Technical catalogues
Editorial update: .
Exact schema values and source registry content supporting the PALO semantic deep dive. This extraction does not create new canonical definitions.
Read the taxonomyField dictionary CSVField dictionary JSONControlled vocabularies JSONRDF inventory JSON
65 schemas · 2,408 schema entries · 204 enum declarations. “Required in parent” describes the local schema branch; conditional and referenced requirements must also be evaluated.
Canonical registries and draft graph
Lifecycle (6)
Source: data/lifecycle-core.json · Download full registry
[
{
"phaseDefinitionId": "phase-frame",
"semanticId": "https://paloframework.org/semantic/stage/frame",
"definitionVersion": "3.0.0",
"ordinal": 1,
"label": "Frame",
"purpose": "Define the use case, its boundary, owners and affected people before governance choices are made.",
"gateDefinitionRef": "https://paloframework.org/semantic/gate/frame?v=3.1.0"
},
{
"phaseDefinitionId": "phase-classify",
"semanticId": "https://paloframework.org/semantic/stage/classify",
"definitionVersion": "3.0.0",
"ordinal": 2,
"label": "Classify",
"purpose": "Establish the applicable risk route, obligations and level of scrutiny.",
"gateDefinitionRef": "https://paloframework.org/semantic/gate/classify?v=3.1.0"
},
{
"phaseDefinitionId": "phase-assess",
"semanticId": "https://paloframework.org/semantic/stage/assess",
"definitionVersion": "3.0.0",
"ordinal": 3,
"label": "Assess",
"purpose": "Evaluate impacts, rights, delegated authority, autonomy and oversight conditions.",
"gateDefinitionRef": "https://paloframework.org/semantic/gate/assess?v=3.1.0"
},
{
"phaseDefinitionId": "phase-control",
"semanticId": "https://paloframework.org/semantic/stage/control",
"definitionVersion": "3.0.0",
"ordinal": 4,
"label": "Control",
"purpose": "Translate findings into owned, testable engineering, process and assurance controls.",
"gateDefinitionRef": "https://paloframework.org/semantic/gate/control?v=3.1.0"
},
{
"phaseDefinitionId": "phase-measure",
"semanticId": "https://paloframework.org/semantic/stage/measure",
"definitionVersion": "3.0.0",
"ordinal": 5,
"label": "Measure",
"purpose": "Define how accountability, performance, risk and drift will be observed over time.",
"gateDefinitionRef": "https://paloframework.org/semantic/gate/measure?v=3.1.0"
},
{
"phaseDefinitionId": "phase-prove",
"semanticId": "https://paloframework.org/semantic/stage/prove",
"definitionVersion": "3.0.0",
"ordinal": 6,
"label": "Prove & Review",
"purpose": "Assemble reconstructable evidence, decide readiness and feed findings into the next cycle.",
"gateDefinitionRef": "https://paloframework.org/semantic/gate/prove?v=3.1.0"
}
]Gate definitions (6)
Source: data/lifecycle-core.json · Download full registry
[
{
"gateDefinitionId": "https://paloframework.org/semantic/gate/frame?v=3.1.0",
"gateId": "frame",
"definitionVersion": "3.1.0",
"label": "Frame",
"purpose": "Agree the problem, affected stakeholders, intended benefit, owner and non-AI alternatives.",
"entryCriteria": [
"Named accountable owner",
"Problem and affected population described",
"Non-AI option considered"
],
"decisionOptions": [
"proceed",
"proceed-with-conditions",
"hold",
"redesign",
"stop"
],
"requiredControlIds": [
"ctrl-purpose-boundary"
],
"conditionalControlIds": [
"ctrl-system-card-explanations",
"ctrl-data-governance-lifecycle",
"ctrl-privacy-lifecycle",
"ctrl-environmental-performance",
"ctrl-ai-literacy-effectiveness",
"ctrl-aims-leadership-objectives"
],
"indicatorIds": [
"kri-scope-change-rate",
"kpi-system-card-coverage",
"kpi-data-lifecycle-coverage",
"kpi-energy-measurement-coverage",
"kpi-ai-literacy-competence-rate",
"kpi-aims-objective-coverage"
],
"sourceIds": [
"src-oecd-ai-principles",
"src-nist-ai-rmf"
],
"templateIds": [
"tpl-contribution-starter"
]
},
{
"gateDefinitionId": "https://paloframework.org/semantic/gate/classify?v=3.1.0",
"gateId": "classify",
"definitionVersion": "3.1.0",
"label": "Classify",
"purpose": "Identify system type, authority, affected rights, jurisdictions, suppliers and preliminary risk posture.",
"entryCriteria": [
"Purpose boundary recorded",
"Material system and supplier dependencies listed"
],
"decisionOptions": [
"proceed",
"proceed-with-conditions",
"hold",
"redesign",
"stop"
],
"requiredControlIds": [
"ctrl-purpose-boundary",
"ctrl-third-party-due-diligence",
"ctrl-change-gate"
],
"conditionalControlIds": [
"ctrl-fair-allocation",
"ctrl-system-card-explanations",
"ctrl-affected-person-notice",
"ctrl-article50-transparency",
"ctrl-privacy-lifecycle",
"ctrl-gpai-provider",
"ctrl-gpai-deployer",
"ctrl-systemic-risk",
"ctrl-regulatory-incident-reporting",
"ctrl-runtime-production-boundary",
"ctrl-aims-leadership-objectives"
],
"indicatorIds": [
"kri-scope-change-rate",
"kpi-system-card-coverage",
"kpi-notice-delivery-coverage",
"kpi-gpai-obligation-evidence-coverage",
"kpi-production-admission-coverage",
"kpi-aims-objective-coverage"
],
"sourceIds": [
"src-eu-ai-act",
"src-nist-ai-rmf"
],
"templateIds": [
"tpl-procurement"
]
},
{
"gateDefinitionId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"gateId": "assess",
"definitionVersion": "3.1.0",
"label": "Assess",
"purpose": "Test impacts, data, misuse, limitations, alternatives and residual uncertainty.",
"entryCriteria": [
"Classification reviewed",
"Data and affected-stakeholder context available",
"Test scope agreed"
],
"decisionOptions": [
"proceed",
"proceed-with-conditions",
"hold",
"redesign",
"stop"
],
"requiredControlIds": [
"ctrl-data-provenance",
"ctrl-third-party-due-diligence",
"ctrl-adversarial-testing",
"ctrl-change-gate"
],
"conditionalControlIds": [
"ctrl-agentic-authority",
"ctrl-fairness-quality-of-service",
"ctrl-fair-allocation",
"ctrl-harmful-representation",
"ctrl-system-card-explanations",
"ctrl-data-governance-lifecycle",
"ctrl-annotation-quality",
"ctrl-privacy-lifecycle",
"ctrl-gpai-deployer",
"ctrl-systemic-risk",
"ctrl-ai-output-accessibility",
"ctrl-environmental-performance"
],
"indicatorIds": [
"kpi-provenance-coverage",
"kpi-vendor-evidence-coverage",
"kri-critical-test-failure-rate",
"kpi-subgroup-evaluation-coverage",
"kri-residual-disparity-rate",
"kpi-explanation-comprehension",
"kpi-data-lifecycle-coverage",
"kpi-annotation-quality-coverage",
"kri-systemic-risk-finding-rate",
"kpi-accessibility-test-pass-rate",
"kpi-energy-measurement-coverage"
],
"sourceIds": [
"src-nist-ai-rmf",
"src-nist-genai-profile"
],
"templateIds": [
"tpl-red-team-evidence",
"tpl-procurement"
]
},
{
"gateDefinitionId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"gateId": "control",
"definitionVersion": "3.1.0",
"label": "Control",
"purpose": "Assign safeguards, owners, escalation, human authority, technical limits and supplier obligations.",
"entryCriteria": [
"Material risks and uncertainty recorded",
"Control owners available",
"Residual-risk decision route named"
],
"decisionOptions": [
"proceed",
"proceed-with-conditions",
"hold",
"redesign",
"stop"
],
"requiredControlIds": [
"ctrl-data-provenance",
"ctrl-human-review",
"ctrl-third-party-due-diligence",
"ctrl-incident-response"
],
"conditionalControlIds": [
"ctrl-system-card-explanations",
"ctrl-affected-person-notice",
"ctrl-appeal-remedy",
"ctrl-article50-transparency",
"ctrl-data-governance-lifecycle",
"ctrl-privacy-lifecycle",
"ctrl-gpai-provider",
"ctrl-gpai-deployer",
"ctrl-systemic-risk",
"ctrl-regulatory-incident-reporting",
"ctrl-decommissioning",
"ctrl-ai-output-accessibility",
"ctrl-ai-literacy-effectiveness",
"ctrl-runtime-production-boundary"
],
"indicatorIds": [
"kpi-review-completion",
"kpi-vendor-evidence-coverage",
"kri-sensitive-data-events",
"kri-override-failure-rate",
"kpi-notice-delivery-coverage",
"kpi-appeal-resolution-sla",
"kpi-machine-readable-marking-coverage",
"kpi-data-lifecycle-coverage",
"kpi-gpai-obligation-evidence-coverage",
"kpi-regulatory-reporting-clock-compliance",
"kpi-accessibility-test-pass-rate",
"kpi-ai-literacy-competence-rate",
"kpi-production-admission-coverage"
],
"sourceIds": [
"src-iso-42001",
"src-nist-ai-rmf"
],
"templateIds": [
"tpl-incident-response",
"tpl-procurement"
]
},
{
"gateDefinitionId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"gateId": "measure",
"definitionVersion": "3.1.0",
"label": "Measure",
"purpose": "Set baselines, indicators, thresholds, monitoring ownership and response timing.",
"entryCriteria": [
"Controls and owners assigned",
"Data collection feasibility checked",
"Threshold decision rights named"
],
"decisionOptions": [
"proceed",
"proceed-with-conditions",
"hold",
"redesign",
"stop"
],
"requiredControlIds": [
"ctrl-adversarial-testing",
"ctrl-incident-response",
"ctrl-decision-trace"
],
"conditionalControlIds": [
"ctrl-fairness-quality-of-service",
"ctrl-fair-allocation",
"ctrl-harmful-representation",
"ctrl-system-card-explanations",
"ctrl-affected-person-notice",
"ctrl-appeal-remedy",
"ctrl-article50-transparency",
"ctrl-data-governance-lifecycle",
"ctrl-annotation-quality",
"ctrl-gpai-provider",
"ctrl-gpai-deployer",
"ctrl-systemic-risk",
"ctrl-regulatory-incident-reporting",
"ctrl-decommissioning",
"ctrl-ai-output-accessibility",
