{
  "version": "1.0.0",
  "mappings": [
    { "id": "MAP-001", "priority": 10, "when": { "all": [] }, "threatId": "THR-AUTHORITY-CONFUSION", "controlId": "CTL-IDENTITY", "requirementLevel": "required", "interruptsStageIds": ["AUTH-1", "AUTH-3"], "rationale": "Every production agent needs an attributable principal before additional capability-specific controls can be assigned.", "sourceIds": ["S03", "S04", "S06"], "claimIds": ["C02", "C12"] },
    { "id": "MAP-002", "priority": 20, "when": { "all": [{ "criterionId": "action_capable_tools", "equals": "yes" }] }, "threatId": "THR-CREDENTIAL-EXPOSURE", "controlId": "CTL-SCOPED-TOKENS", "requirementLevel": "required", "interruptsStageIds": ["CRED-2", "CRED-3"], "rationale": "Action-capable tools turn a reusable or misdirected token into an external side effect.", "sourceIds": ["S05", "S06"], "claimIds": ["C04"] },
    { "id": "MAP-003", "priority": 30, "when": { "all": [{ "criterionId": "action_capable_tools", "equals": "yes" }] }, "threatId": "THR-AUTHORITY-CONFUSION", "controlId": "CTL-POLICY-DECISION", "requirementLevel": "required", "interruptsStageIds": ["AUTH-2"], "rationale": "Tool permission must be decided by deterministic policy rather than model-generated intent.", "sourceIds": ["S03", "S04", "S05"], "claimIds": ["C03"] },
    { "id": "MAP-004", "priority": 40, "when": { "all": [{ "criterionId": "multi_tenancy", "equals": "yes" }] }, "threatId": "THR-CROSS-TENANT", "controlId": "CTL-TENANT-BOUNDARY", "requirementLevel": "required", "interruptsStageIds": ["TEN-1", "TEN-2", "TEN-3"], "rationale": "Shared infrastructure needs an enforced tenant context at every data and action boundary.", "sourceIds": ["S01", "S04", "S06"], "claimIds": ["C02", "C12"] },

    { "id": "MAP-005", "priority": 50, "when": { "all": [{ "criterionId": "untrusted_external_content", "equals": "yes" }] }, "threatId": "THR-INDIRECT-INJECTION", "controlId": "CTL-CONTENT-TRUST", "requirementLevel": "required", "interruptsStageIds": ["INJ-1", "INJ-2"], "rationale": "Untrusted instructions cannot be handled consistently if their origin and trust class disappear during ingestion.", "sourceIds": ["S01", "S03", "S04", "S09"], "claimIds": ["C01", "C02"] },
    { "id": "MAP-006", "priority": 60, "when": { "all": [{ "criterionId": "untrusted_external_content", "equals": "yes" }] }, "threatId": "THR-INDIRECT-INJECTION", "controlId": "CTL-INSTRUCTION-HIERARCHY", "requirementLevel": "required", "interruptsStageIds": ["INJ-2", "INJ-3"], "rationale": "External content must remain data when it conflicts with trusted task instructions.", "sourceIds": ["S01", "S02", "S03", "S04", "S09"], "claimIds": ["C01", "C15"] },
    { "id": "MAP-007", "priority": 70, "when": { "all": [{ "criterionId": "action_capable_tools", "equals": "yes" }] }, "threatId": "THR-TOOL-MISUSE", "controlId": "CTL-OUTPUT-SCHEMA", "requirementLevel": "required", "interruptsStageIds": ["TOOL-2"], "rationale": "A typed boundary rejects malformed or instruction-bearing output before it becomes a tool request.", "sourceIds": ["S03", "S04"], "claimIds": ["C02", "C03"] },
    { "id": "MAP-008", "priority": 80, "when": { "all": [{ "criterionId": "untrusted_external_content", "equals": "yes" }, { "criterionId": "action_capable_tools", "equals": "yes" }] }, "threatId": "THR-INDIRECT-INJECTION", "controlId": "CTL-UNTRUSTED-ISOLATION", "requirementLevel": "required", "interruptsStageIds": ["INJ-3", "INJ-4"], "rationale": "Separating content interpretation from privileged execution removes a direct injection-to-action path.", "sourceIds": ["S01", "S03", "S04"], "claimIds": ["C01", "C02", "C03"] },

