45,"value":1615},"logic",{"type":45,"value":1617}," version is still open.",{"type":32,"tag":146,"props":1619,"children":1620},{},[1621,1630,1635],{"type":32,"tag":173,"props":1622,"children":1623},{},[1624],{"type":32,"tag":55,"props":1625,"children":1627},{"className":1626},[],[1628],{"type":45,"value":1629},":258",{"type":32,"tag":173,"props":1631,"children":1632},{},[1633],{"type":45,"value":1634},"Open finding counts in the Policies view?",{"type":32,"tag":173,"props":1636,"children":1637},{},[1638,1642,1644,1649],{"type":32,"tag":41,"props":1639,"children":1640},{},[1641],{"type":45,"value":1404},{"type":45,"value":1643}," The policy header shows open findings (",{"type":32,"tag":55,"props":1645,"children":1647},{"className":1646},[],[1648],{"type":45,"value":543},{"type":45,"value":553},{"type":32,"tag":146,"props":1651,"children":1652},{},[1653,1662,1667],{"type":32,"tag":173,"props":1654,"children":1655},{},[1656],{"type":32,"tag":55,"props":1657,"children":1659},{"className":1658},[],[1660],{"type":45,"value":1661},":259",{"type":32,"tag":173,"props":1663,"children":1664},{},[1665],{"type":45,"value":1666},"Enforcement capability shown separately from monitoring?",{"type":32,"tag":173,"props":1668,"children":1669},{},[1670],{"type":45,"value":1671},"Open. §3 suggests Enforced vs Observed as coverage states.",{"type":32,"tag":146,"props":1673,"children":1674},{},[1675,1684,1689],{"type":32,"tag":173,"props":1676,"children":1677},{},[1678],{"type":32,"tag":55,"props":1679,"children":1681},{"className":1680},[],[1682],{"type":45,"value":1683},":260",{"type":32,"tag":173,"props":1685,"children":1686},{},[1687],{"type":45,"value":1688},"Customer-defined policies mapped into frameworks?",{"type":32,"tag":173,"props":1690,"children":1691},{},[1692,1694,1700],{"type":45,"value":1693},"Open. Custom authoring is a non-goal (",{"type":32,"tag":55,"props":1695,"children":1697},{"className":1696},[],[1698],{"type":45,"value":1699},"enforce_configure-policies-and-exceptions.md:43",{"type":45,"value":1701},"), so this can wait.",{"type":32,"tag":146,"props":1703,"children":1704},{},[1705,1714,1719],{"type":32,"tag":173,"props":1706,"children":1707},{},[1708],{"type":32,"tag":55,"props":1709,"children":1711},{"className":1710},[],[1712],{"type":45,"value":1713},":261",{"type":32,"tag":173,"props":1715,"children":1716},{},[1717],{"type":45,"value":1718},"Toxic combinations",{"type":32,"tag":173,"props":1720,"children":1721},{},[1722],{"type":45,"value":1723},"Open, and out of scope here.",{"type":32,"tag":37,"props":1725,"children":1726},{},[1727,1731],{"type":32,"tag":41,"props":1728,"children":1729},{},[1730],{"type":45,"value":485},{"type":45,"value":1732}," questions:",{"type":32,"tag":503,"props":1734,"children":1735},{},[1736,1741,1753],{"type":32,"tag":321,"props":1737,"children":1738},{},[1739],{"type":45,"value":1740},"Can a requirement map to an evidence source (inventory, log retention, export) as well as a policy?",{"type":32,"tag":321,"props":1742,"children":1743},{},[1744,1746,1751],{"type":45,"value":1745},"Is the fit stored per mapping, for example \"P-PROVIDERS ",{"type":32,"tag":745,"props":1747,"children":1748},{},[1749],{"type":45,"value":1750},"partially",{"type":45,"value":1752}," supports SOC 2 CC9.2\"? c65 stored ok\u002Fpartial per policy × framework; the c114 fixture dropped it.",{"type":32,"tag":321,"props":1754,"children":1755},{},[1756,1758,1764],{"type":45,"value":1757},"What is the minimum v1 catalog and mapping set? This is the configure intent's ",{"type":32,"tag":55,"props":1759,"children":1761},{"className":1760},[],[1762],{"type":45,"value":1763},":58",{"type":45,"value":1765},", and the question for today.",{"type":32,"tag":496,"props":1767,"children":1769},{"id":1768},"related-263321",[1770,1772,1778],{"type":45,"value":1771},"Related (",{"type":32,"tag":55,"props":1773,"children":1775},{"className":1774},[],[1776],{"type":45,"value":1777},":263–321",{"type":45,"value":599},{"type":32,"tag":503,"props":1780,"children":1781},{},[1782,1797,1818],{"type":32,"tag":321,"props":1783,"children":1784},{},[1785,1795],{"type":32,"tag":41,"props":1786,"children":1787},{},[1788,1789],{"type":45,"value":513},{"type":32,"tag":55,"props":1790,"children":1792},{"className":1791},[],[1793],{"type":45,"value":1794},":272–275",{"type":45,"value":1796}," journey with \"Track a Framework · Configure Policies and Exceptions · Publish Policy Configuration\".",{"type":32,"tag":321,"props":1798,"children":1799},{},[1800,1810,1812,1816],{"type":32,"tag":41,"props":1801,"children":1802},{},[1803,1804],{"type":45,"value":610},{"type":32,"tag":55,"props":1805,"children":1807},{"className":1806},[],[1808],{"type":45,"value":1809},":292",{"type":45,"value":1811}," Policy Group. ",{"type":32,"tag":41,"props":1813,"children":1814},{},[1815],{"type":45,"value":485},{"type":45,"value":1817}," Policy Exception, Policy Configuration Version and Evidence source.",{"type":32,"tag":321,"props":1819,"children":1820},{},[1821,1831],{"type":32,"tag":41,"props":1822,"children":1823},{},[1824,1825],{"type":45,"value":513},{"type":32,"tag":55,"props":1826,"children":1828},{"className":1827},[],[1829],{"type":45,"value":1830},":316–321",{"type":45,"value":1832}," downstream: strike \"Manage Policy Groups\", \"Configure Policy Scope\" and \"Enable \u002F Disable Policy Enforcement\", all superseded per c121's housekeeping item 8. Keep \"View a Framework's Details\". Add \"Track a Framework\" and \"Configure Policies and Exceptions\".",{"type":32,"tag":433,"props":1834,"children":1835},{},[],{"type":32,"tag":437,"props":1837,"children":1839},{"id":1838},"_2-observe_view-a-framework-detailsmd",[1840,1842],{"type":45,"value":1841},"2. ",{"type":32,"tag":55,"props":1843,"children":1845},{"className":1844},[],[1846],{"type":45,"value":110},{"type":32,"tag":496,"props":1848,"children":1850},{"id":1849},"tldr-38",[1851,1853,1859],{"type":45,"value":1852},"TL;DR (",{"type":32,"tag":55,"props":1854,"children":1856},{"className":1855},[],[1857],{"type":45,"value":1858},":3–8",{"type":45,"value":599},{"type":32,"tag":503,"props":1861,"children":1862},{},[1863,1885],{"type":32,"tag":321,"props":1864,"children":1865},{},[1866,1876,1878,1883],{"type":32,"tag":41,"props":1867,"children":1868},{},[1869,1870],{"type":45,"value":513},{"type":32,"tag":55,"props":1871,"children":1873},{"className":1872},[],[1874],{"type":45,"value":1875},":6",{"type":45,"value":1877}," → \"Each Framework requirement can map to one or more Qpoint Policies ",{"type":32,"tag":41,"props":1879,"children":1880},{},[1881],{"type":45,"value":1882},"or evidence sources",{"type":45,"value":1884},"…\"",{"type":32,"tag":321,"props":1886,"children":1887},{},[1888,1897],{"type":32,"tag":41,"props":1889,"children":1890},{},[1891,1892],{"type":45,"value":513},{"type":32,"tag":55,"props":1893,"children":1895},{"className":1894},[],[1896],{"type":45,"value":567},{"type":45,"value":1898}," \"configuring individual Policies, Scope, severity, Exceptions, or enforcement is handled downstream\" → \"configuring a policy's mode, severity or exceptions, and tracking the framework, are handled downstream.