"ctrl-environmental-performance",
"ctrl-ai-literacy-effectiveness",
"ctrl-aims-internal-audit",
"ctrl-aims-management-review-capa",
"ctrl-runtime-production-boundary"
],
"indicatorIds": [
"kpi-review-completion",
"kpi-incident-triage-time",
"kri-sensitive-data-events",
"kri-critical-test-failure-rate",
"kri-residual-disparity-rate",
"kri-harmful-representation-rate",
"kpi-explanation-comprehension",
"kpi-appeal-resolution-sla",
"kri-overdue-remedy-rate",
"kri-provenance-verification-failure-rate",
"kpi-deletion-verification-coverage",
"kri-systemic-risk-finding-rate",
"kpi-regulatory-reporting-clock-compliance",
"kpi-decommissioning-evidence-coverage",
"kri-accessibility-blocker-rate",
"kri-environmental-budget-variance",
"kri-trained-control-error-rate",
"kpi-aims-audit-completion",
"kpi-corrective-action-closure",
"kri-execution-bypass-rate"
],
"sourceIds": [
"src-nist-ai-rmf"
],
"templateIds": [
"tpl-incident-response",
"tpl-red-team-evidence"
]
},
{
"gateDefinitionId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"gateId": "prove",
"definitionVersion": "3.1.0",
"label": "Prove and Review",
"purpose": "Assemble decision evidence, exceptions, source status, approvals and triggers for reopening.",
"entryCriteria": [
"Required evidence indexed",
"Exceptions and residual risk recorded",
"Review and reopening schedule assigned"
],
"decisionOptions": [
"proceed",
"proceed-with-conditions",
"hold",
"redesign",
"stop"
],
"requiredControlIds": [
"ctrl-human-review",
"ctrl-adversarial-testing",
"ctrl-incident-response",
"ctrl-change-gate",
"ctrl-decision-trace"
],
"conditionalControlIds": [
"ctrl-fairness-quality-of-service",
"ctrl-fair-allocation",
"ctrl-harmful-representation",
"ctrl-system-card-explanations",
"ctrl-affected-person-notice",
"ctrl-appeal-remedy",
"ctrl-article50-transparency",
"ctrl-data-governance-lifecycle",
"ctrl-annotation-quality",
"ctrl-privacy-lifecycle",
"ctrl-gpai-provider",
"ctrl-gpai-deployer",
"ctrl-systemic-risk",
"ctrl-regulatory-incident-reporting",
"ctrl-decommissioning",
"ctrl-ai-output-accessibility",
"ctrl-environmental-performance",
"ctrl-ai-literacy-effectiveness",
"ctrl-aims-leadership-objectives",
"ctrl-aims-internal-audit",
"ctrl-aims-management-review-capa",
"ctrl-runtime-production-boundary"
],
"indicatorIds": [
"kpi-provenance-coverage",
"kpi-review-completion",
"kpi-incident-triage-time",
"kri-scope-change-rate",
"kpi-subgroup-evaluation-coverage",
"kri-residual-disparity-rate",
"kpi-system-card-coverage",
"kpi-explanation-comprehension",
"kpi-notice-delivery-coverage",
"kpi-appeal-resolution-sla",
"kpi-machine-readable-marking-coverage",
"kpi-data-lifecycle-coverage",
"kpi-annotation-quality-coverage",
"kpi-gpai-obligation-evidence-coverage",
"kpi-regulatory-reporting-clock-compliance",
"kpi-decommissioning-evidence-coverage",
"kpi-accessibility-test-pass-rate",
"kpi-energy-measurement-coverage",
"kpi-ai-literacy-competence-rate",
"kpi-aims-objective-coverage",
"kpi-aims-audit-completion",
"kpi-corrective-action-closure",
"kpi-production-admission-coverage"
],
"sourceIds": [
"src-nist-ai-rmf",
"src-iso-42001"
],
"templateIds": [
"tpl-board-review",
"tpl-contribution-starter"
]
}
]Twelve governance domains (12)
Source: data/governance-control-packs.json · Download full registry
[
{
"domainId": "domain-fairness-subgroups",
"title": "Fairness and subgroup testing",
"objective": "Make quality-of-service, allocation and representational-harm evaluation a release and monitoring requirement for affected and intersectional groups.",
"completionLevel": "governance-control-plane",
"applicabilityQuestions": [
"Can outcomes or service quality differ across affected groups?",
"Does the system allocate, rank, recommend or represent people or groups?"
],
"controlIds": [
"ctrl-fairness-quality-of-service",
"ctrl-fair-allocation",
"ctrl-harmful-representation"
],
"indicatorIds": [
"kpi-subgroup-evaluation-coverage",
"kri-residual-disparity-rate",
"kri-harmful-representation-rate"
],
"gateIds": [
"classify",
"assess",
"measure",
"prove"
],
"evidenceContractRefs": [
"schemas/palo-governance-assurance-record.schema.json"
],
"minimumEvidenceKinds": [
"subgroup-register",
"fairness-test-result",
"threshold-approval",
"residual-disparity-disclosure"
],
"completionCriteria": [
"Applicable groups, intersections, metrics, sample adequacy and thresholds are approved before evaluation.",
"Component and whole-system tests pass or a named authority records conditions, mitigation and residual disparities."
],
"stopConditions": [
"A material subgroup is omitted or a release threshold is exceeded without accepted mitigation and disclosure."
],
"residualBoundary": "PALO validates the governance record, not the scientific validity, legality or social acceptability of a fairness metric or trade-off."
},
{
"domainId": "domain-system-card-explanations",
"title": "System cards and stakeholder explanations",
"objective": "Maintain a version-bound system card and verify that affected people, operators, reviewers and customers understand the explanation needed for their decisions.",
"completionLevel": "governance-control-plane",
"applicabilityQuestions": [
"Do stakeholders need information to understand, rely on, challenge or operate the system?"
],
"controlIds": [
"ctrl-system-card-explanations"
],
"indicatorIds": [
"kpi-system-card-coverage",
"kpi-explanation-comprehension"
],
"gateIds": [
"frame",
"assess",
"control",
"prove"
],
"evidenceContractRefs": [
"schemas/palo-system-card.schema.json",
"schemas/palo-governance-assurance-record.schema.json"
],
"minimumEvidenceKinds": [
"system-card",
"stakeholder-explanation",
"comprehension-test",
"limitation-disclosure"
],
"completionCriteria": [
"The card matches the deployed system and identifies use, components, data, performance, limitations, oversight and monitoring.",
"Representative stakeholders meet an approved comprehension rubric in supported languages and accessible formats."
],
"stopConditions": [
"A material limitation, decision consequence or human action route is absent or critically misunderstood."
],
"residualBoundary": "A system card and comprehension test do not guarantee that every individual understands an outcome or that an explanation is legally sufficient."
},
{
"domainId": "domain-notice-appeal-remedy",
"title": "Affected-person notice, appeal, independent review and remedy",
"objective": "Turn contestability into an accessible operational case flow with accountable deadlines, conflict-independent review, reasoned outcomes and verified remedies.",
"completionLevel": "governance-control-plane",
"applicabilityQuestions": [
"Can an AI-assisted interaction or outcome materially affect an identifiable person?",
"Could a person reasonably need explanation, correction or review?"
],
"controlIds": [
"ctrl-affected-person-notice",
"ctrl-appeal-remedy"
],
"indicatorIds": [
"kpi-notice-delivery-coverage",
"kpi-appeal-resolution-sla",
"kri-overdue-remedy-rate"
],
"gateIds": [
"classify",
"control",
"measure",
"prove"
],
"evidenceContractRefs": [
"schemas/palo-affected-person-case.schema.json",
"schemas/palo-governance-assurance-record.schema.json"
],
"minimumEvidenceKinds": [
"notice-template",
"delivery-log",
"appeal-case",
"independence-check",
"review-outcome",
"remedy-record"
],
"completionCriteria": [
"Notice and intake routes are accessible, timely and connected to the correct case and system version.",
"Appeals receive conflict-independent review and accepted remedies are verified before closure."
],
"stopConditions": [
"A high-impact system lacks a reachable human challenge route or an urgent remedy is overdue."
],
"residualBoundary": "The adopting organization must determine legal rights, deadlines, reviewer independence and available remedies for each jurisdiction and context."
},
{
"domainId": "domain-article50-transparency",
"title": "Article 50 marking, labelling and provenance",
"objective": "Separate provider and deployer obligations and preserve evidence for AI-interaction notices, machine-readable marks, labels, provenance and exceptions.",
"completionLevel": "governance-control-plane",
"applicabilityQuestions": [
"Does the system interact directly with people?",
"Does it generate or manipulate image, audio, video or text content covered by Article 50?",
"Is the organization acting as provider, deployer or both?"
],
"controlIds": [
"ctrl-article50-transparency"
],
"indicatorIds": [
"kpi-machine-readable-marking-coverage",
"kri-provenance-verification-failure-rate"
],
"gateIds": [
"classify",
"control",
"measure",
"prove"
],
"evidenceContractRefs": [
"schemas/palo-article50-transparency-record.schema.json",
"schemas/palo-governance-assurance-record.schema.json"
],
"minimumEvidenceKinds": [
"article50-applicability-record",
"interaction-notice-test",
"machine-readable-marking-test",
"deployer-label-record",
"content-provenance-record"
],
"completionCriteria": [
"A reviewed actor, content-type, obligation and exception assessment exists for every supported modality.",
"Independent samples verify notices, detectable marks, labels and provenance across the expected content transformation path."