    { "id": "MAP-009", "priority": 90, "when": { "all": [{ "criterionId": "action_capable_tools", "equals": "yes" }] }, "threatId": "THR-TOOL-MISUSE", "controlId": "CTL-TOOL-AUTH", "requirementLevel": "required", "interruptsStageIds": ["TOOL-2", "TOOL-3"], "rationale": "Every state-changing invocation needs authorization bound to the exact tool and arguments.", "sourceIds": ["S03", "S04", "S05"], "claimIds": ["C03", "C05"] },
    { "id": "MAP-010", "priority": 100, "when": { "all": [{ "criterionId": "generated_code_execution", "equals": "yes" }] }, "threatId": "THR-CODE-EGRESS", "controlId": "CTL-SANDBOX", "requirementLevel": "required", "interruptsStageIds": ["CODE-2", "CODE-3"], "rationale": "Generated code needs enforced runtime boundaries independent of model instructions.", "sourceIds": ["S01", "S03", "S04", "S08"], "claimIds": ["C06"] },
    { "id": "MAP-011", "priority": 110, "when": { "all": [{ "criterionId": "open_network_egress", "equals": "yes" }] }, "threatId": "THR-CODE-EGRESS", "controlId": "CTL-EGRESS", "requirementLevel": "required", "interruptsStageIds": ["CODE-3", "CODE-4"], "rationale": "Open egress supplies an exfiltration path that a destination-aware broker can interrupt and observe.", "sourceIds": ["S01", "S03", "S04", "S10", "S11"], "claimIds": ["C07", "C16"] },
    { "id": "MAP-012", "priority": 120, "when": { "all": [{ "criterionId": "irreversible_high_impact_actions", "equals": "yes" }] }, "threatId": "THR-TOOL-MISUSE", "controlId": "CTL-IDEMPOTENCY", "requirementLevel": "required", "interruptsStageIds": ["TOOL-4"], "rationale": "High-impact workflows need replay protection and a recovery design before side effects are enabled.", "sourceIds": ["S03", "S04"], "claimIds": ["C05"] },

    { "id": "MAP-013", "priority": 130, "when": { "all": [{ "criterionId": "persistent_memory", "equals": "yes" }] }, "threatId": "THR-MEMORY-POISONING", "controlId": "CTL-MEMORY-AUTH", "requirementLevel": "required", "interruptsStageIds": ["MEM-1", "MEM-3"], "rationale": "Persistent state needs read and write scope that is independent of generated content.", "sourceIds": ["S01", "S03", "S04"], "claimIds": ["C08"] },
    { "id": "MAP-014", "priority": 140, "when": { "all": [{ "criterionId": "persistent_memory", "equals": "yes" }] }, "threatId": "THR-MEMORY-POISONING", "controlId": "CTL-MEMORY-VALIDATION", "requirementLevel": "required", "interruptsStageIds": ["MEM-1", "MEM-2"], "rationale": "Validation, provenance and quarantine prevent candidate memory from silently becoming trusted state.", "sourceIds": ["S01", "S03", "S04"], "claimIds": ["C08", "C09"] },
    { "id": "MAP-015", "priority": 150, "when": { "all": [{ "criterionId": "persistent_memory", "equals": "yes" }] }, "threatId": "THR-MEMORY-POISONING", "controlId": "CTL-MEMORY-LIFECYCLE", "requirementLevel": "recommended", "interruptsStageIds": ["MEM-2", "MEM-3"], "rationale": "Versioning and expiry bound how long a stored item can influence later decisions.", "sourceIds": ["S01", "S03", "S04"], "claimIds": ["C08"] },
    { "id": "MAP-016", "priority": 160, "when": { "all": [{ "criterionId": "persistent_memory", "equals": "yes" }] }, "threatId": "THR-MEMORY-POISONING", "controlId": "CTL-MEMORY-ROLLBACK", "requirementLevel": "recommended", "interruptsStageIds": ["MEM-3", "MEM-4"], "rationale": "Detected poisoned state needs a reversible containment path that retains investigation evidence.", "sourceIds": ["S03", "S04"], "claimIds": ["C09", "C14"] },