\"",{"type":32,"tag":496,"props":1900,"children":1902},{"id":1901},"desired-outcome-4163",[1903,1904,1910],{"type":45,"value":591},{"type":32,"tag":55,"props":1905,"children":1907},{"className":1906},[],[1908],{"type":45,"value":1909},":41–63",{"type":45,"value":599},{"type":32,"tag":503,"props":1912,"children":1913},{},[1914,2089,2104,2119,2134],{"type":32,"tag":321,"props":1915,"children":1916},{},[1917,1927,1929,1934,1936],{"type":32,"tag":41,"props":1918,"children":1919},{},[1920,1921],{"type":45,"value":513},{"type":32,"tag":55,"props":1922,"children":1924},{"className":1923},[],[1925],{"type":45,"value":1926},":48",{"type":45,"value":1928}," (formal standard, compliance framework, control framework or risk taxonomy) with a closed list of ",{"type":32,"tag":41,"props":1930,"children":1931},{},[1932],{"type":45,"value":1933},"kinds",{"type":45,"value":1935},", each saying how it should read:",{"type":32,"tag":138,"props":1937,"children":1938},{},[1939,1960],{"type":32,"tag":142,"props":1940,"children":1941},{},[1942],{"type":32,"tag":146,"props":1943,"children":1944},{},[1945,1950,1955],{"type":32,"tag":150,"props":1946,"children":1947},{},[1948],{"type":45,"value":1949},"Kind",{"type":32,"tag":150,"props":1951,"children":1952},{},[1953],{"type":45,"value":1954},"v1 \u002F later examples",{"type":32,"tag":150,"props":1956,"children":1957},{},[1958],{"type":45,"value":1959},"Coverage reads as",{"type":32,"tag":166,"props":1961,"children":1962},{},[1963,1981,1999,2017,2035,2053,2071],{"type":32,"tag":146,"props":1964,"children":1965},{},[1966,1971,1976],{"type":32,"tag":173,"props":1967,"children":1968},{},[1969],{"type":45,"value":1970},"Risk taxonomy",{"type":32,"tag":173,"props":1972,"children":1973},{},[1974],{"type":45,"value":1975},"OWASP LLM Top 10, OWASP Agentic Top 10",{"type":32,"tag":173,"props":1977,"children":1978},{},[1979],{"type":45,"value":1980},"Threat coverage: which risks we watch, which we stop",{"type":32,"tag":146,"props":1982,"children":1983},{},[1984,1989,1994],{"type":32,"tag":173,"props":1985,"children":1986},{},[1987],{"type":45,"value":1988},"Risk-management framework",{"type":32,"tag":173,"props":1990,"children":1991},{},[1992],{"type":45,"value":1993},"NIST AI RMF (+ AI 600-1)",{"type":32,"tag":173,"props":1995,"children":1996},{},[1997],{"type":45,"value":1998},"Evidence completeness by function",{"type":32,"tag":146,"props":2000,"children":2001},{},[2002,2007,2012],{"type":32,"tag":173,"props":2003,"children":2004},{},[2005],{"type":45,"value":2006},"Attestation criteria",{"type":32,"tag":173,"props":2008,"children":2009},{},[2010],{"type":45,"value":2011},"SOC 2 TSC",{"type":32,"tag":173,"props":2013,"children":2014},{},[2015],{"type":45,"value":2016},"Audit readiness over a period",{"type":32,"tag":146,"props":2018,"children":2019},{},[2020,2025,2030],{"type":32,"tag":173,"props":2021,"children":2022},{},[2023],{"type":45,"value":2024},"Controls matrix",{"type":32,"tag":173,"props":2026,"children":2027},{},[2028],{"type":45,"value":2029},"CSA AICM",{"type":32,"tag":173,"props":2031,"children":2032},{},[2033],{"type":45,"value":2034},"Controls by shared-responsibility role (AI Customer)",{"type":32,"tag":146,"props":2036,"children":2037},{},[2038,2043,2048],{"type":32,"tag":173,"props":2039,"children":2040},{},[2041],{"type":45,"value":2042},"Certification",{"type":32,"tag":173,"props":2044,"children":2045},{},[2046],{"type":45,"value":2047},"AIUC-1",{"type":32,"tag":173,"props":2049,"children":2050},{},[2051],{"type":45,"value":2052},"Vendor assurance; for most customers, due diligence on vendors",{"type":32,"tag":146,"props":2054,"children":2055},{},[2056,2061,2066],{"type":32,"tag":173,"props":2057,"children":2058},{},[2059],{"type":45,"value":2060},"Certifiable management standard",{"type":32,"tag":173,"props":2062,"children":2063},{},[2064],{"type":45,"value":2065},"ISO\u002FIEC 42001, ISO\u002FIEC 27001",{"type":32,"tag":173,"props":2067,"children":2068},{},[2069],{"type":45,"value":2070},"Statement-of-applicability style: controls and the records that show them operating",{"type":32,"tag":146,"props":2072,"children":2073},{},[2074,2079,2084],{"type":32,"tag":173,"props":2075,"children":2076},{},[2077],{"type":45,"value":2078},"Law",{"type":32,"tag":173,"props":2080,"children":2081},{},[2082],{"type":45,"value":2083},"EU AI Act, EU CRA",{"type":32,"tag":173,"props":2085,"children":2086},{},[2087],{"type":45,"value":2088},"Exposure and dates",{"type":32,"tag":321,"props":2090,"children":2091},{},[2092,2102],{"type":32,"tag":41,"props":2093,"children":2094},{},[2095,2096],{"type":45,"value":513},{"type":32,"tag":55,"props":2097,"children":2099},{"className":2098},[],[2100],{"type":45,"value":2101},":51–58",{"type":45,"value":2103}," (supports observation \u002F enforcement \u002F both; fully \u002F partially \u002F not addressable) with the four states in §3.",{"type":32,"tag":321,"props":2105,"children":2106},{},[2107,2117],{"type":32,"tag":41,"props":2108,"children":2109},{},[2110,2111],{"type":45,"value":513},{"type":32,"tag":55,"props":2112,"children":2114},{"className":2113},[],[2115],{"type":45,"value":2116},":60",{"type":45,"value":2118}," \"Which mapped Policies are currently applicable\" → \"each mapped policy's effective mode: the default, any exceptions, whether it's published, and how many endpoints have confirmed it\".",{"type":32,"tag":321,"props":2120,"children":2121},{},[2122,2132],{"type":32,"tag":41,"props":2123,"children":2124},{},[2125,2126],{"type":45,"value":513},{"type":32,"tag":55,"props":2127,"children":2129},{"className":2128},[],[2130],{"type":45,"value":2131},":61",{"type":45,"value":2133}," \"Which mapped Policies have Open Findings\" → \"open findings through each mapped policy, split by outcome. Observed findings are counted, though Findings hides them by default (c121 D3).\"",{"type":32,"tag":321,"props":2135,"children":2136},{},[2137,2141],{"type":32,"tag":41,"props":2138,"children":2139},{},[2140],{"type":45,"value":662},{"type":45,"value":2142}," \"What lies outside Qpoint for this framework, with who usually owns it (HR, legal, the model provider).\"",{"type":32,"tag":496,"props":2144,"children":2146},{"id":2145},"context-and-framework-model-65126",[2147,2149,2155],{"type":45,"value":2148},"Context and Framework Model (",{"type":32,"tag":55,"props":2150,"children":2152},{"className":2151},[],[2153],{"type":45,"value":2154},":65–126",{"type":45,"value":599},{"type":32,"tag":503,"props":2157,"children":2158},{},[2159,2188],{"type":32,"tag":321,"props":2160,"children":2161},{},[2162,2172,2173,2179,2181,2187],{"type":32,"tag":41,"props":2163,"children":2164},{},[2165,2166],{"type":45,"value":561},{"type":32,"tag":55,"props":2167,"children":2169},{"className":2168},[],[2170],{"type":45,"value":2171},":81–101",{"type":45,"value":1038},{"type":32,"tag":55,"props":2174,"children":2176},{"className":2175},[],[2177],{"type":45,"value":2178},":105–126",{"type":45,"value":2180},". Preserving source terminology is right, and the c114 fixture already does it with ",{"type":32,"tag":55,"props":2182,"children":2184},{"className":2183},[],[2185],{"type":45,"value":2186},"sourceTerm",{"type":45,"value":62},{"type":32,"tag":321,"props":2189,"children":2190},{},[2191,2201,2203],{"type":32,"tag":41,"props":2192,"children":2193},{},[2194,2195],{"type":45,"value":513},{"type":32,"tag":55,"props":2196,"children":2198},{"className":2197},[],[2199],{"type":45,"value":2200},":98–101",{"type":45,"value":2202},", the chain, with:\n",{"type":32,"tag":33,"props":2204,"children":2205},{},[2206],{"type":32,"tag":37,"props":2207,"children":2208},{},[2209,2211,2216],{"type":45,"value":2210},"Framework (kind, version) → Requirement (source term) ↔ Qpoint Policy ",{"type":32,"tag":41,"props":2212,"children":2213},{},[2214],{"type":45,"value":2215},"or evidence source",{"type":45,"value":2217}," (with fit: full or partial) → Policy evaluation → Finding (outcome: Enforced or Observed)",{"type":32,"tag":496,"props":2219,"children":2221},{"id":2220},"policy-mapping-model-128150",[2222,2224,2230],{"type":45,"value":2223},"Policy Mapping Model (",{"type":32,"tag":55,"props":2225,"children":2227},{"className":2226},[],[2228],{"type":45,"value":2229},":128–150",{"type":45,"value":599},{"type":32,"tag":503,"props":2232,"children":2233},{},[2234,2243,2260],{"type":32,"tag":321,"props":2235,"children":2236},{},[2237,2241],{"type":32,"tag":41,"props":2238,"children":2239},{},[2240],{"type":45,"value":492},{"type":45,"value":2242}," the