],
"stopConditions": [
"Required notices or markings are systematically absent, undetectable or not bound to the produced content."
],
"residualBoundary": "PALO records implementation claims but does not prescribe one technical marking standard or determine equivalent legal adequacy."
},
{
"domainId": "domain-data-lifecycle",
"title": "Dataset, annotation, privacy, retention and deletion lifecycle",
"objective": "Trace material training, evaluation, prompt, retrieval, embedding and operational data through origin, transformation, quality, permission, lawful use, retention and verified disposition.",
"completionLevel": "governance-control-plane",
"applicabilityQuestions": [
"Does the system train, evaluate, retrieve, infer from or retain material data or knowledge sources?",
"Is personal, sensitive, licensed or annotated data involved?"
],
"controlIds": [
"ctrl-data-provenance",
"ctrl-data-governance-lifecycle",
"ctrl-annotation-quality",
"ctrl-privacy-lifecycle"
],
"indicatorIds": [
"kpi-provenance-coverage",
"kpi-data-lifecycle-coverage",
"kpi-annotation-quality-coverage",
"kpi-deletion-verification-coverage",
"kri-sensitive-data-events"
],
"gateIds": [
"frame",
"classify",
"assess",
"control",
"measure",
"prove"
],
"evidenceContractRefs": [
"schemas/palo-data-lineage-record.schema.json",
"schemas/palo-governance-assurance-record.schema.json"
],
"minimumEvidenceKinds": [
"dataset-lineage-record",
"permission-record",
"quality-test",
"annotation-protocol",
"lawful-basis-record",
"retention-schedule",
"deletion-verification"
],
"completionCriteria": [
"Every material data asset has a versioned lineage, purpose, permission, quality, sensitivity and owner record.",
"Retention and deletion decisions cover replicas, derived data, embeddings, caches and approved legal holds."
],
"stopConditions": [
"A material dataset has unknown origin or permission, or sensitive data lacks an approved lifecycle and disposition route."
],
"residualBoundary": "Schema-valid records cannot establish lawful basis, ownership, representativeness or actual deletion without accountable and technical verification."
},
{
"domainId": "domain-gpai-systemic-risk",
"title": "GPAI provider, deployer and systemic-risk workflows",
"objective": "Determine value-chain role, assemble applicable provider or deployer evidence and operate systemic-risk evaluation, mitigation, incident and downstream-information workflows.",
"completionLevel": "governance-control-plane",
"applicabilityQuestions": [
"Is the organization providing, modifying, integrating or deploying a general-purpose AI model?",
"Could the model meet systemic-risk classification or create material cascading impacts?"
],
"controlIds": [
"ctrl-gpai-provider",
"ctrl-gpai-deployer",
"ctrl-systemic-risk",
"ctrl-third-party-due-diligence"
],
"indicatorIds": [
"kpi-gpai-obligation-evidence-coverage",
"kri-systemic-risk-finding-rate",
"kpi-vendor-evidence-coverage"
],
"gateIds": [
"classify",
"assess",
"control",
"measure",
"prove"
],
"evidenceContractRefs": [
"schemas/palo-gpai-systemic-risk-record.schema.json",
"schemas/palo-governance-assurance-record.schema.json"
],
"minimumEvidenceKinds": [
"gpai-role-assessment",
"model-component-inventory",
"provider-evidence-review",
"systemic-risk-assessment",
"model-evaluation",
"risk-mitigation-record"
],
"completionCriteria": [
"Actor role, model identity, modifications, applicable obligations and downstream dependencies receive accountable review.",
"Systemic-risk scenarios, evaluations, mitigations, residual findings and incident routes are current for the released model."
],
"stopConditions": [
"The GPAI role is undetermined, mandatory provider evidence is missing or a critical systemic-risk scenario is untested."
],
"residualBoundary": "PALO does not designate a model as systemic-risk GPAI, verify model-provider disclosures or establish compliance with the voluntary Code."
},
{
"domainId": "domain-serious-incident-decommissioning",
"title": "Serious-incident reporting and decommissioning",
"objective": "Bind detection to jurisdiction-specific reporting clocks and ensure withdrawal or retirement completes stakeholder transition, revocation, data disposition and residual monitoring.",
"completionLevel": "governance-control-plane",
"applicabilityQuestions": [
"Can a system failure meet a serious-incident or other mandatory reporting threshold?",
"Is the system, model, provider or material feature being withdrawn or retired?"
],
"controlIds": [
"ctrl-incident-response",
"ctrl-regulatory-incident-reporting",
"ctrl-decommissioning"
],
"indicatorIds": [
"kpi-incident-triage-time",
"kpi-regulatory-reporting-clock-compliance",
"kpi-decommissioning-evidence-coverage"
],
"gateIds": [
"classify",
"control",
"measure",
"prove"
],
"evidenceContractRefs": [
"schemas/palo-serious-incident-record.schema.json",
"schemas/palo-decommission-record.schema.json",
"schemas/palo-governance-assurance-record.schema.json"
],
"minimumEvidenceKinds": [
"serious-incident-record",
"reportability-decision",
"notification-receipt",
"decommission-plan",
"data-disposition-record",
"retirement-verification"
],
"completionCriteria": [
"Clock starts, applicable deadlines, reportability decisions, notifications and corrective actions are timestamped and evidence-bound.",
"Decommissioning closes only after access revocation, stakeholder transition, data disposition and residual-risk verification."
],
"stopConditions": [
"A potentially reportable incident has no active accountable clock or a retirement would strand unsafe access, data or affected users."
],
"residualBoundary": "Legal reportability, authority routing and deadlines require current jurisdiction-specific review; retirement evidence needs operational verification."
},
{
"domainId": "domain-accessibility",
"title": "Accessibility of AI interactions and outcomes",
"objective": "Test interfaces, notices, explanations, generated content, human review and remedy routes with assistive technologies and representative disabled users.",
"completionLevel": "governance-control-plane",
"applicabilityQuestions": [
"Can disabled people interact with, receive, understand or challenge system outputs?"
],
"controlIds": [
"ctrl-ai-output-accessibility",
"ctrl-affected-person-notice",
"ctrl-system-card-explanations"
],
"indicatorIds": [
"kpi-accessibility-test-pass-rate",
"kri-accessibility-blocker-rate",
"kpi-explanation-comprehension"
],
"gateIds": [
"assess",
"control",
"measure",
"prove"
],
"evidenceContractRefs": [
"schemas/palo-governance-assurance-record.schema.json"
],
"minimumEvidenceKinds": [
"accessibility-test-plan",
"assistive-technology-result",
"user-evaluation",
"conformance-report",
"remediation-record"
],
"completionCriteria": [
"Critical journeys and supported output modalities pass automated and manual accessibility evaluation.",
"Representative disabled users can complete notice, explanation, review and remedy journeys through equivalent routes."
],
"stopConditions": [
"A high-impact notice, decision, review or remedy journey has an unresolved accessibility blocker."
],
"residualBoundary": "PALO does not certify WCAG conformance or replace sector, product and jurisdiction-specific accessibility assessment."
},
{
"domainId": "domain-environment",
"title": "Environmental performance",
"objective": "Make energy, emissions, water and hardware impacts visible through explicit boundaries, measurement or estimation, alternatives and accountable budgets.",
"completionLevel": "governance-control-plane",
"applicabilityQuestions": [
"Are training, evaluation, inference or hardware impacts material under the organization environmental boundary?"
],
"controlIds": [
"ctrl-environmental-performance"
],
"indicatorIds": [
"kpi-energy-measurement-coverage",
"kri-environmental-budget-variance"
],
"gateIds": [
"frame",
"assess",
"measure",
"prove"
],
"evidenceContractRefs": [
"schemas/palo-governance-assurance-record.schema.json"
],
"minimumEvidenceKinds": [
"environmental-boundary-record",
"energy-measurement",
"emissions-calculation",
"alternative-analysis",
"budget-decision"
],
"completionCriteria": [
"Material workloads have declared boundaries, reproducible measurement or estimation and current baselines.",
"Material regressions and alternative architectures receive an accountable budget and trade-off decision."
],
"stopConditions": [
"A material workload has no baseline or exceeds an approved budget without a reviewed exception."
],
"residualBoundary": "PALO does not prescribe lifecycle-accounting methodology, verify supplier data or make environmental claims independently."
},
{
"domainId": "domain-ai-literacy",
"title": "AI literacy and competence effectiveness",
"objective": "Move beyond attendance records by testing role-specific knowledge, practical control behavior and refresh needs after system or obligation changes.",
"completionLevel": "governance-control-plane",
"applicabilityQuestions": [
"Does a role develop, deploy, operate, review, procure, oversee or use AI on the organization behalf?"
],
"controlIds": [
"ctrl-ai-literacy-effectiveness"
],
"indicatorIds": [
"kpi-ai-literacy-competence-rate",
"kri-trained-control-error-rate"
],
"gateIds": [
"frame",
"control",
"measure",
"prove"
],
"evidenceContractRefs": [
"schemas/palo-governance-assurance-record.schema.json"
],
"minimumEvidenceKinds": [
"role-competence-matrix",
"learning-record",
"competence-assessment",
"observed-practice-test",
"refresh-record"
],
"completionCriteria": [
"Every in-scope role has approved competencies and current role-specific learning.",
"People demonstrate competence in practical assessments and observed control behavior, with failures routed to refresh and redesign."
],
"stopConditions": [
"A high-authority role lacks current demonstrated competence for the system and decisions in scope."
],
"residualBoundary": "PALO cannot establish competence from attendance, self-attestation or a generic quiz and does not define an organization curriculum."