    { "id": "MAP-017", "priority": 170, "when": { "all": [{ "criterionId": "third_party_components", "equals": "yes" }] }, "threatId": "THR-SUPPLY-COMPROMISE", "controlId": "CTL-COMPONENT-ALLOWLIST", "requirementLevel": "required", "interruptsStageIds": ["SUP-2", "SUP-3"], "rationale": "A declared allowlist establishes which components and capabilities are eligible for admission.", "sourceIds": ["S03", "S04", "S07", "S08"], "claimIds": ["C10"] },
    { "id": "MAP-018", "priority": 180, "when": { "all": [{ "criterionId": "third_party_components", "equals": "yes" }] }, "threatId": "THR-SUPPLY-COMPROMISE", "controlId": "CTL-INTEGRITY-PROVENANCE", "requirementLevel": "required", "interruptsStageIds": ["SUP-1", "SUP-3"], "rationale": "Digest and provenance checks detect substitution only when verified against trusted expectations and roots.", "sourceIds": ["S07", "S08"], "claimIds": ["C10", "C11"] },
    { "id": "MAP-019", "priority": 190, "when": { "all": [{ "criterionId": "third_party_components", "equals": "yes" }] }, "threatId": "THR-SUPPLY-COMPROMISE", "controlId": "CTL-AIBOM", "requirementLevel": "recommended", "interruptsStageIds": ["SUP-2", "SUP-4"], "rationale": "A release-bound inventory connects a new component finding to affected deployments and accountable owners.", "sourceIds": ["S03", "S04", "S07", "S08"], "claimIds": ["C10"] },
    { "id": "MAP-020", "priority": 200, "when": { "all": [{ "criterionId": "third_party_components", "equals": "yes" }] }, "threatId": "THR-SUPPLY-COMPROMISE", "controlId": "CTL-DEPENDENCY-ADMISSION", "requirementLevel": "required", "interruptsStageIds": ["SUP-2", "SUP-3", "SUP-4"], "rationale": "Admission and revocation turn component evidence into enforceable release and response decisions.", "sourceIds": ["S03", "S04", "S07", "S08"], "claimIds": ["C10", "C11"] },

    { "id": "MAP-021", "priority": 210, "when": { "all": [{ "criterionId": "action_capable_tools", "equals": "yes" }] }, "threatId": "THR-TOOL-MISUSE", "controlId": "CTL-AUDIT", "requirementLevel": "required", "interruptsStageIds": ["TOOL-3", "TOOL-4"], "rationale": "A material tool action must remain attributable to identity, policy, arguments, approval and result.", "sourceIds": ["S03", "S04", "S06"], "claimIds": ["C12"] },
    { "id": "MAP-022", "priority": 220, "when": { "all": [{ "criterionId": "multi_agent_delegation", "equals": "yes" }] }, "threatId": "THR-RUNAWAY-AUTONOMY", "controlId": "CTL-RATE-SPEND", "requirementLevel": "required", "interruptsStageIds": ["RUN-2", "RUN-3"], "rationale": "Delegated task graphs can multiply calls and cost, so hard limits must terminate the chain.", "sourceIds": ["S03", "S04"], "claimIds": ["C13"] },
    { "id": "MAP-023", "priority": 230, "when": { "all": [{ "criterionId": "irreversible_high_impact_actions", "equals": "yes" }] }, "threatId": "THR-RUNAWAY-AUTONOMY", "controlId": "CTL-HUMAN-APPROVAL", "requirementLevel": "required", "interruptsStageIds": ["RUN-3"], "rationale": "A high-impact side effect needs approval bound to the exact operation rather than a general instruction to the agent.", "sourceIds": ["S03", "S04"], "claimIds": ["C05"] },
    { "id": "MAP-024", "priority": 240, "when": { "all": [{ "criterionId": "multi_agent_delegation", "equals": "yes" }] }, "threatId": "THR-RUNAWAY-AUTONOMY", "controlId": "CTL-KILL-SWITCH", "requirementLevel": "required", "interruptsStageIds": ["RUN-3", "RUN-4"], "rationale": "A delegated chain needs containment that does not depend on cooperation from the agent control plane.", "sourceIds": ["S03", "S04"], "claimIds": ["C14"] },

    { "id": "MAP-025", "priority": 250, "when": { "all": [{ "criterionId": "mcp_a2a_connections", "equals": "yes" }] }, "threatId": "THR-CREDENTIAL-EXPOSURE", "controlId": "CTL-SCOPED-TOKENS", "requirementLevel": "required", "interruptsStageIds": ["CRED-1", "CRED-2", "CRED-3"], "rationale": "Remote capability protocols add an audience boundary where token forwarding and overbroad scope must fail closed.", "sourceIds": ["S05", "S06"], "claimIds": ["C04"] },
