How the mapper produces a control plan

1. Input model and three-state evidence

The input schema contains eleven stable criterion IDs. Each accepts exactly yes, no or unknown. A record with a missing, extra or invalid criterion is rejected rather than inferred.

Yes

The capability or exposure exists inside the assessed boundary.

No

The team has evidence that it does not exist inside that boundary. "Not planned" is not automatically "no."

Unknown

The evidence is insufficient. The engine records the criterion under unresolvedInputs and sets INSUFFICIENT_SCOPE_EVIDENCE.

Presets contain all eleven answers. They are editable examples, not classifications of a product. The engine receives the selected values rather than the preset name.

2. Predicate grammar

Every mapping relation has a stable ID, unique integer priority, threat ID, control ID and an all predicate. Each predicate term compares one criterion ID with one allowed answer. An empty all list is a baseline relation; otherwise every term must match exactly. The following predicate excerpt comes from MAP-008 in the published registry.

{
  "id": "MAP-008",
  "priority": 80,
  "when": { "all": [
    { "criterionId": "untrusted_external_content", "equals": "yes" },
    { "criterionId": "action_capable_tools", "equals": "yes" }
  ]},
  "threatId": "THR-INDIRECT-INJECTION",
  "controlId": "CTL-UNTRUSTED-ISOLATION",
  "requirementLevel": "required"
}

The grammar intentionally has no probabilistic weights, hidden defaults or negative inference. A relation is either matched by the submitted evidence or it is not.

3. Union algorithm and ordering

1. Validate the registry graph and resolve every referenced layer, criterion, threat, attack stage, control, claim and source.
2. Validate that the answer set contains each criterion exactly once.
3. Evaluate all matching relations; do not stop at the first match.
4. Union their controls by stable control ID.
5. If repeated relations assign different levels, retain required over recommended.
6. Retain every activating mapping ID, related threat and interrupted attack stage so the selection remains explainable.
7. Order controls by the lowest activating mapping priority, then layer order, then control order and stable ID.
8. Inject generatedAt once and freeze the result used by every exporter.

The union algorithm means one answer can activate several protections, and one protection can be justified by several attack paths. Deduplication never discards those reasons.

4. Result and control snapshot schema

The result record contains the method and schema versions, status, provisional flag, input answers, unresolved inputs, matched mappings and threats, ordered control snapshots and the supplied generation timestamp. It also embeds the selected bounded claims and source records, so an export remains reviewable without silently resolving IDs against a later registry publication.

5. Deterministic exports

JSON is the lossless machine-readable record. CSV uses one row per selected control and quotes delimiter, quote and newline characters. Markdown is the human-review view with status, unresolved inputs and headed control records. All three exporters consume the same immutable result and never call the clock independently.

Determinism is scoped to identical validated registries, answers, method version and generatedAt. A new generation action intentionally creates a new record and timestamp. Changing any form answer marks the visible record stale, clears it and disables all export controls.

6. Registry graph and validation

Canonical registries define criteria, six ordered layers, threats and attack stages, controls, mapping relations, profiles, incidents, claims, sources and methodology. Public mirrors are byte-for-byte copies. A release check rejects duplicate IDs or priorities, unresolved references, invalid URLs, missing evidence fields, layers outside the six-layer sequence and a derived CSV that differs from the mappings registry.

Registry validation establishes internal consistency; it does not prove the controls were correctly implemented in a target system. Implementation evidence requires a separate technical review.

Inspect the tested records directly: controls, mapping relations, bounded claims, dated sources, incident evidence, method contract and the normalized control matrix CSV.

7. Claim-to-source boundary

A claim record contains a bounded statement and source IDs. A control or mapping can cite several claims and official sources. The registry distinguishes standards, specifications, official guidance, researcher disclosures and incident records so editorial interpretation is not presented as an issuing organization's certification or endorsement.

Official sources are preferred for standards, specifications and vulnerability facts. The six-layer grouping and AISVS references are editorial crosswalks; OWASP, NIST, MCP and SLSA do not certify this mapper. The EchoLeak entry separates the MSRC vulnerability record from Aim Labs' proof-of-concept report and from any claim of confirmed exploitation.

8. Updates, exceptions and corrections

Each source record carries a verification date and, where available, a publication date and document status. A material change to criteria, predicate meaning, ordering, result fields or export columns requires a method or export-schema version change. Source clarifications and mapping corrections receive an editorial release entry.

Exceptions belong in the adopting team's own risk record with owner, rationale, compensating control, residual risk, approval and expiry. The public mapper does not store user answers or exceptions. Report a correction through the repository issue tracker with the affected stable ID and a primary source.

Published

21 August 2026

Sources last verified

21 August 2026

Independent review

Not independently reviewed.

Drafting disclosure

AI-assisted drafting with deterministic registry, contract and release checks.