many-to-many model.",{"type":32,"tag":321,"props":2244,"children":2245},{},[2246,2250,2252,2258],{"type":32,"tag":41,"props":2247,"children":2248},{},[2249],{"type":45,"value":485},{"type":45,"value":2251}," fit per mapping. \"Detect sensitive information\" may fully support LLM02 while \"Block prohibited data classes\" partially supports SOC 2 CC9.2. A requirement's coverage is derived from its best mapping and that mapping's effective mode, not from the bare existence of a mapped policy. Today the c114 fixture's ",{"type":32,"tag":55,"props":2253,"children":2255},{"className":2254},[],[2256],{"type":45,"value":2257},"coverage()",{"type":45,"value":2259}," reads \"a policy exists → fully\". That overstates coverage.",{"type":32,"tag":321,"props":2261,"children":2262},{},[2263,2267],{"type":32,"tag":41,"props":2264,"children":2265},{},[2266],{"type":45,"value":485},{"type":45,"value":2268}," evidence sources as mapping targets, with examples: AI inventory → NIST GV 1.6, ISO 27001 5.9, ISO 42001 A.4.2; log retention ≥ 6 months → EU AI Act Art. 26(6), AIUC-1 E015.",{"type":32,"tag":496,"props":2270,"children":2272},{"id":2271},"expected-behavior-152187",[2273,2274,2280],{"type":45,"value":883},{"type":32,"tag":55,"props":2275,"children":2277},{"className":2276},[],[2278],{"type":45,"value":2279},":152–187",{"type":45,"value":599},{"type":32,"tag":503,"props":2282,"children":2283},{},[2284,2307,2323,2373,2388,2411,2420,2437],{"type":32,"tag":321,"props":2285,"children":2286},{},[2287,2297,2299,2305],{"type":32,"tag":41,"props":2288,"children":2289},{},[2290,2291],{"type":45,"value":561},{"type":32,"tag":55,"props":2292,"children":2294},{"className":2293},[],[2295],{"type":45,"value":2296},":154–175",{"type":45,"value":2298},", except that ",{"type":32,"tag":55,"props":2300,"children":2302},{"className":2301},[],[2303],{"type":45,"value":2304},":172–175",{"type":45,"value":2306}," takes the §3 states.",{"type":32,"tag":321,"props":2308,"children":2309},{},[2310,2321],{"type":32,"tag":41,"props":2311,"children":2312},{},[2313,2315],{"type":45,"value":2314},"Amend ",{"type":32,"tag":55,"props":2316,"children":2318},{"className":2317},[],[2319],{"type":45,"value":2320},":176",{"type":45,"value":2322}," \"Coverage is derived from mapped QPoint capabilities rather than manually asserted\" → keep the sentence and add \"…including evidence sources. Coverage is never asserted by hand.\"",{"type":32,"tag":321,"props":2324,"children":2325},{},[2326,2336,2338],{"type":32,"tag":41,"props":2327,"children":2328},{},[2329,2330],{"type":45,"value":513},{"type":32,"tag":55,"props":2331,"children":2333},{"className":2332},[],[2334],{"type":45,"value":2335},":177–180",{"type":45,"value":2337},", the three-way distinction, with four:\n",{"type":32,"tag":33,"props":2339,"children":2340},{},[2341],{"type":32,"tag":37,"props":2342,"children":2343},{},[2344,2346,2351,2353,2358,2360,2365,2367,2372],{"type":45,"value":2345},"The practitioner can distinguish Qpoint ",{"type":32,"tag":41,"props":2347,"children":2348},{},[2349],{"type":45,"value":2350},"capability",{"type":45,"value":2352},", organization ",{"type":32,"tag":41,"props":2354,"children":2355},{},[2356],{"type":45,"value":2357},"configuration",{"type":45,"value":2359}," (mode after exceptions, in the published version), ",{"type":32,"tag":41,"props":2361,"children":2362},{},[2363],{"type":45,"value":2364},"confirmed reach",{"type":45,"value":2366}," (endpoints running that version, c121 D11), and current ",{"type":32,"tag":41,"props":2368,"children":2369},{},[2370],{"type":45,"value":2371},"findings",{"type":45,"value":62},{"type":32,"tag":321,"props":2374,"children":2375},{},[2376,2386],{"type":32,"tag":41,"props":2377,"children":2378},{},[2379,2380],{"type":45,"value":513},{"type":32,"tag":55,"props":2381,"children":2383},{"className":2382},[],[2384],{"type":45,"value":2385},":181",{"type":45,"value":2387}," \"applicable or configured\" → \"effective mode and confirmed reach\".",{"type":32,"tag":321,"props":2389,"children":2390},{},[2391,2402,2403,2409],{"type":32,"tag":41,"props":2392,"children":2393},{},[2394,2395,2401],{"type":45,"value":561},{"type":32,"tag":55,"props":2396,"children":2398},{"className":2397},[],[2399],{"type":45,"value":2400},":183–187",{"type":45,"value":62},{"type":45,"value":374},{"type":32,"tag":55,"props":2404,"children":2406},{"className":2405},[],[2407],{"type":45,"value":2408},":187",{"type":45,"value":2410},", \"useful even if the organization has not enabled every mapped Policy\", is the untracked preview, and worth keeping word for word.",{"type":32,"tag":321,"props":2412,"children":2413},{},[2414,2418],{"type":32,"tag":41,"props":2415,"children":2416},{},[2417],{"type":45,"value":662},{"type":45,"value":2419}," \"The framework shows its tracked version. A newer edition shows as available and is never applied silently.\"",{"type":32,"tag":321,"props":2421,"children":2422},{},[2423,2427,2429,2435],{"type":32,"tag":41,"props":2424,"children":2425},{},[2426],{"type":45,"value":662},{"type":45,"value":2428}," \"Requirements filter by coverage state.\" This answers ",{"type":32,"tag":55,"props":2430,"children":2432},{"className":2431},[],[2433],{"type":45,"value":2434},":366",{"type":45,"value":2436}," yes.",{"type":32,"tag":321,"props":2438,"children":2439},{},[2440,2444],{"type":32,"tag":41,"props":2441,"children":2442},{},[2443],{"type":45,"value":662},{"type":45,"value":2445}," \"Counts by coverage state, no percentage.\"",{"type":32,"tag":496,"props":2447,"children":2449},{"id":2448},"example-owasp-189231",[2450,2452,2458],{"type":45,"value":2451},"Example: OWASP (",{"type":32,"tag":55,"props":2453,"children":2455},{"className":2454},[],[2456],{"type":45,"value":2457},":189–231",{"type":45,"value":599},{"type":32,"tag":503,"props":2460,"children":2461},{},[2462,2499,2514],{"type":32,"tag":321,"props":2463,"children":2464},{},[2465,2476,2478],{"type":32,"tag":41,"props":2466,"children":2467},{},[2468,2469,2475],{"type":45,"value":513},{"type":32,"tag":55,"props":2470,"children":2472},{"className":2471},[],[2473],{"type":45,"value":2474},":214–218",{"type":45,"value":62},{"type":45,"value":2477}," \"In Scope \u002F Observe\" and \"In Scope \u002F Observe + Enforce\" are no longer states. Suggested:\n",{"type":32,"tag":33,"props":2479,"children":2480},{},[2481,2486],{"type":32,"tag":37,"props":2482,"children":2483},{},[2484],{"type":45,"value":2485},"Organization state:",{"type":32,"tag":503,"props":2487,"children":2488},{},[2489,2494],{"type":32,"tag":321,"props":2490,"children":2491},{},[2492],{"type":45,"value":2493},"Sensitive Information Detection: Observe (organization default)",{"type":32,"tag":321,"props":2495,"children":2496},{},[2497],{"type":45,"value":2498},"Sensitive Information Sanitization: Observe, with Enforce for Finance (exception, until Dec 15); published in Policy Config v14, confirmed on 97 of 100 endpoints",{"type":32,"tag":321,"props":2500,"children":2501},{},[2502,2512],{"type":32,"tag":41,"props":2503,"children":2504},{},[2505,2506],{"type":45,"value":513},{"type":32,"tag":55,"props":2507,"children":2509},{"className":2508},[],[2510],{"type":45,"value":2511},":220–223",{"type":45,"value":2513}," \"Open: 4 \u002F Resolved: 12\" → \"Open: 4 (Observed 3 · Enforced 1) · Resolved: 12\".",{"type":32,"tag":321,"props":2515,"children":2516},{},[2517,2521],{"type":32,"tag":41,"props":2518,"children":2519},{},[2520],{"type":45,"value":485},{"type":45,"value":2522}," under the \"practitioner understands\" list: \"Findings from Finance are Enforced (blocked); elsewhere they are Observed.