    { "id": "MAP-026", "priority": 260, "when": { "all": [{ "criterionId": "sensitive_data", "equals": "yes" }, { "criterionId": "open_network_egress", "equals": "yes" }] }, "threatId": "THR-CODE-EGRESS", "controlId": "CTL-EGRESS", "requirementLevel": "required", "interruptsStageIds": ["CODE-3", "CODE-4"], "rationale": "Sensitive-data access raises the consequence of an unrestricted outbound path and keeps egress control at release-gate level.", "sourceIds": ["S01", "S03", "S04", "S10", "S11"], "claimIds": ["C07", "C16"] },
    { "id": "MAP-027", "priority": 270, "when": { "all": [{ "criterionId": "generated_code_execution", "equals": "yes" }, { "criterionId": "open_network_egress", "equals": "yes" }] }, "threatId": "THR-CODE-EGRESS", "controlId": "CTL-KILL-SWITCH", "requirementLevel": "required", "interruptsStageIds": ["CODE-2", "CODE-3", "CODE-4"], "rationale": "Code plus network access requires an independent path to terminate execution and revoke access during containment.", "sourceIds": ["S03", "S04"], "claimIds": ["C14"] },
    { "id": "MAP-028", "priority": 280, "when": { "all": [{ "criterionId": "sensitive_data", "equals": "yes" }] }, "threatId": "THR-SENSITIVE-DATA-EXPOSURE", "controlId": "CTL-CONTENT-TRUST", "requirementLevel": "required", "interruptsStageIds": ["DATA-1", "DATA-2", "DATA-3"], "rationale": "Sensitive fields need classification, minimization and redaction before they enter model, memory, tool or logging paths.", "sourceIds": ["S04", "S12"], "claimIds": ["C19", "C20"] },
    { "id": "MAP-029", "priority": 290, "when": { "all": [{ "criterionId": "sensitive_data", "equals": "yes" }] }, "threatId": "THR-SENSITIVE-DATA-EXPOSURE", "controlId": "CTL-SCOPED-TOKENS", "requirementLevel": "required", "interruptsStageIds": ["DATA-1", "DATA-4"], "rationale": "Minimally scoped and audience-bound authority limits which sensitive resources the agent can reach and where credentials can be reused.", "sourceIds": ["S05", "S06", "S12"], "claimIds": ["C04", "C20"] },
    { "id": "MAP-030", "priority": 300, "when": { "all": [{ "criterionId": "irreversible_high_impact_actions", "equals": "yes" }] }, "threatId": "THR-AUTHORITY-CONFUSION", "controlId": "CTL-POLICY-DECISION", "requirementLevel": "required", "interruptsStageIds": ["AUTH-2"], "rationale": "High-impact authority needs a deterministic policy decision even when the deployment declares no general action-capable tool category.", "sourceIds": ["S03", "S04", "S12"], "claimIds": ["C03", "C05", "C20"] },
    { "id": "MAP-031", "priority": 310, "when": { "all": [{ "criterionId": "irreversible_high_impact_actions", "equals": "yes" }] }, "threatId": "THR-TOOL-MISUSE", "controlId": "CTL-TOOL-AUTH", "requirementLevel": "required", "interruptsStageIds": ["TOOL-2", "TOOL-3"], "rationale": "The exact high-impact operation and parameters require authorization before the side effect is committed.", "sourceIds": ["S03", "S04", "S12"], "claimIds": ["C03", "C05", "C20"] },
    { "id": "MAP-032", "priority": 320, "when": { "all": [{ "criterionId": "irreversible_high_impact_actions", "equals": "yes" }] }, "threatId": "THR-TOOL-MISUSE", "controlId": "CTL-AUDIT", "requirementLevel": "required", "interruptsStageIds": ["TOOL-3", "TOOL-4"], "rationale": "A high-impact decision needs an attributable chain from identity and policy through approval, parameters and result.", "sourceIds": ["S03", "S04", "S06", "S12"], "claimIds": ["C05", "C12", "C20"] }
  ]
}