},
{
"domainId": "domain-iso42001-aims",
"title": "ISO/IEC 42001 management-system overlay",
"objective": "Connect system-level PALO cases to organizational context, leadership, policy, objectives, support, operations, performance evaluation, internal audit, management review and corrective action.",
"completionLevel": "governance-control-plane",
"applicabilityQuestions": [
"Is the organization establishing, operating or assessing an AI management system?"
],
"controlIds": [
"ctrl-aims-leadership-objectives",
"ctrl-aims-internal-audit",
"ctrl-aims-management-review-capa"
],
"indicatorIds": [
"kpi-aims-objective-coverage",
"kpi-aims-audit-completion",
"kpi-corrective-action-closure"
],
"gateIds": [
"frame",
"classify",
"measure",
"prove"
],
"evidenceContractRefs": [
"schemas/palo-aims-overlay-record.schema.json",
"schemas/palo-governance-assurance-record.schema.json"
],
"minimumEvidenceKinds": [
"aims-scope",
"ai-policy",
"aims-objectives",
"audit-programme",
"management-review-record",
"corrective-action",
"effectiveness-check"
],
"completionCriteria": [
"The AIMS scope, policy, objectives, roles, resources and documented-information controls are approved and connected to applicable PALO cases.",
"Internal audit, management review, nonconformity and corrective-action cycles operate with independence and effectiveness evidence."
],
"stopConditions": [
"Material AI activities fall outside the declared AIMS scope without review or a critical nonconformity is overdue."
],
"residualBoundary": "This is an implementation overlay, not the licensed ISO/IEC 42001 text, a clause-by-clause legal interpretation or certification."
},
{
"domainId": "domain-palo-ai-production",
"title": "PALO-AI production identity, persistence, tenancy, keys and execution",
"objective": "Fail closed unless the deployed runtime demonstrates workload identity, tenant isolation, durable recovery, external key custody, non-bypassable policy enforcement, trusted connectors and verified effects.",
"completionLevel": "reference-runtime-only",
"applicabilityQuestions": [
"Will PALO-AI authorize or execute consequential actions in a production environment?",
"Will multiple tenants, external connectors or regulated evidence use the runtime?"
],
"controlIds": [
"ctrl-agentic-authority",
"ctrl-runtime-production-boundary"
],
"indicatorIds": [
"kpi-production-admission-coverage",
"kri-execution-bypass-rate",
"kri-tool-call-error-rate",
"kri-override-failure-rate"
],
"gateIds": [
"classify",
"control",
"measure",
"prove"
],
"evidenceContractRefs": [
"schemas/palo-production-profile.schema.json",
"schemas/palo-governance-assurance-record.schema.json"
],
"minimumEvidenceKinds": [
"production-profile",
"identity-test",
"tenant-isolation-test",
"persistence-recovery-test",
"key-custody-attestation",
"bypass-resistance-test",
"connector-attestation"
],
"completionCriteria": [
"The production admission validator passes only against deployment-specific, current and independently challengeable evidence.",
"Every protected external effect is observed through a claim, decision, one-time capability, trusted receipt and authoritative outcome-verification chain."
],
"stopConditions": [
"Shared tokens, process-local keys, SQLite-only state, unscoped tenant data or an in-process bypass route remain in the production path."
],
"residualBoundary": "PALO 3.1 supplies a fail-closed admission contract and reference tests; it does not claim production completion until external infrastructure and independent deployment evidence satisfy that contract."
}
]All 31 controls (31)
Source: data/control-library.json · Download full registry
[
{
"controlId": "ctrl-purpose-boundary",
"title": "Document purpose and prohibited uses",
"objective": "Keep intended outcomes, affected people, authority and prohibited uses explicit and reviewable.",
"controlType": "directive",
"lifecycleGates": [
"frame",
"classify"
],
"evidenceKinds": [
"approved-purpose-record",
"stakeholder-map"
],
"indicatorIds": [
"kri-scope-change-rate"
],
"sourceIds": [
"src-nist-ai-rmf",
"src-oecd-ai-principles"
],
"templateIds": [
"tpl-board-review",
"tpl-procurement"
]
},
{
"controlId": "ctrl-data-provenance",
"title": "Record data provenance and permitted use",
"objective": "Trace material data sources, permissions, quality limits and sensitivity decisions.",
"controlType": "preventive",
"lifecycleGates": [
"assess",
"control"
],
"evidenceKinds": [
"data-inventory",
"provenance-record",
"quality-test"
],
"indicatorIds": [
"kpi-provenance-coverage",
"kri-sensitive-data-events"
],
"sourceIds": [
"src-nist-ai-rmf",
"src-eu-ai-act"
],
"templateIds": [
"tpl-procurement",
"tpl-red-team-evidence"
]
},
{
"controlId": "ctrl-human-review",
"title": "Define meaningful human review",
"objective": "Give named reviewers sufficient information, authority, time and escalation paths to change outcomes.",
"controlType": "preventive",
"lifecycleGates": [
"control",
"prove"
],
"evidenceKinds": [
"review-procedure",
"override-log",
"training-record"
],
"indicatorIds": [
"kpi-review-completion",
"kri-override-failure-rate"
],
"sourceIds": [
"src-nist-ai-rmf",
"src-oecd-ai-principles",
"src-eu-ai-act"
],
"templateIds": [
"tpl-board-review",
"tpl-incident-response"
]
},
{
"controlId": "ctrl-third-party-due-diligence",
"title": "Perform risk-based third-party due diligence",
"objective": "Record supplier capabilities, limitations, dependencies, change notices, audit rights and exit options.",
"controlType": "preventive",
"lifecycleGates": [
"classify",
"assess",
"control"
],
"evidenceKinds": [
"supplier-questionnaire",
"contract-control-matrix",
"exit-plan"
],
"indicatorIds": [
"kpi-vendor-evidence-coverage"
],
"sourceIds": [
"src-iso-42001",
"src-nist-ai-rmf"
],
"templateIds": [
"tpl-procurement"
]
},
{
"controlId": "ctrl-adversarial-testing",
"title": "Test misuse and failure scenarios",
"objective": "Exercise credible abuse, unsafe-output, security and recovery scenarios before and after material change.",
"controlType": "detective",
"lifecycleGates": [
"assess",
"measure",
"prove"
],
"evidenceKinds": [
"test-plan",
"test-result",
"residual-risk-record"
],
"indicatorIds": [
"kri-critical-test-failure-rate"
],
"sourceIds": [
"src-nist-genai-profile",
"src-owasp-llm-top10"
],
"templateIds": [
"tpl-red-team-evidence"
]
},
{
"controlId": "ctrl-incident-response",
"title": "Operate incident and escalation response",
"objective": "Detect, contain, document, communicate and learn from material failures and near misses.",
"controlType": "corrective",
"lifecycleGates": [
"control",
"measure",
"prove"
],
"evidenceKinds": [
"incident-record",
"containment-log",
"post-incident-review"
],
"indicatorIds": [
"kpi-incident-triage-time",
"kri-sensitive-data-events"
],
"sourceIds": [
"src-nist-ai-rmf",
"src-iso-42001"
],
"templateIds": [
"tpl-incident-response",
"tpl-board-review"
]
},
{
"controlId": "ctrl-change-gate",
"title": "Gate material model and workflow changes",
"objective": "Reassess purpose, authority, data, controls and evidence before material changes enter use.",
"controlType": "preventive",
"lifecycleGates": [
"classify",
"assess",
"prove"
],
"evidenceKinds": [
"change-record",
"impact-delta",
"approval-record"
],
"indicatorIds": [
"kri-scope-change-rate",
"kpi-review-completion"
],
"sourceIds": [
"src-nist-ai-rmf",
"src-iso-42001"
],
"templateIds": [
"tpl-board-review"
]
},
{
"controlId": "ctrl-decision-trace",
"title": "Maintain decision and evidence traceability",
"objective": "Connect accountable decisions to inputs, controls, exceptions, evidence and source status.",
"controlType": "detective",
"lifecycleGates": [
"measure",
"prove"
],
"evidenceKinds": [
"decision-log",
"evidence-index",
"exception-record"
],
"indicatorIds": [
"kpi-review-completion",
"kpi-provenance-coverage"
],
"sourceIds": [
"src-nist-ai-rmf",
"src-eu-ai-act"
],
"templateIds": [
"tpl-board-review",
"tpl-contribution-starter"
]
},
{
"controlId": "ctrl-agentic-authority",
"title": "Enforce agentic authority and delegation constraints",
"objective": "Limit tool access, define subagent boundaries, and intercept high-risk action claims in autonomous AI workflows.",
"controlType": "preventive",
"lifecycleGates": [
"assess",
"control"
],
"evidenceKinds": [
"agentic-interface-config",
"signed-execution-log",
"human-override-record"
],
"indicatorIds": [
"kpi-review-completion",
"kri-scope-change-rate"
],
"sourceIds": [
"src-nist-ai-rmf",
"src-iso-42001"
],
"templateIds": [
"tpl-board-review"
]
},
{
"controlId": "ctrl-fairness-quality-of-service",
"title": "Test quality of service across affected groups",
"objective": "Define relevant demographic and intersectional groups, approved metrics and release thresholds, then test component and whole-system performance before release and after material change.",
"controlType": "preventive",
"lifecycleGates": [
"assess",
"measure",
"prove"
],
"evidenceKinds": [
"subgroup-register",
"evaluation-dataset-record",
"fairness-test-result",
"threshold-approval"
],
"indicatorIds": [
"kpi-subgroup-evaluation-coverage",
"kri-residual-disparity-rate"
],
"sourceIds": [
"src-nist-ai-rmf",
"src-iso-42005",
"src-eu-ai-act"
],
"templateIds": [
"tpl-red-team-evidence",
"tpl-board-review"
]
},
{
"controlId": "ctrl-fair-allocation",