\"",{"type":32,"tag":496,"props":2524,"children":2526},{"id":2525},"example-partial-coverage-example-coverage-gap-233272",[2527,2529,2535],{"type":45,"value":2528},"Example: Partial Coverage, Example: Coverage Gap (",{"type":32,"tag":55,"props":2530,"children":2532},{"className":2531},[],[2533],{"type":45,"value":2534},":233–272",{"type":45,"value":599},{"type":32,"tag":503,"props":2537,"children":2538},{},[2539,2548,2572],{"type":32,"tag":321,"props":2540,"children":2541},{},[2542,2546],{"type":32,"tag":41,"props":2543,"children":2544},{},[2545],{"type":45,"value":492},{"type":45,"value":2547}," both. They are the clearest statement of the honesty rule.",{"type":32,"tag":321,"props":2549,"children":2550},{},[2551,2555,2557,2562,2564],{"type":32,"tag":41,"props":2552,"children":2553},{},[2554],{"type":45,"value":485},{"type":45,"value":2556}," a third example, ",{"type":32,"tag":41,"props":2558,"children":2559},{},[2560],{"type":45,"value":2561},"Evidence without a policy",{"type":45,"value":2563},":\n",{"type":32,"tag":33,"props":2565,"children":2566},{},[2567],{"type":32,"tag":37,"props":2568,"children":2569},{},[2570],{"type":45,"value":2571},"Requirement: NIST AI RMF GOVERN 1.6, \"Mechanisms are in place to inventory AI systems.\"\nMapped: AI inventory (evidence source). No policy.\nCoverage: Evidenced. Qpoint's inventory is the mechanism, kept continuously, with first-seen and last-seen per provider, model, harness and MCP server.",{"type":32,"tag":321,"props":2573,"children":2574},{},[2575,2579,2581,2587],{"type":32,"tag":41,"props":2576,"children":2577},{},[2578],{"type":45,"value":485},{"type":45,"value":2580}," to the gap example (",{"type":32,"tag":55,"props":2582,"children":2584},{"className":2583},[],[2585],{"type":45,"value":2586},":270–272",{"type":45,"value":2588},"): \"The requirement shows who usually owns it outside Qpoint.\"",{"type":32,"tag":496,"props":2590,"children":2592},{"id":2591},"relationship-to-enforcement-289309",[2593,2595,2601],{"type":45,"value":2594},"Relationship to Enforcement (",{"type":32,"tag":55,"props":2596,"children":2598},{"className":2597},[],[2599],{"type":45,"value":2600},":289–309",{"type":45,"value":599},{"type":32,"tag":503,"props":2603,"children":2604},{},[2605],{"type":32,"tag":321,"props":2606,"children":2607},{},[2608,2618],{"type":32,"tag":41,"props":2609,"children":2610},{},[2611,2612],{"type":45,"value":513},{"type":32,"tag":55,"props":2613,"children":2615},{"className":2614},[],[2616],{"type":45,"value":2617},":305",{"type":45,"value":2619}," \"If enforcement is enabled for that Policy and Scope\" → \"If the policy's effective mode is Enforce for that person, in a published version their endpoint has confirmed\".",{"type":32,"tag":496,"props":2621,"children":2623},{"id":2622},"non-goals-311327",[2624,2625,2631],{"type":45,"value":1152},{"type":32,"tag":55,"props":2626,"children":2628},{"className":2627},[],[2629],{"type":45,"value":2630},":311–327",{"type":45,"value":599},{"type":32,"tag":503,"props":2633,"children":2634},{},[2635,2661,2676,2691],{"type":32,"tag":321,"props":2636,"children":2637},{},[2638,2648,2650,2659],{"type":32,"tag":41,"props":2639,"children":2640},{},[2641,2642],{"type":45,"value":610},{"type":32,"tag":55,"props":2643,"children":2645},{"className":2644},[],[2646],{"type":45,"value":2647},":315",{"type":45,"value":2649}," \"Defining Policy Scope\" and ",{"type":32,"tag":41,"props":2651,"children":2652},{},[2653],{"type":32,"tag":55,"props":2654,"children":2656},{"className":2655},[],[2657],{"type":45,"value":2658},":317",{"type":45,"value":2660}," \"Defining Policy Group management\". The objects no longer exist.",{"type":32,"tag":321,"props":2662,"children":2663},{},[2664,2674],{"type":32,"tag":41,"props":2665,"children":2666},{},[2667,2668],{"type":45,"value":513},{"type":32,"tag":55,"props":2669,"children":2671},{"className":2670},[],[2672],{"type":45,"value":2673},":318",{"type":45,"value":2675}," \"Defining Exceptions\" → \"Defining exceptions (see Configure Policies and Exceptions)\".",{"type":32,"tag":321,"props":2677,"children":2678},{},[2679,2689],{"type":32,"tag":41,"props":2680,"children":2681},{},[2682,2683],{"type":45,"value":561},{"type":32,"tag":55,"props":2684,"children":2686},{"className":2685},[],[2687],{"type":45,"value":2688},":323",{"type":45,"value":2690}," \"evidence packages for auditors\", and name the gap: there is no Report-stage intent yet (c114 G5). SOC 2 auditors will test a Qpoint export as information produced by the entity: the full population, a fixed period, a reproducible query and the policy version in force at each event. That belongs in the Report intent, when someone writes it.",{"type":32,"tag":321,"props":2692,"children":2693},{},[2694,2704],{"type":32,"tag":41,"props":2695,"children":2696},{},[2697,2698],{"type":45,"value":561},{"type":32,"tag":55,"props":2699,"children":2701},{"className":2700},[],[2702],{"type":45,"value":2703},":327",{"type":45,"value":2705}," \"third-party Framework content licensing\". It needs an owner soon, though, if AICM's crosswalks become our mapping source.",{"type":32,"tag":496,"props":2707,"children":2709},{"id":2708},"constraints-329343",[2710,2711,2717],{"type":45,"value":1219},{"type":32,"tag":55,"props":2712,"children":2714},{"className":2713},[],[2715],{"type":45,"value":2716},":329–343",{"type":45,"value":599},{"type":32,"tag":503,"props":2719,"children":2720},{},[2721,2760,2769,2778],{"type":32,"tag":321,"props":2722,"children":2723},{},[2724,2729,2730,2736,2738,2744,2746,2751,2753,2758],{"type":32,"tag":41,"props":2725,"children":2726},{},[2727],{"type":45,"value":2728},"Keep all thirteen.",{"type":45,"value":374},{"type":32,"tag":55,"props":2731,"children":2733},{"className":2732},[],[2734],{"type":45,"value":2735},":341",{"type":45,"value":2737}," (versioning never rewrites history), ",{"type":32,"tag":55,"props":2739,"children":2741},{"className":2740},[],[2742],{"type":45,"value":2743},":342",{"type":45,"value":2745}," (unsupported requirements stay visible) and ",{"type":32,"tag":55,"props":2747,"children":2749},{"className":2748},[],[2750],{"type":45,"value":424},{"type":45,"value":2752}," (taxonomies not presented as equivalent to standards) are exactly right, and the kind table above puts ",{"type":32,"tag":55,"props":2754,"children":2756},{"className":2755},[],[2757],{"type":45,"value":424},{"type":45,"value":2759}," into practice.",{"type":32,"tag":321,"props":2761,"children":2762},{},[2763,2767],{"type":32,"tag":41,"props":2764,"children":2765},{},[2766],{"type":45,"value":662},{"type":45,"value":2768}," \"Coverage is computed against the tracked framework version.\"",{"type":32,"tag":321,"props":2770,"children":2771},{},[2772,2776],{"type":32,"tag":41,"props":2773,"children":2774},{},[2775],{"type":45,"value":662},{"type":45,"value":2777}," \"Every mapping records its fit (full or partial) and its provenance.\"",{"type":32,"tag":321,"props":2779,"children":2780},{},[2781,2785],{"type":32,"tag":41,"props":2782,"children":2783},{},[2784],{"type":45,"value":662},{"type":45,"value":2786}," \"Requirements outside Qpoint are listed and never counted toward coverage.\" This is c65's honesty rule.",{"type":32,"tag":496,"props":2788,"children":2790},{"id":2789},"open-questions-345376",[2791,2792,2798],{"type":45,"value":1302},{"type":32,"tag":55,"props":2793,"children":2795},{"className":2794},[],[2796],{"type":45,"value":2797},":345–376",{"type":45,"value":599},{"type":32,"tag":138,"props":2800,"children":2801},{},[2802,2821],{"type":32,"tag":142,"props":2803,"children":2804},{},[2805],{"type":32,"tag":146,"props":2806,"children":2807},{},[2808,2812,2816],{"type":32,"tag":150,"props":2809,"children":2810},{},[2811],{"type":45,"value":1323},{"type":32,"tag":150,"props":2813,"children":2814},{},[2815],{"type":45,"value":1328},{"type":32,"tag":150,"props":2817,"children":2818},{},[2819],{"type":45,"value":2820},"Suggestion",{"type":32,"tag":166,"props":2822,"children":2823},{},[2824,2846,2868,2890,2912,2934,2962,2984,3006,3061,3082,3104,3126,3148,3175,3197],{"type":32,"tag":146,"props":2825,"children":2826},{},[2827,2836,2841],{"type":32,"tag":173,"props":2828,"children":2829},{},[2830],{"type":32,"tag":55,"props":2831,"children":2833},{"className":2832},[],[2834],{"type":45,"value":2835},":347",{"type":32,"tag":173,"props":2837,"children":2838},{},[2839],{"type":45,"value":2840},"What metadata above the fold?",{"type":32,"tag":173,"props":2842,"children":2843},{},[2844],{"type":45,"value":2845},"Name, kind, version (with \"newer edition available\"), publisher, tracked since, counts by state.",{"type":32,"tag":146,"props":2847,"children":2848},{},[2849,2858,2863],{"type":32,"tag":173,"props":2850,"children":2851},{},[2852],{"type":32,"tag":55,"props":2853,"children":2855},{"className":2854},[],[2856],{"type":45,"value":2857},":348–352",{"type":32,"tag":173,"props":2859,"children":2860},{},[2861],{"type":45,"value":2862},"Expose a type?",{"type":32,"tag":173,"props":2864,"children":2865},{},[2866],{"type":45,"value":2867},"Yes. Use the kind table in §2.",{"type":32,"tag":146,"props":2869,"children":2870},{},[2871,2880,2885],{"type":32,"tag":173,"props":2872,"children":2873},{},[2874],{"type":32,"tag":55,"props":2875,"children":2877},{"className":2876},[],[2878],{"type":45,"value":2879},":353",{"type":32,"tag":173,"props":2881,"children":2882},{},[2883],{"type":45,"value":2884},"Fully vs partially addressable?",{"type":32,"tag":173,"props":2886,"children":2887},{},[2888],{"type":45,"value":2889},"§3.",{"type":32,"tag":146,"props":2891,"children":2892},{},[2893,2902,2907],{"type":32,"tag":173,"props":2894,"children":2895},{},[2896],{"type":32,"tag":55,"props":2897,"children":2899},{"className":2898},[],[2900],{"type":45,"value":2901},":354–357",{"type":32,"tag":173,"props":2903,"children":2904},{},[2905],{"type":45,"value":2906},"Distinguish supports \u002F configured \u002F enforced?",{"type":32,"tag":173,"props":2908,"children":2909},{},[2910],{"type":45,"value":2911},"Yes, four ways: capability, configuration, confirmed reach, findings.",{"type":32,"tag":146,"props":2913,"children":2914},{},[2915,2924,2929],{"type":32,"tag":173,"props":2916,"children":2917},{},[2918],{"type":32,"tag":55,"props":2919,"children":2921},{"className":2920},[],[2922],{"type":45,"value":2923},":358",{"type":32,"tag":173,"props":2925,"children":2926},{},[2927],{"type":45,"value":2928},"Percentage, count or states?",{"type":32,"tag":173,"props":2930,"children":2931},{},[2932],{"type":45,"value":2933},"Counts and states only.",{"type":32,"tag":146,"props":2935,"children":2936},{},[2937,2946,2951],{"type":32,"tag":173,"props":2938,"children":2939},{},[2940],{"type":32,"tag":55,"props":2941,"children":2943},{"className":2942},[],[2944],{"type":45,"value":2945},":359",{"type":32,"tag":173,"props":2947,"children":2948},{},[2949],{"type":45,"value":2950},"Open finding counts per requirement?",{"type":32,"tag":173,"props":2952,"children":2953},{},[2954,2956,2961],{"type":45,"value":2955},"Yes, split by outcome, linking to Findings ",{"type":32,"tag":55,"props":2957,"children":2959},{"className":2958},[],[2960],{"type":45,"value":1564},{"type":45,"value":62},{"type":32,"tag":146,"props":2963,"children":2964},{},[2965,2974,2979],{"type":32,"tag":173,"props":2966,"children":2967},{},[2968],{"type":32,"tag":55,"props":2969,"children":2971},{"className":2970},[],[2972],{"type":45,"value":2973},":360",{"type":32,"tag":173,"props":2975,"children":2976},{},[2977],{"type":45,"value":2978},"Show mapped policies' severity?",{"type":32,"tag":173,"props":2980,"children":2981},{},[2982],{"type":45,"value":2983},"Yes, organization severity, as the policy header does.",{"type":32,"tag":146,"props":2985,"children":2986},{},[2987,2996,3001],{"type":32,"tag":173,"props":2988,"children":2989},{},[2990],{"type":32,"tag":55,"props":2991,"children":2993},{"className":2992},[],[2994],{"type":45,"value":2995},":361",{"type":32,"tag":173,"props":2997,"children":2998},{},[2999],{"type":45,"value":3000},"Show observation and enforcement states?",{"type":32,"tag":173,"props":3002,"children":3003},{},[3004],{"type":45,"value":3005},"Yes. Effective mode, with exceptions summarized.",{"type":32,"tag":146,"props":3007,"children":3008},{},[3009,3018,3023],{"type":32,"tag":173,"props":3010,"children":3011},{},[3012],{"type":32,"tag":55,"props":3013,"children":3015},{"className":3014},[],[3016],{"type":45,"value":3017},":362–365",{"type":32,"tag":173,"props":3019,"children":3020},{},[3021],{"type":45,"value":3022},"Gap reasons: no policy \u002F not in Scope \u002F observed not enforced",{"type":32,"tag":173,"props":3024,"children":3025},{},[3026,3028,3033,3035,3040,3042,3047,3048,3053,3054,3059],{"type":45,"value":3027},"Reword for the model: ",{"type":32,"tag":41,"props":3029,"children":3030},{},[3031],{"type":45,"value":3032},"no policy",{"type":45,"value":3034}," · ",{"type":32,"tag":41,"props":3036,"children":3037},{},[3038],{"type":45,"value":3039},"policy Off",{"type":45,"value":3041}," (or Off for some, by exception) · ",{"type":32,"tag":41,"props":3043,"children":3044},{},[3045],{"type":45,"value":3046},"Observe only",{"type":45,"value":3034},{"type":32,"tag":41,"props":3049,"children":3050},{},[3051],{"type":45,"value":3052},"not yet confirmed on endpoints",{"type":45,"value":3034},{"type":32,"tag":41,"props":3055,"children":3056},{},[3057],{"type":45,"value":3058},"outside Qpoint",{"type":45,"value":3060},". \"Not in Scope\" goes.",{"type":32,"tag":146,"props":3062,"children":3063},{},[3064,3072,3077],{"type":32,"tag":173,"props":3065,"children":3066},{},[3067],{"type":32,"tag":55,"props":3068,"children":3070},{"className":3069},[],[3071],{"type":45,"value":2434},{"type":32,"tag":173,"props":3073,"children":3074},{},[3075],{"type":45,"value":3076},"Filter by coverage state?",{"type":32,"tag":173,"props":3078,"children":3079},{},[3080],{"type":45,"value":3081},"Yes.",{"type":32,"tag":146,"props":3083,"children":3084},{},[3085,3094,3099],{"type":32,"tag":173,"props":3086,"children":3087},{},[3088],{"type":32,"tag":55,"props":3089,"children":3091},{"className":3090},[],[3092],{"type":45,"value":3093},":367–368",{"type":32,"tag":173,"props":3095,"children":3096},{},[3097],{"type":45,"value":3098},"Many-to-many effect on coverage",{"type":32,"tag":173,"props":3100,"children":3101},{},[3102],{"type":45,"value":3103},"Per requirement, take the strongest mapping in effect. One policy counts once for each requirement it supports.",{"type":32,"tag":146,"props":3105,"children":3106},{},[3107,3116,3121],{"type":32,"tag":173,"props":3108,"children":3109},{},[3110],{"type":32,"tag":55,"props":3111,"children":3113},{"className":3112},[],[3114],{"type":45,"value":3115},":369–370",{"type":32,"tag":173,"props":3117,"children":3118},{},[3119],{"type":45,"value":3120},"External version changes; prior versions viewable?",{"type":32,"tag":173,"props":3122,"children":3123},{},[3124],{"type":45,"value":3125},"Tracking pins a version. A new edition shows as available, with a diff of moved and renamed ids. Prior versions stay viewable read-only, along with the findings stamped against them.",{"type":32,"tag":146,"props":3127,"children":3128},{},[3129,3138,3143],{"type":32,"tag":173,"props":3130,"children":3131},{},[3132],{"type":32,"tag":55,"props":3133,"children":3135},{"className":3134},[],[3136],{"type":45,"value":3137},":371",{"type":32,"tag":173,"props":3139,"children":3140},{},[3141],{"type":45,"value":3142},"New