"title": "Test allocation effects and disparities",
"objective": "Evaluate whether decisions, rankings or allocations create unjustified differences in resources or opportunities and record mitigation and residual disparity decisions.",
"controlType": "preventive",
"lifecycleGates": [
"classify",
"assess",
"prove"
],
"evidenceKinds": [
"allocation-impact-assessment",
"group-outcome-test",
"trade-off-decision",
"residual-disparity-disclosure"
],
"indicatorIds": [
"kpi-subgroup-evaluation-coverage",
"kri-residual-disparity-rate"
],
"sourceIds": [
"src-nist-ai-rmf",
"src-iso-42005",
"src-eu-ai-act"
],
"templateIds": [
"tpl-board-review"
]
},
{
"controlId": "ctrl-harmful-representation",
"title": "Detect stereotyping, demeaning and erasing outputs",
"objective": "Test representational harms across languages, cultures and intersecting groups, including refusal, omission and generated-content failure modes.",
"controlType": "detective",
"lifecycleGates": [
"assess",
"measure",
"prove"
],
"evidenceKinds": [
"representation-test-set",
"harmful-output-evaluation",
"mitigation-result",
"residual-harm-record"
],
"indicatorIds": [
"kri-harmful-representation-rate"
],
"sourceIds": [
"src-nist-genai-profile",
"src-iso-42005"
],
"templateIds": [
"tpl-red-team-evidence"
]
},
{
"controlId": "ctrl-system-card-explanations",
"title": "Maintain a system card and test stakeholder explanations",
"objective": "Keep intended use, components, data, performance, limitations, human authority and monitoring current, and test whether each stakeholder group can understand and act on the explanation provided.",
"controlType": "directive",
"lifecycleGates": [
"frame",
"assess",
"control",
"prove"
],
"evidenceKinds": [
"system-card",
"stakeholder-explanation",
"comprehension-test",
"limitation-disclosure"
],
"indicatorIds": [
"kpi-system-card-coverage",
"kpi-explanation-comprehension"
],
"sourceIds": [
"src-nist-ai-rmf",
"src-iso-42005",
"src-eu-ai-act"
],
"templateIds": [
"tpl-board-review",
"tpl-contribution-starter"
]
},
{
"controlId": "ctrl-affected-person-notice",
"title": "Provide timely notice to affected people",
"objective": "Inform affected people about material AI involvement, decision significance, available human contact, explanation and challenge routes in an accessible form.",
"controlType": "directive",
"lifecycleGates": [
"classify",
"control",
"measure"
],
"evidenceKinds": [
"notice-template",
"delivery-log",
"accessibility-review",
"channel-coverage-test"
],
"indicatorIds": [
"kpi-notice-delivery-coverage"
],
"sourceIds": [
"src-eu-ai-act",
"src-eu-article50-guidelines",
"src-wcag-22"
],
"templateIds": [
"tpl-incident-response"
]
},
{
"controlId": "ctrl-appeal-remedy",
"title": "Operate appeal, independent review and remedy",
"objective": "Provide an accessible intake route, conflict-independent reviewer, decision deadline, reasoned outcome and tracked correction, restoration or compensation route where applicable.",
"controlType": "corrective",
"lifecycleGates": [
"control",
"measure",
"prove"
],
"evidenceKinds": [
"appeal-case",
"independence-check",
"review-outcome",
"remedy-record"
],
"indicatorIds": [
"kpi-appeal-resolution-sla",
"kri-overdue-remedy-rate"
],
"sourceIds": [
"src-eu-ai-act",
"src-iso-42005"
],
"templateIds": [
"tpl-incident-response",
"tpl-board-review"
]
},
{
"controlId": "ctrl-article50-transparency",
"title": "Enforce Article 50 notices, marking, labelling and provenance",
"objective": "Determine provider and deployer duties, disclose direct AI interaction, apply detectable machine-readable marks to in-scope synthetic content, preserve provenance and test required labels and exceptions.",
"controlType": "preventive",
"lifecycleGates": [
"classify",
"control",
"measure",
"prove"
],
"evidenceKinds": [
"article50-applicability-record",
"interaction-notice-test",
"machine-readable-marking-test",
"deployer-label-record",
"content-provenance-record"
],
"indicatorIds": [
"kpi-machine-readable-marking-coverage",
"kri-provenance-verification-failure-rate"
],
"sourceIds": [
"src-eu-ai-act",
"src-eu-article50-guidelines"
],
"templateIds": [
"tpl-board-review"
]
},
{
"controlId": "ctrl-data-governance-lifecycle",
"title": "Govern complete data and knowledge-source lifecycles",
"objective": "Trace datasets, prompts, retrieval corpora, embeddings and derived data through origin, transformation, permission, quality, use, retention, deletion and change impact.",
"controlType": "preventive",
"lifecycleGates": [
"frame",
"assess",
"control",
"measure",
"prove"
],
"evidenceKinds": [
"dataset-lineage-record",
"transformation-log",
"permission-record",
"retention-schedule",
"deletion-verification"
],
"indicatorIds": [
"kpi-data-lifecycle-coverage",
"kpi-deletion-verification-coverage",
"kpi-provenance-coverage"
],
"sourceIds": [
"src-eu-gdpr",
"src-eu-ai-act",
"src-nist-ai-rmf"
],
"templateIds": [
"tpl-procurement",
"tpl-board-review"
]
},
{
"controlId": "ctrl-annotation-quality",
"title": "Assure annotation and ground-truth quality",
"objective": "Define annotation instructions, annotator competence, sampling, agreement, dispute resolution, drift review and known ground-truth limitations.",
"controlType": "detective",
"lifecycleGates": [
"assess",
"measure",
"prove"
],
"evidenceKinds": [
"annotation-protocol",
"annotator-competence-record",
"inter-annotator-test",
"quality-sample",
"dispute-log"
],
"indicatorIds": [
"kpi-annotation-quality-coverage"
],
"sourceIds": [
"src-nist-ai-rmf",
"src-iso-42005"
],
"templateIds": [
"tpl-red-team-evidence"
]
},
{
"controlId": "ctrl-privacy-lifecycle",
"title": "Apply privacy obligations across the AI lifecycle",
"objective": "Record actor roles, purposes, lawful basis, necessity, minimisation, data-subject rights, retention, deletion and privacy-risk decisions for personal data used by or exposed to AI.",
"controlType": "preventive",
"lifecycleGates": [
"frame",
"classify",
"assess",
"control",
"prove"
],
"evidenceKinds": [
"privacy-role-record",
"lawful-basis-record",
"necessity-test",
"rights-procedure",
"retention-schedule",
"deletion-verification"
],
"indicatorIds": [
"kpi-data-lifecycle-coverage",
"kpi-deletion-verification-coverage",
"kri-sensitive-data-events"
],
"sourceIds": [
"src-eu-gdpr",
"src-nist-ai-rmf"
],
"templateIds": [
"tpl-procurement",
"tpl-board-review"
]
},
{
"controlId": "ctrl-gpai-provider",
"title": "Operate the GPAI provider obligation pack",
"objective": "For in-scope providers, maintain technical documentation, downstream information, copyright policy, training-content summary and Code-of-Practice or equivalent compliance evidence.",
"controlType": "directive",
"lifecycleGates": [
"classify",
"control",
"measure",
"prove"
],
"evidenceKinds": [
"gpai-role-assessment",
"technical-documentation",
"downstream-information-pack",
"copyright-policy",
"training-content-summary",
"code-conformity-record"
],
"indicatorIds": [
"kpi-gpai-obligation-evidence-coverage"
],
"sourceIds": [
"src-eu-ai-act",
"src-eu-gpai-code"
],
"templateIds": [
"tpl-procurement",
"tpl-board-review"
]
},
{
"controlId": "ctrl-gpai-deployer",
"title": "Operate the GPAI deployer and integrator control pack",
"objective": "Record model selection, contractual rights, provider documentation, configuration, downstream context, evaluation, monitoring and material modifications for GPAI use.",
"controlType": "preventive",
"lifecycleGates": [
"classify",
"assess",
"control",
"measure",
"prove"
],
"evidenceKinds": [
"gpai-role-assessment",
"model-component-inventory",
"provider-evidence-review",
"deployment-evaluation",
"material-modification-record"
],
"indicatorIds": [
"kpi-gpai-obligation-evidence-coverage",
"kpi-vendor-evidence-coverage"
],
"sourceIds": [
"src-eu-ai-act",
"src-eu-gpai-code",
"src-nist-genai-profile"
],
"templateIds": [
"tpl-procurement",
"tpl-red-team-evidence"
]
},
{
"controlId": "ctrl-systemic-risk",
"title": "Evaluate and mitigate GPAI systemic risk",
"objective": "Identify model-capability, misuse, cyber, autonomy, societal and cascading risks; run proportionate evaluations and adversarial tests; document mitigations and unresolved systemic-risk findings.",
"controlType": "preventive",
"lifecycleGates": [
"classify",
"assess",
"control",
"measure",
"prove"
],
"evidenceKinds": [
"systemic-risk-assessment",
"model-evaluation",
"adversarial-test-result",
"risk-mitigation-record",
"systemic-incident-record"
],
"indicatorIds": [
"kri-systemic-risk-finding-rate",
"kri-critical-test-failure-rate"
],
"sourceIds": [
"src-eu-ai-act",
"src-eu-gpai-code",
"src-nist-genai-profile",
"src-owasp-llm-top10"
],
"templateIds": [
"tpl-red-team-evidence",
"tpl-incident-response"
]
},
{
"controlId": "ctrl-regulatory-incident-reporting",
"title": "Classify and report serious incidents within applicable clocks",
"objective": "Start a jurisdiction-specific clock at detection, preserve evidence, determine reportability, notify competent authorities and affected parties, and document updates and closure without delaying containment.",
"controlType": "corrective",
"lifecycleGates": [
"control",
"measure",
"prove"
],
"evidenceKinds": [
"serious-incident-record",
"reportability-decision",
"regulatory-clock-log",
"notification-receipt",
"corrective-action-record"
],
"indicatorIds": [