Qpoint policy relevant to an existing framework",{"type":32,"tag":173,"props":3144,"children":3145},{},[3146],{"type":45,"value":3147},"It shows on the framework as a new mapping. For tracked frameworks, it arrives at Observe through the same preview as tracking.",{"type":32,"tag":146,"props":3149,"children":3150},{},[3151,3160,3165],{"type":32,"tag":173,"props":3152,"children":3153},{},[3154],{"type":32,"tag":55,"props":3155,"children":3157},{"className":3156},[],[3158],{"type":45,"value":3159},":372–373",{"type":32,"tag":173,"props":3161,"children":3162},{},[3163],{"type":45,"value":3164},"Track without changing policy configuration? Separate workflow?",{"type":32,"tag":173,"props":3166,"children":3167},{},[3168,3173],{"type":32,"tag":41,"props":3169,"children":3170},{},[3171],{"type":45,"value":3172},"Answered in the room",{"type":45,"value":3174}," by A6 and Q10: tracking brings policies in at Observe. We suggest a separate short intent, Track a Framework, with a preview before staging.",{"type":32,"tag":146,"props":3176,"children":3177},{},[3178,3187,3192],{"type":32,"tag":173,"props":3179,"children":3180},{},[3181],{"type":32,"tag":55,"props":3182,"children":3184},{"className":3183},[],[3185],{"type":45,"value":3186},":374",{"type":32,"tag":173,"props":3188,"children":3189},{},[3190],{"type":45,"value":3191},"Customer-authored mappings",{"type":32,"tag":173,"props":3193,"children":3194},{},[3195],{"type":45,"value":3196},"Later.",{"type":32,"tag":146,"props":3198,"children":3199},{},[3200,3209,3214],{"type":32,"tag":173,"props":3201,"children":3202},{},[3203],{"type":32,"tag":55,"props":3204,"children":3206},{"className":3205},[],[3207],{"type":45,"value":3208},":375–376",{"type":32,"tag":173,"props":3210,"children":3211},{},[3212],{"type":45,"value":3213},"Non-technical and procedural requirements",{"type":32,"tag":173,"props":3215,"children":3216},{},[3217,3219,3224],{"type":45,"value":3218},"Coverage state ",{"type":32,"tag":41,"props":3220,"children":3221},{},[3222],{"type":45,"value":3223},"Outside",{"type":45,"value":3225},", listed and never counted, with the usual owner.",{"type":32,"tag":496,"props":3227,"children":3229},{"id":3228},"related-378425",[3230,3231,3237],{"type":45,"value":1771},{"type":32,"tag":55,"props":3232,"children":3234},{"className":3233},[],[3235],{"type":45,"value":3236},":378–425",{"type":45,"value":599},{"type":32,"tag":503,"props":3239,"children":3240},{},[3241,3256,3271],{"type":32,"tag":321,"props":3242,"children":3243},{},[3244,3254],{"type":32,"tag":41,"props":3245,"children":3246},{},[3247,3248],{"type":45,"value":513},{"type":32,"tag":55,"props":3249,"children":3251},{"className":3250},[],[3252],{"type":45,"value":3253},":405–407",{"type":45,"value":3255}," objects: strike Scope, Policy Group and Enforcement State. Add Mode, Policy Exception, Policy Configuration Version, Evidence source and Framework Version.",{"type":32,"tag":321,"props":3257,"children":3258},{},[3259,3269],{"type":32,"tag":41,"props":3260,"children":3261},{},[3262,3263],{"type":45,"value":513},{"type":32,"tag":55,"props":3264,"children":3266},{"className":3265},[],[3267],{"type":45,"value":3268},":420–421",{"type":45,"value":3270}," related intents: strike \"Configure Policy Scope\" and \"Enable \u002F Disable Policy Enforcement\". Add \"Configure Policies and Exceptions\", \"Track a Framework\" and \"Publish Policy Configuration\".",{"type":32,"tag":321,"props":3272,"children":3273},{},[3274,3284],{"type":32,"tag":41,"props":3275,"children":3276},{},[3277,3278],{"type":45,"value":513},{"type":32,"tag":55,"props":3279,"children":3281},{"className":3280},[],[3282],{"type":45,"value":3283},":423–425",{"type":45,"value":3285}," downstream \"TBD\" → \"Track a Framework · View All Findings (filtered by framework) · (future) Report: Framework evidence\".",{"type":32,"tag":433,"props":3287,"children":3288},{},[],{"type":32,"tag":437,"props":3290,"children":3292},{"id":3291},"_3-a-proposal-for-coverage-states",[3293],{"type":45,"value":15},{"type":32,"tag":37,"props":3295,"children":3296},{},[3297,3299,3305],{"type":45,"value":3298},"The intents ask for at least fully \u002F partially \u002F not currently addressable (",{"type":32,"tag":55,"props":3300,"children":3302},{"className":3301},[],[3303],{"type":45,"value":3304},"observe_view-a-framework-details.md:172–175",{"type":45,"value":3306},"). We suggest four states. Each is derived from a requirement's strongest mapping and that mapping's effective mode:",{"type":32,"tag":138,"props":3308,"children":3309},{},[3310,3336],{"type":32,"tag":142,"props":3311,"children":3312},{},[3313],{"type":32,"tag":146,"props":3314,"children":3315},{},[3316,3321,3326,3331],{"type":32,"tag":150,"props":3317,"children":3318},{},[3319],{"type":45,"value":3320},"State",{"type":32,"tag":150,"props":3322,"children":3323},{},[3324],{"type":45,"value":3325},"Meaning",{"type":32,"tag":150,"props":3327,"children":3328},{},[3329],{"type":45,"value":3330},"Derived when",{"type":32,"tag":150,"props":3332,"children":3333},{},[3334],{"type":45,"value":3335},"Maps to the intent's",{"type":32,"tag":166,"props":3337,"children":3338},{},[3339,3365,3391,3416],{"type":32,"tag":146,"props":3340,"children":3341},{},[3342,3350,3355,3360],{"type":32,"tag":173,"props":3343,"children":3344},{},[3345],{"type":32,"tag":41,"props":3346,"children":3347},{},[3348],{"type":45,"value":3349},"Enforced",{"type":32,"tag":173,"props":3351,"children":3352},{},[3353],{"type":45,"value":3354},"A policy can stop it, and does",{"type":32,"tag":173,"props":3356,"children":3357},{},[3358],{"type":45,"value":3359},"A full-fit policy is in Enforce for the population in question, published and confirmed",{"type":32,"tag":173,"props":3361,"children":3362},{},[3363],{"type":45,"value":3364},"Fully addressable",{"type":32,"tag":146,"props":3366,"children":3367},{},[3368,3376,3381,3386],{"type":32,"tag":173,"props":3369,"children":3370},{},[3371],{"type":32,"tag":41,"props":3372,"children":3373},{},[3374],{"type":45,"value":3375},"Observed",{"type":32,"tag":173,"props":3377,"children":3378},{},[3379],{"type":45,"value":3380},"A policy watches it and raises findings, without blocking. Or Qpoint can only detect it.",{"type":32,"tag":173,"props":3382,"children":3383},{},[3384],{"type":45,"value":3385},"A mapped policy is in Observe, or its capability is detect-only",{"type":32,"tag":173,"props":3387,"children":3388},{},[3389],{"type":45,"value":3390},"Partially addressable",{"type":32,"tag":146,"props":3392,"children":3393},{},[3394,3402,3407,3412],{"type":32,"tag":173,"props":3395,"children":3396},{},[3397],{"type":32,"tag":41,"props":3398,"children":3399},{},[3400],{"type":45,"value":3401},"Evidenced",{"type":32,"tag":173,"props":3403,"children":3404},{},[3405],{"type":45,"value":3406},"Qpoint data supports a human process, with no policy involved",{"type":32,"tag":173,"props":3408,"children":3409},{},[3410],{"type":45,"value":3411},"Only evidence sources map: inventory, log retention, exports",{"type":32,"tag":173,"props":3413,"children":3414},{},[3415],{"type":45,"value":3390},{"type":32,"tag":146,"props":3417,"children":3418},{},[3419,3426,3431,3436],{"type":32,"tag":173,"props":3420,"children":3421},{},[3422],{"type":32,"tag":41,"props":3423,"children":3424},{},[3425],{"type":45,"value":3223},{"type":32,"tag":173,"props":3427,"children":3428},{},[3429],{"type":45,"value":3430},"No network or endpoint observation reaches it",{"type":32,"tag":173,"props":3432,"children":3433},{},[3434],{"type":45,"value":3435},"Nothing maps. It is listed with its usual owner and never counted.",{"type":32,"tag":173,"props":3437,"children":3438},{},[3439],{"type":45,"value":3440},"Not currently