"kpi-regulatory-reporting-clock-compliance",
"kpi-incident-triage-time"
],
"sourceIds": [
"src-eu-ai-act",
"src-iso-42001"
],
"templateIds": [
"tpl-incident-response",
"tpl-board-review"
]
},
{
"controlId": "ctrl-decommissioning",
"title": "Gate withdrawal, retirement and decommissioning",
"objective": "Plan service withdrawal, customer transition, model and data disposition, capability revocation, residual monitoring and accountable closure before operation ends.",
"controlType": "corrective",
"lifecycleGates": [
"control",
"measure",
"prove"
],
"evidenceKinds": [
"decommission-plan",
"stakeholder-notice",
"data-disposition-record",
"access-revocation-log",
"retirement-verification"
],
"indicatorIds": [
"kpi-decommissioning-evidence-coverage"
],
"sourceIds": [
"src-iso-42001",
"src-nist-ai-rmf",
"src-eu-ai-act"
],
"templateIds": [
"tpl-board-review",
"tpl-incident-response"
]
},
{
"controlId": "ctrl-ai-output-accessibility",
"title": "Test accessible AI interactions and generated outcomes",
"objective": "Test interfaces, notices, explanations, generated content, review and appeal routes with assistive technologies and representative disabled users across supported modalities.",
"controlType": "preventive",
"lifecycleGates": [
"assess",
"control",
"measure",
"prove"
],
"evidenceKinds": [
"accessibility-test-plan",
"assistive-technology-result",
"user-evaluation",
"conformance-report",
"remediation-record"
],
"indicatorIds": [
"kpi-accessibility-test-pass-rate",
"kri-accessibility-blocker-rate"
],
"sourceIds": [
"src-wcag-22",
"src-iso-42005",
"src-eu-ai-act"
],
"templateIds": [
"tpl-red-team-evidence",
"tpl-board-review"
]
},
{
"controlId": "ctrl-environmental-performance",
"title": "Measure and govern AI environmental performance",
"objective": "Define material energy, carbon, water and hardware indicators, establish baselines and budgets, compare alternatives and gate material environmental regressions.",
"controlType": "preventive",
"lifecycleGates": [
"frame",
"assess",
"measure",
"prove"
],
"evidenceKinds": [
"environmental-boundary-record",
"energy-measurement",
"emissions-calculation",
"alternative-analysis",
"budget-decision"
],
"indicatorIds": [
"kpi-energy-measurement-coverage",
"kri-environmental-budget-variance"
],
"sourceIds": [
"src-iso-42001",
"src-iso-42005",
"src-eu-ai-act"
],
"templateIds": [
"tpl-board-review"
]
},
{
"controlId": "ctrl-ai-literacy-effectiveness",
"title": "Measure role-based AI literacy effectiveness",
"objective": "Map role competencies, deliver contextual learning, assess demonstrated ability, refresh after material change and track whether trained people apply required controls.",
"controlType": "directive",
"lifecycleGates": [
"frame",
"control",
"measure",
"prove"
],
"evidenceKinds": [
"role-competence-matrix",
"learning-record",
"competence-assessment",
"observed-practice-test",
"refresh-record"
],
"indicatorIds": [
"kpi-ai-literacy-competence-rate",
"kri-trained-control-error-rate"
],
"sourceIds": [
"src-eu-ai-act",
"src-iso-42001"
],
"templateIds": [
"tpl-board-review"
]
},
{
"controlId": "ctrl-aims-leadership-objectives",
"title": "Establish AIMS context, leadership, policy and objectives",
"objective": "Define organizational scope, interested parties, accountable leadership, AI policy, measurable objectives, roles, resources and controlled documented information.",
"controlType": "directive",
"lifecycleGates": [
"frame",
"classify",
"prove"
],
"evidenceKinds": [
"aims-scope",
"ai-policy",
"leadership-commitment",
"roles-and-authorities",
"aims-objectives",
"document-control-record"
],
"indicatorIds": [
"kpi-aims-objective-coverage"
],
"sourceIds": [
"src-iso-42001"
],
"templateIds": [
"tpl-board-review"
]
},
{
"controlId": "ctrl-aims-internal-audit",
"title": "Operate risk-based AIMS internal audits",
"objective": "Maintain an independent audit programme covering system and organizational controls, evidence quality, nonconformities and follow-up verification.",
"controlType": "detective",
"lifecycleGates": [
"measure",
"prove"
],
"evidenceKinds": [
"audit-programme",
"auditor-independence-record",
"audit-plan",
"audit-report",
"nonconformity-record"
],
"indicatorIds": [
"kpi-aims-audit-completion",
"kpi-corrective-action-closure"
],
"sourceIds": [
"src-iso-42001"
],
"templateIds": [
"tpl-board-review"
]
},
{
"controlId": "ctrl-aims-management-review-capa",
"title": "Perform management review and corrective action",
"objective": "Review AIMS performance, source and context changes, incidents, audit results, resources and objectives; assign corrective actions and verify effectiveness before closure.",
"controlType": "corrective",
"lifecycleGates": [
"measure",
"prove"
],
"evidenceKinds": [
"management-review-record",
"performance-evaluation",
"corrective-action",
"effectiveness-check",
"continual-improvement-record"
],
"indicatorIds": [
"kpi-corrective-action-closure",
"kpi-aims-objective-coverage"
],
"sourceIds": [
"src-iso-42001"
],
"templateIds": [
"tpl-board-review"
]
},
{
"controlId": "ctrl-runtime-production-boundary",
"title": "Enforce PALO-AI production admission and non-bypassable execution",
"objective": "Refuse production claims unless workload identity, tenant isolation, durable state, external key custody, policy enforcement, trusted connectors, outcome verification and recovery controls are configured and tested.",
"controlType": "preventive",
"lifecycleGates": [
"classify",
"control",
"measure",
"prove"
],
"evidenceKinds": [
"production-profile",
"identity-test",
"tenant-isolation-test",
"persistence-recovery-test",
"key-custody-attestation",
"bypass-resistance-test",
"connector-attestation"
],
"indicatorIds": [
"kpi-production-admission-coverage",
"kri-execution-bypass-rate"
],
"sourceIds": [
"src-iso-42001",
"src-nist-ai-rmf",
"src-owasp-llm-top10"
],
"templateIds": [
"tpl-red-team-evidence",
"tpl-board-review"
]
}
]All 38 indicators with formulas (38)
Source: data/kpi-kri-registry.json · Download full registry
[
{
"indicatorId": "kpi-provenance-coverage",
"type": "KPI",
"name": "Material data provenance coverage",
"purpose": "Track whether material data inputs have reviewed provenance records.",
"formula": "reviewed material data sources / identified material data sources * 100",
"cadence": "monthly and before material change",
"direction": "higher-is-better",
"thresholds": {
"amber": "below 95%",
"red": "below 85%"
},
"controlIds": [
"ctrl-data-provenance",
"ctrl-decision-trace"
],
"gateIds": [
"assess",
"prove"
],
"sourceIds": [
"src-nist-ai-rmf"
],
"caveat": "Coverage measures documentation presence, not correctness, permission, or fitness for use."
},
{
"indicatorId": "kpi-review-completion",
"type": "KPI",
"name": "Required review completion",
"purpose": "Track whether decisions requiring human review received a recorded review before execution.",
"formula": "eligible decisions with timely recorded review / eligible decisions * 100",
"cadence": "weekly",
"direction": "higher-is-better",
"thresholds": {
"amber": "below 98%",
"red": "below 95%"
},
"controlIds": [
"ctrl-human-review",
"ctrl-change-gate",
"ctrl-decision-trace"
],
"gateIds": [
"control",
"measure",
"prove"
],
"sourceIds": [
"src-oecd-ai-principles",
"src-nist-ai-rmf"
],
"caveat": "Completion alone does not show that review was informed, independent, or able to alter the outcome."
},
{
"indicatorId": "kpi-vendor-evidence-coverage",
"type": "KPI",
"name": "Supplier evidence coverage",
"purpose": "Track completion of required supplier evidence items for in-scope services.",
"formula": "accepted required supplier evidence items / required supplier evidence items * 100",
"cadence": "quarterly and at renewal",
"direction": "higher-is-better",
"thresholds": {
"amber": "below 90%",
"red": "below 75%"
},
"controlIds": [
"ctrl-third-party-due-diligence"
],
"gateIds": [
"assess",
"control"
],
"sourceIds": [
"src-iso-42001"
],
"caveat": "Accepted evidence must still be tested for relevance, recency, scope and independent support."
},
{
"indicatorId": "kpi-incident-triage-time",
"type": "KPI",
"name": "Median incident triage time",
"purpose": "Track elapsed time from detection to accountable initial classification and containment assignment.",
"formula": "median minutes from detectedAt to triagedAt for in-scope incidents",
"cadence": "monthly",
"direction": "lower-is-better",
"thresholds": {
"amber": "over 240 minutes",
"red": "over 480 minutes"
},
"controlIds": [
"ctrl-incident-response"
],
"gateIds": [
"measure",
"prove"
],
"sourceIds": [
"src-nist-ai-rmf"
],
"caveat": "Fast triage is not equivalent to correct severity, containment quality, or regulatory reporting."
},
{
"indicatorId": "kri-scope-change-rate",
"type": "KRI",
"name": "Ungated material scope changes",
"purpose": "Detect purpose, population, authority or workflow changes that bypassed the change gate.",
"formula": "ungated material changes / identified material changes * 100",
"cadence": "monthly",
"direction": "lower-is-better",
"thresholds": {
"amber": "above 0%",
"red": "above 5%"
},
"controlIds": [
"ctrl-purpose-boundary",
"ctrl-change-gate"
],
"gateIds": [
"frame",
"classify",
"prove"
],
"sourceIds": [
"src-nist-ai-rmf"
],
"caveat": "A useful denominator depends on reliable change detection and an agreed definition of material change."