addressable",{"type":32,"tag":37,"props":3442,"children":3443},{},[3444],{"type":45,"value":3445},"Two details matter for correctness:",{"type":32,"tag":503,"props":3447,"children":3448},{},[3449,3459],{"type":32,"tag":321,"props":3450,"children":3451},{},[3452,3457],{"type":32,"tag":41,"props":3453,"children":3454},{},[3455],{"type":45,"value":3456},"Partial fit caps the state.",{"type":45,"value":3458}," A partial-fit policy in Enforce reads Observed, because Qpoint stops part of the risk, not all of it. P12 Prompt Inspection is the c65 example: it is never \"ok\".",{"type":32,"tag":321,"props":3460,"children":3461},{},[3462,3467,3469,3475],{"type":32,"tag":41,"props":3463,"children":3464},{},[3465],{"type":45,"value":3466},"Mixed modes summarize by count, not by blend.",{"type":45,"value":3468}," If the default is Observe and Finance has Enforce, the requirement reads Observed, with a note: \"Enforced for Finance (12 people)\". The team page already reads this way (",{"type":32,"tag":55,"props":3470,"children":3472},{"className":3471},[],[3473],{"type":45,"value":3474},"observe_review-team-policy-posture.md:25",{"type":45,"value":553},{"type":32,"tag":37,"props":3477,"children":3478},{},[3479],{"type":45,"value":3480},"Gap reasons, for the gaps list: no policy · policy Off · Observe only · partial fit · not yet confirmed on endpoints · outside Qpoint.",{"type":32,"tag":433,"props":3482,"children":3483},{},[],{"type":32,"tag":437,"props":3485,"children":3487},{"id":3486},"_4-clean-drafts-in-pr-4-style",[3488],{"type":45,"value":16},{"type":32,"tag":37,"props":3490,"children":3491},{},[3492,3494,3499],{"type":45,"value":3493},"These are suggested replacements, around 80 lines each, matching ",{"type":32,"tag":55,"props":3495,"children":3497},{"className":3496},[],[3498],{"type":45,"value":336},{"type":45,"value":62},{"type":32,"tag":496,"props":3501,"children":3503},{"id":3502},"_41-observe_view-frameworksmd",[3504,3506],{"type":45,"value":3505},"4.1 ",{"type":32,"tag":55,"props":3507,"children":3509},{"className":3508},[],[3510],{"type":45,"value":362},{"type":32,"tag":3512,"props":3513,"children":3519},"pre",{"className":3514,"code":3515,"language":3516,"meta":3517,"style":3518},"language-markdown","# Intent: View Frameworks\n\n## TL;DR\n\nFrameworks are the predefined grouping of Qpoint policies and the starting point for governance. The Frameworks view lists the external frameworks Qpoint maps to, what kind each is, which version the organization tracks, and how many requirements Qpoint enforces, observes, evidences or leaves outside, as counts, never a compliance percentage.\n\n## User \u002F Persona\n\nSecurity practitioner \u002F administrator responsible for AI governance. Secondary: CISO, GRC, compliance, audit.\n\n## Problem\n\nPractitioners work from external frameworks, not product controls. They need to see which frameworks Qpoint supports, what each one means for their organization, and where Qpoint helps and where it can't, before deciding what to track.\n\n## Desired Outcome\n\nSee every supported framework with its kind, publisher and version; see which are tracked and since when; compare coverage across them; open one for detail or start tracking it.\n\n## Context\n\nFrameworks remain the predefined policy grouping (observe_review-team-policy-posture.md). Policies and their configuration live in Configure Policies and Exceptions. Tracking is its own intent, Track a Framework.\n\n## Expected Behavior\n\n- List supported frameworks grouped as tracked and available. Each shows its name, kind, publisher, tracked version (and whether a newer edition exists), and when tracking began.\n- Kind is one of: risk taxonomy, risk-management framework, attestation criteria, controls matrix, certification, certifiable management standard, law. Kind shapes the summary: threat coverage for taxonomies, audit readiness for attestation criteria, exposure and dates for laws.\n- Coverage is shown as counts of requirements by state: Enforced, Observed, Evidenced, Outside. There is no percentage.\n- Coverage is derived from mapped policies' effective mode (published and confirmed on endpoints) and from mapped evidence sources. It is never asserted by hand.\n- Show open findings through mapped policies, split by outcome (Enforced, Observed), linking to Findings filtered by framework.\n- Untracked frameworks stay browsable and show what coverage would be.\n- Selecting a framework opens View a Framework's Details. A policy's header lists its frameworks and links back.\n\n## Non-Goals \u002F Out of Scope\n\n- Policy configuration, severity and exceptions (Configure Policies and Exceptions).\n- Tracking and untracking (Track a Framework).\n- Auditor evidence packages (future Report intent).\n- Custom frameworks, framework import, customer-authored mappings.\n\n## Constraints \u002F Guardrails\n\n- Never imply that tracking or coverage means compliance.\n- Do not present risk taxonomies as equivalent in authority to standards or law.\n- Requirements outside Qpoint are counted as Outside and never hidden.\n- A framework's tracked version is pinned; a new edition never silently replaces it.\n\n## Open Questions\n\n- What is the minimum v1 framework set, and which edition of each? (OWASP LLM 2025 or 2026; whether OWASP Agentic joins v1.)\n- Can requirements map to evidence sources as well as policies?\n- Who reviews mapping correctness, and how is provenance shown?\n\n## Related\n\n### User Journey\n\nObserve → View Frameworks → Track a Framework → Configure Policies and Exceptions → Publish Configuration\n\n### Related Objects\n\nFramework · Framework Version · Requirement · Policy · Evidence source · Finding\n\n### Downstream Intents\n\n- observe_view-a-framework-details.md\n- enforce_track-a-framework.md\n","markdown","","undefined",[3520],{"type":32,"tag":55,"props":3521,"children":3522},{"__ignoreMap":3517},[3523],{"type":45,"value":3515},{"type":32,"tag":496,"props":3525,"children":3527},{"id":3526},"_42-observe_view-a-framework-detailsmd",[3528,3530],{"type":45,"value":3529},"4.2 ",{"type":32,"tag":55,"props":3531,"children":3533},{"className":3532},[],[3534],{"type":45,"value":110},{"type":32,"tag":3512,"props":3536,"children":3538},{"className":3514,"code":3537,"language":3516,"meta":3517,"style":3518},"# Intent: View a Framework's Details\n\n## TL;DR\n\nOne framework, requirement by requirement: what the source says, which Qpoint policies or evidence sources map to it and how well, what the organization has in effect, and what lies outside Qpoint. Informational and evidentiary; configuration happens on the policy, tracking in Track a Framework.\n\n## User \u002F Persona\n\nSecurity practitioner \u002F administrator. Secondary: CISO, GRC, compliance, audit.\n\n## Problem\n\nWithout a framework view, practitioners rebuild mappings by hand and can't tell what Qpoint enforces, what it only watches, what it evidences, and what it can never reach.\n\n## Desired Outcome\n\nUnderstand each requirement's coverage and its reason; navigate to the policy that changes it or the findings that evidence it; know exactly what remains for people and processes outside Qpoint.\n\n## Context\n\nFramework (kind, version) → Requirement (source term) ↔ Policy or evidence source (fit: full or partial) → Policy evaluation → Finding (outcome: Enforced or Observed). Frameworks never generate findings and are never enforced.\n\n## Expected Behavior\n\n- Header: name, kind, publisher, tracked version (newer edition flagged), tracked since, counts by coverage state.\n- Requirements keep source ids and terms (LLM02:2025, CC6.7, A.9.2, Art. 26(6)), and can be filtered by coverage state.\n- Each requirement shows its mappings with fit, each mapped policy's organization severity, its effective mode (default plus exceptions, summarized), and confirmed endpoint reach.\n- Coverage states: Enforced, Observed, Evidenced, Outside. Partial fit caps a requirement at Observed. Mixed modes are summarized with counts (\"Enforced for Finance, 12 people\").\n- Gap reasons: no policy, policy Off, Observe only, partial fit, not yet confirmed on endpoints, outside Qpoint.\n- Outside requirements are listed with their usual owner (HR, legal, model provider) and never counted.\n- Open findings per requirement, split by outcome, linking to Findings filtered by framework.\n- Distinguish capability, configuration, confirmed reach and findings.\n- Prior framework versions are viewable read-only, with the findings stamped against them.\n\n## Non-Goals \u002F Out of Scope\n\n- Editing policy mode, severity or exceptions (Configure Policies and Exceptions).\n- Tracking (Track a Framework).\n- Auditor evidence packages (future Report intent).\n- Licensing and distribution of third-party framework content.\n\n## Constraints \u002F Guardrails\n\n- Mappings never imply Qpoint alone satisfies a requirement unless the fit is full and stated.\n- Monitoring and enforcement stay distinguishable; capability and configuration stay distinguishable.\n- Findings stay attributed to policies, not frameworks.\n- Version updates never rewrite historical mappings or findings.\n- Every mapping records fit and provenance.\n- Taxonomies are not presented as equivalent in authority to standards or law.\n\n## Open Questions\n\n- Is fit stored per mapping, and who sets it?\n- Should a requirement's Evidenced state carry a freshness rule (e.g. inventory updated within 24 hours)?\n- How are moved or renamed requirement ids shown across editions (OWASP LLM06:2025 → LLM03:2026)?\n\n## Related\n\n### Related Objects\n\nFramework · Framework Version · Requirement · Policy · Policy Exception · Evidence source · Policy Configuration Version · Finding\n\n### Upstream Intents\n\n- observe_view-frameworks.md\n\n### Related Intents\n\n- enforce_configure-policies-and-exceptions.md\n- enforce_track-a-framework.md\n- observe_view-all-findings.md\n",[3539],{"type":32,"tag":55,"props":3540,"children":3541},{"__ignoreMap":3517},[3542],{"type":45,"value":3537},{"type":32,"tag":496,"props":3544,"children":3546},{"id":3545},"_43-enforce_track-a-frameworkmd-new-optional",[3547,3549,3554],{"type":45,"value":3548},"4.3 ",{"type":32,"tag":55,"props":3550,"children":3552},{"className":3551},[],[3553],{"type":45,"value":380},{"type":45,"value":3555}," (new, optional)",{"type":32,"tag":3512,"props":3557,"children":3559},{"className":3514,"code":3558,"language":3516,"meta":3517,"style":3518},"# Intent: Track a Framework\n\n## TL;DR\n\nTracking a framework is the starting point for governance (A6). It stages the framework's mapped policies into the shared Policy Config draft at Observe, after a preview of what that changes. The admin backs out with Off or exceptions. Tracking never claims compliance and never sets a mode without showing it.\n\n## User \u002F Persona\n\nSecurity or IT administrator responsible for AI governance.\n\n## Problem\n\n\"Least restrictive while being compliant\": admins want an opinionated starting set of policies for the framework they answer to, and a way to say \"not yet\" to parts of it without losing sight of what they turned down.\n\n## Desired Outcome\n\nPick a framework and edition, see exactly which policies change and what that would have meant recently, stage it, and publish when ready.\n\n## Expected Behavior\n\n- Tracking previews before staging: how many mapped policies come in, at which mode, which are already on (and stay as they are), and, from historical evidence, findings the last 30 days would have raised and on how many endpoints.\n- Policies currently Off move to Observe. Policies already in Observe or Enforce keep their mode. Tracking never moves a policy to Enforce.\n- Tracking is a staged change in the shared draft; publishing is explicit (Publish Policy Configuration).\n- Untracking previews too. It does not turn policies off; it lists policies no other tracked framework maps, so the admin can choose.\n- Tracking pins an edition. Moving to a new edition is its own previewed change showing added, removed and renumbered requirements.\n- The organization's tracking history (what, which edition, when, by whom) is kept as audit evidence.\n\n## Non-Goals \u002F Out of Scope\n\n- Compliance claims, scores or certification.\n- Auto-enforcement on tracking.\n\n## Constraints \u002F Guardrails\n\n- Do not infer that framework selection guarantees compliance or silently chooses an enforcement mode (configure intent, :51).\n- A policy shared by several tracked frameworks is configured once (single canonical policy per concern).\n\n## Open Questions\n\n- Should untracking ever turn policies off, or only list them?\n- Does tracking require a reason, the way loosening does (c121 D1)? Probably not: it only tightens.\n\n## Related\n\n### User Journey\n\nObserve → View Frameworks → Track a Framework → Configure Policies and Exceptions → Publish Configuration\n\n### Related Intents\n\n- observe_view-frameworks.md\n- enforce_configure-policies-and-exceptions.md\n- enforce_publish-policy-configuration.md\n",[3560],{"type":32,"tag":55,"props":3561,"children":3562},{"__ignoreMap":3517},[3563],{"type":45,"value":3558},{"type":32,"tag":433,"props":3565,"children":3566},{},[],{"type":32,"tag":437,"props":3568,"children":3570},{"id":3569},"_5-the-gap-check-what-his-revision-should-settle",[3571],{"type":45,"value":27},{"type":32,"tag":317,"props":3573,"children":3574},{},[3575,3580,3585,3590,3595,3600],{"type":32,"tag":321,"props":3576,"children":3577},{},[3578],{"type":45,"value":3579},"Split the two intents by object (View Frameworks, View a Framework), with Track a Framework as a third short intent, or folded in.",{"type":32,"tag":321,"props":3581,"children":3582},{},[3583],{"type":45,"value":3584},"Evidence sources as mapping targets.",{"type":32,"tag":321,"props":3586,"children":3587},{},[3588],{"type":45,"value":3589},"The four coverage states, with partial fit capping a requirement at Observed.",{"type":32,"tag":321,"props":3591,"children":3592},{},[3593],{"type":45,"value":3594},"Tracking moves Off to Observe only, never to Enforce, and is previewed before it's staged.",{"type":32,"tag":321,"props":3596,"children":3597},{},[3598],{"type":45,"value":3599},"Version pinning, and the v1 edition of each framework.",{"type":32,"tag":321,"props":3601,"children":3602},{},[3603],{"type":45,"value":3604},"Fit and provenance stored on every mapping.",{"type":32,"tag":37,"props":3606,"children":3607},{},[3608,3610,3616,3617,3623,3624,3630,3631,3637],{"type":45,"value":3609},"Housekeeping, as in c121's feedback: when these land, the four superseded intents (",{"type":32,"tag":55,"props":3611,"children":3613},{"className":3612},[],[3614],{"type":45,"value":3615},"enforce_manage-policy-groups.md",{"type":45,"value":193},{"type":32,"tag":55,"props":3618,"children":3620},{"className":3619},[],[3621],{"type":45,"value":3622},"enforce_configure-policy-scope.md",{"type":45,"value":193},{"type":32,"tag":55,"props":3625,"children":3627},{"className":3626},[],[3628],{"type":45,"value":3629},"enforce_enable-disable-policy-enforcement.md",{"type":45,"value":1038},{"type":32,"tag":55,"props":3632,"children":3634},{"className":3633},[],[3635],{"type":45,"value":3636},"enforce_manually-resolve-with-ignore.md",{"type":45,"value":3638},") are the remaining places that still describe Scope and Policy Groups.",{"type":32,"tag":3640,"props":3641,"children":3642},"style",{},[3643],{"type":45,"value":3517},1794599401491]