},
{
"indicatorId": "kri-sensitive-data-events",
"type": "KRI",
"name": "Sensitive-data control events",
"purpose": "Surface unauthorized access, disclosure, retention or use involving sensitive data.",
"formula": "count of confirmed in-scope sensitive-data control events",
"cadence": "continuous with monthly review",
"direction": "lower-is-better",
"thresholds": {
"amber": "1 event",
"red": "2 or more events or any severe event"
},
"controlIds": [
"ctrl-data-provenance",
"ctrl-incident-response"
],
"gateIds": [
"control",
"measure",
"prove"
],
"sourceIds": [
"src-eu-ai-act",
"src-nist-ai-rmf"
],
"caveat": "Counts depend on detection quality and do not by themselves determine legal incident materiality."
},
{
"indicatorId": "kri-override-failure-rate",
"type": "KRI",
"name": "Human override failure rate",
"purpose": "Detect cases where a required reviewer could not pause, alter or reverse a system action.",
"formula": "failed override attempts / recorded override attempts * 100",
"cadence": "weekly",
"direction": "lower-is-better",
"thresholds": {
"amber": "above 0%",
"red": "above 2% or any severe consequence"
},
"controlIds": [
"ctrl-human-review"
],
"gateIds": [
"control",
"measure"
],
"sourceIds": [
"src-oecd-ai-principles",
"src-eu-ai-act"
],
"caveat": "Low rates can hide low usage, poor logging or reviewers avoiding an ineffective mechanism."
},
{
"indicatorId": "kri-critical-test-failure-rate",
"type": "KRI",
"name": "Critical adversarial test failure rate",
"purpose": "Track unresolved critical failures in approved misuse and failure scenarios.",
"formula": "unresolved critical failed tests / executed critical tests * 100",
"cadence": "per release and monthly for adaptive systems",
"direction": "lower-is-better",
"thresholds": {
"amber": "above 0%",
"red": "any failure without an approved containment decision"
},
"controlIds": [
"ctrl-adversarial-testing"
],
"gateIds": [
"assess",
"measure",
"prove"
],
"sourceIds": [
"src-nist-genai-profile",
"src-owasp-llm-top10"
],
"caveat": "The metric is only as useful as scenario coverage, test independence and severity calibration."
},
{
"indicatorId": "kri-tool-call-error-rate",
"type": "KRI",
"name": "Tool call error rate",
"purpose": "Track the rate of malformed, hallucinated, or unauthorized tool calls made by autonomous agents.",
"formula": "unauthorized or failed tool calls / total tool calls * 100",
"cadence": "weekly and per release",
"direction": "lower-is-better",
"thresholds": {
"amber": "above 1%",
"red": "above 5% or any unauthorized write attempt"
},
"controlIds": [
"ctrl-human-review"
],
"gateIds": [
"control",
"measure"
],
"sourceIds": [
"src-nist-ai-rmf"
],
"caveat": "High error rates indicate semantic drift, poor schema alignment, or attempt to bypass controls."
},
{
"indicatorId": "kri-multi-agent-conflict-rate",
"type": "KRI",
"name": "Multi-agent conflict rate",
"purpose": "Track deadlocked, conflicting, or terminated multi-agent workflows.",
"formula": "deadlocked or failed workflow runs / total multi-agent runs * 100",
"cadence": "weekly",
"direction": "lower-is-better",
"thresholds": {
"amber": "above 2%",
"red": "above 10%"
},
"controlIds": [
"ctrl-human-review"
],
"gateIds": [
"control",
"measure"
],
"sourceIds": [
"src-nist-ai-rmf"
],
"caveat": "Signals goal conflicts, prompt mismatches, or infinite message loop issues."
},
{
"indicatorId": "kpi-subgroup-evaluation-coverage",
"type": "KPI",
"name": "Applicable subgroup evaluation coverage",
"purpose": "Track whether approved demographic and intersectional groups are represented in release and monitoring evaluations.",
"formula": "applicable approved subgroups with accepted evaluation evidence / applicable approved subgroups * 100",
"cadence": "per release, after material change and quarterly",
"direction": "higher-is-better",
"thresholds": {
"amber": "below 100%",
"red": "below 95% or any omitted high-impact group"
},
"controlIds": [
"ctrl-fairness-quality-of-service",
"ctrl-fair-allocation"
],
"gateIds": [
"assess",
"measure",
"prove"
],
"sourceIds": [
"src-nist-ai-rmf",
"src-iso-42005"
],
"caveat": "Coverage does not show that group definitions, sample sizes, metrics or thresholds are appropriate."
},
{
"indicatorId": "kri-residual-disparity-rate",
"type": "KRI",
"name": "Unaccepted residual disparity rate",
"purpose": "Surface subgroup metric comparisons that exceed an approved maximum difference without an accountable residual-risk decision.",
"formula": "subgroup comparisons above approved difference threshold without accepted decision / applicable subgroup comparisons * 100",
"cadence": "per release and monthly for adaptive systems",
"direction": "lower-is-better",
"thresholds": {
"amber": "above 0%",
"red": "any unresolved material disparity"
},
"controlIds": [
"ctrl-fairness-quality-of-service",
"ctrl-fair-allocation"
],
"gateIds": [
"assess",
"measure",
"prove"
],
"sourceIds": [
"src-nist-ai-rmf",
"src-eu-ai-act"
],
"caveat": "A numerical threshold cannot by itself determine whether a difference is lawful, fair or acceptable."
},
{
"indicatorId": "kri-harmful-representation-rate",
"type": "KRI",
"name": "Material harmful-representation rate",
"purpose": "Track unresolved stereotyping, demeaning, erasing or culturally harmful outputs in approved test scenarios.",
"formula": "unresolved material harmful outputs / executed representation scenarios * 100",
"cadence": "per release and monthly",
"direction": "lower-is-better",
"thresholds": {
"amber": "above 0%",
"red": "any severe output or repeated group-specific pattern"
},
"controlIds": [
"ctrl-harmful-representation"
],
"gateIds": [
"assess",
"measure",
"prove"
],
"sourceIds": [
"src-nist-genai-profile",
"src-iso-42005"
],
"caveat": "Results depend on culturally competent scenario design, reviewers and supported languages."
},
{
"indicatorId": "kpi-system-card-coverage",
"type": "KPI",
"name": "Current system-card coverage",
"purpose": "Track whether in-scope systems have an approved card reflecting the deployed version, use, limitations, data, performance and controls.",
"formula": "in-scope deployed systems with current approved system cards / in-scope deployed systems * 100",
"cadence": "per release and quarterly",
"direction": "higher-is-better",
"thresholds": {
"amber": "below 100%",
"red": "any high-impact system without a current card"
},
"controlIds": [
"ctrl-system-card-explanations"
],
"gateIds": [
"frame",
"assess",
"prove"
],
"sourceIds": [
"src-nist-ai-rmf",
"src-eu-ai-act"
],
"caveat": "A current card is documentation evidence, not proof that its claims are accurate or understood."
},
{
"indicatorId": "kpi-explanation-comprehension",
"type": "KPI",
"name": "Stakeholder explanation comprehension",
"purpose": "Measure whether representative stakeholders can correctly understand limitations, significance, human authority and available actions.",
"formula": "participants meeting the approved comprehension rubric / tested representative participants * 100",
"cadence": "before release, after material explanation change and annually",
"direction": "higher-is-better",
"thresholds": {
"amber": "below 85%",
"red": "below 70% or any critical misunderstanding"
},
"controlIds": [
"ctrl-system-card-explanations"
],
"gateIds": [
"assess",
"control",
"prove"
],
"sourceIds": [
"src-iso-42005",
"src-wcag-22"
],
"caveat": "The organization must justify participant selection, language, accessibility and the comprehension rubric."
},
{
"indicatorId": "kpi-notice-delivery-coverage",
"type": "KPI",
"name": "Affected-person notice delivery coverage",
"purpose": "Track whether people receive an accessible notice before or at the point of material AI interaction or effect.",
"formula": "eligible interactions or decisions with verified notice delivery / eligible interactions or decisions * 100",
"cadence": "continuous with monthly review",
"direction": "higher-is-better",
"thresholds": {
"amber": "below 99%",
"red": "below 95% or any systematic channel failure"
},
"controlIds": [
"ctrl-affected-person-notice"
],
"gateIds": [
"control",
"measure"
],
"sourceIds": [
"src-eu-ai-act",
"src-eu-article50-guidelines",
"src-wcag-22"
],
"caveat": "Delivery does not establish comprehension, legal adequacy or that all eligible events were detected."
},
{
"indicatorId": "kpi-appeal-resolution-sla",
"type": "KPI",
"name": "Appeals resolved within approved service level",
"purpose": "Track timely, reasoned and conflict-independent review of affected-person appeals.",
"formula": "eligible appeals resolved within approved deadline / eligible resolved appeals * 100",
"cadence": "monthly",
"direction": "higher-is-better",
"thresholds": {
"amber": "below 95%",
"red": "below 85% or any urgent case overdue"
},
"controlIds": [
"ctrl-appeal-remedy"
],
"gateIds": [
"measure",
"prove"
],
"sourceIds": [
"src-eu-ai-act",
"src-iso-42005"
],
"caveat": "Speed does not establish reviewer independence, procedural fairness or remedy effectiveness."
},
{
"indicatorId": "kri-overdue-remedy-rate",
"type": "KRI",
"name": "Overdue remedy rate",
"purpose": "Surface accepted corrections, restoration or other remedies that remain incomplete beyond their accountable deadline.",
"formula": "open remedies past due / open and completed remedies in period * 100",
"cadence": "weekly",
"direction": "lower-is-better",
"thresholds": {
"amber": "above 0%",
"red": "above 5% or any severe-harm remedy overdue"
},
"controlIds": [
"ctrl-appeal-remedy"
],
"gateIds": [
"measure",
"prove"
],
"sourceIds": [
"src-iso-42005"
],
"caveat": "A closed remedy still requires evidence that the affected outcome was actually corrected."
},
{
"indicatorId": "kpi-machine-readable-marking-coverage",
"type": "KPI",
"name": "Machine-readable synthetic-content marking coverage",
"purpose": "Track successful application and independent detection of configured marks on in-scope generated or manipulated content.",
"formula": "in-scope content samples with independently detected valid marks / tested in-scope content samples * 100",
"cadence": "per release and daily production sample",
"direction": "higher-is-better",
"thresholds": {
"amber": "below 99%",
"red": "below 95% or any systematically unmarked modality"
},
"controlIds": [
"ctrl-article50-transparency"
],
"gateIds": [
"control",
"measure",
"prove"
],
"sourceIds": [
"src-eu-ai-act",
"src-eu-article50-guidelines"
],
"caveat": "Mark detection in a test set does not prove robustness after downstream transformation or legal sufficiency."
},
{
"indicatorId": "kri-provenance-verification-failure-rate",
"type": "KRI",
"name": "Content provenance verification failure rate",
"purpose": "Detect missing, invalid or broken content-provenance assertions in in-scope outputs.",
"formula": "content samples with missing or invalid expected provenance / tested content samples * 100",
"cadence": "daily with release review",
"direction": "lower-is-better",
"thresholds": {
"amber": "above 1%",
"red": "above 5% or any unexplained signing-key failure"
},
"controlIds": [
"ctrl-article50-transparency"
],
"gateIds": [
"measure",
"prove"
],
"sourceIds": [
"src-eu-article50-guidelines"
],
"caveat": "Provenance assertions indicate origin and processing claims; they do not establish that content is truthful."
},
{
"indicatorId": "kpi-data-lifecycle-coverage",
"type": "KPI",
"name": "Material data lifecycle coverage",
"purpose": "Track complete records for origin, transformations, permissions, quality, purpose, retention and disposition of material data assets.",
"formula": "material data assets with accepted lifecycle records / identified material data assets * 100",
"cadence": "monthly and before material change",
"direction": "higher-is-better",
"thresholds": {
"amber": "below 95%",
"red": "below 85% or any unrecorded sensitive dataset"
},
"controlIds": [
"ctrl-data-governance-lifecycle",
"ctrl-privacy-lifecycle"
],
"gateIds": [
"frame",
"assess",
"control",
"prove"
],
"sourceIds": [
"src-eu-gdpr",
"src-eu-ai-act",
"src-nist-ai-rmf"
],
"caveat": "Record completeness does not prove that permissions, lawful basis, quality or retention decisions are correct."
},
{
"indicatorId": "kpi-annotation-quality-coverage",
"type": "KPI",
"name": "Annotation quality assurance coverage",
"purpose": "Track whether material annotated datasets have current protocols, competence evidence, sampling and agreement results.",
"formula": "material annotated datasets with accepted QA evidence / material annotated datasets * 100",
"cadence": "per dataset release and quarterly",
"direction": "higher-is-better",
"thresholds": {
"amber": "below 100%",
"red": "any production dataset without an accepted QA sample"
},
"controlIds": [
"ctrl-annotation-quality"
],
"gateIds": [
"assess",
"measure",
"prove"
],
"sourceIds": [
"src-nist-ai-rmf",
"src-iso-42005"
],
"caveat": "Agreement can be high while instructions or ground truth remain biased or conceptually invalid."
},
{
"indicatorId": "kpi-deletion-verification-coverage",
"type": "KPI",
"name": "Due data deletion verification coverage",
"purpose": "Track verified deletion or approved legal hold across primary data, replicas, embeddings, caches and derived artifacts.",
"formula": "due deletion items with verified disposition or approved hold / due deletion items * 100",
"cadence": "weekly",
"direction": "higher-is-better",
"thresholds": {
"amber": "below 99%",
"red": "below 95% or any sensitive-data deadline missed"
},
"controlIds": [
"ctrl-data-governance-lifecycle",
"ctrl-privacy-lifecycle"
],
"gateIds": [
"control",
"measure",
"prove"
],
"sourceIds": [
"src-eu-gdpr"
],
"caveat": "Verification scope must explicitly cover backups, immutable records and technically non-deletable derived artifacts."
},
{
"indicatorId": "kpi-gpai-obligation-evidence-coverage",
"type": "KPI",
"name": "Applicable GPAI obligation evidence coverage",
"purpose": "Track accepted evidence for each provider, deployer or integrator obligation activated by the role assessment.",
"formula": "applicable GPAI obligations with accepted evidence / applicable GPAI obligations * 100",
"cadence": "monthly and before release or material modification",
"direction": "higher-is-better",
"thresholds": {
"amber": "below 100%",
"red": "any overdue mandatory evidence item"
},
"controlIds": [
"ctrl-gpai-provider",
"ctrl-gpai-deployer"
],
"gateIds": [
"classify",
"control",
"measure",
"prove"
],
"sourceIds": [
"src-eu-ai-act",
"src-eu-gpai-code"
],
"caveat": "The denominator depends on a legally reviewed role and applicability assessment."
},
{
"indicatorId": "kri-systemic-risk-finding-rate",
"type": "KRI",
"name": "Unresolved material systemic-risk finding rate",
"purpose": "Track material model-capability, misuse, cyber, autonomy, societal or cascading-risk findings without accepted mitigation.",
"formula": "unresolved material systemic-risk findings / executed systemic-risk scenarios * 100",
"cadence": "per model release and monthly",
"direction": "lower-is-better",
"thresholds": {
"amber": "above 0%",
"red": "any critical finding or untested critical scenario"
},
"controlIds": [
"ctrl-systemic-risk"
],
"gateIds": [
"assess",
"control",
"measure",
"prove"
],
"sourceIds": [
"src-eu-gpai-code",
"src-nist-genai-profile"
],
"caveat": "Scenario selection and model-access constraints can materially understate systemic risk."
},
{
"indicatorId": "kpi-regulatory-reporting-clock-compliance",
"type": "KPI",
"name": "Applicable regulatory reporting clock compliance",
"purpose": "Track on-time initial and follow-up notifications for incidents determined reportable in each jurisdiction.",
"formula": "required notifications submitted within applicable clock / required notifications * 100",
"cadence": "continuous with monthly review",
"direction": "higher-is-better",
"thresholds": {
"amber": "below 100%",
"red": "any missed mandatory reporting deadline"
},
"controlIds": [
"ctrl-regulatory-incident-reporting"
],
"gateIds": [
"measure",
"prove"
],
"sourceIds": [
"src-eu-ai-act"
],
"caveat": "Timeliness depends on correct detection, jurisdiction mapping, reportability analysis and clock-start evidence."
},
{
"indicatorId": "kpi-decommissioning-evidence-coverage",
"type": "KPI",
"name": "Decommissioning evidence coverage",
"purpose": "Track completion of customer transition, capability revocation, data disposition, residual monitoring and closure evidence.",
"formula": "accepted due decommissioning evidence items / due decommissioning evidence items * 100",
"cadence": "weekly during retirement and at closure",
"direction": "higher-is-better",
"thresholds": {
"amber": "below 100%",
"red": "any unresolved safety, access or sensitive-data item at closure"
},
"controlIds": [
"ctrl-decommissioning"
],
"gateIds": [
"control",
"measure",
"prove"
],
"sourceIds": [
"src-iso-42001",
"src-nist-ai-rmf"
],
"caveat": "An evidence item can be present while downstream copies, user dependencies or residual harms remain."
},
{
"indicatorId": "kpi-accessibility-test-pass-rate",
"type": "KPI",
"name": "Applicable accessibility test pass rate",
"purpose": "Measure supported interface, notice, explanation, generated-output and remedy scenarios that meet approved accessibility criteria.",
"formula": "passed applicable accessibility scenarios / executed applicable accessibility scenarios * 100",
"cadence": "per release and quarterly",
"direction": "higher-is-better",
"thresholds": {
"amber": "below 98%",
"red": "below 95% or any critical journey blocked"
},
"controlIds": [
"ctrl-ai-output-accessibility"
],
"gateIds": [
"assess",
"control",
"measure",
"prove"
],
"sourceIds": [
"src-wcag-22"
],
"caveat": "Automated conformance checks must be supplemented by manual assistive-technology and representative-user evaluation."
},
{
"indicatorId": "kri-accessibility-blocker-rate",
"type": "KRI",
"name": "Unresolved accessibility blocker rate",
"purpose": "Surface critical user journeys that disabled users cannot complete independently or through an equivalent route.",
"formula": "unresolved blocked critical journeys / tested critical journeys * 100",
"cadence": "per release and weekly while blockers are open",
"direction": "lower-is-better",
"thresholds": {
"amber": "above 0%",
"red": "any high-impact notice, review or remedy journey blocked"
},
"controlIds": [
"ctrl-ai-output-accessibility"
],
"gateIds": [
"control",
"measure",
"prove"
],
"sourceIds": [
"src-wcag-22",
"src-iso-42005"
],
"caveat": "The tested journey inventory must include supported modalities, languages and assistive technologies."
},
{
"indicatorId": "kpi-energy-measurement-coverage",
"type": "KPI",
"name": "Material AI energy measurement coverage",
"purpose": "Track energy measurements or documented estimation methods for material training, evaluation and inference workloads.",
"formula": "material AI workloads with accepted energy measurement or estimate / material AI workloads * 100",
"cadence": "monthly and per release",
"direction": "higher-is-better",
"thresholds": {
"amber": "below 90%",
"red": "below 75% or no baseline for a material workload"
},
"controlIds": [
"ctrl-environmental-performance"
],
"gateIds": [
"assess",
"measure",
"prove"
],
"sourceIds": [
"src-iso-42001",
"src-iso-42005"
],
"caveat": "Estimates must state boundaries, allocation assumptions, location and temporal electricity factors."
},
{
"indicatorId": "kri-environmental-budget-variance",
"type": "KRI",
"name": "Environmental budget variance",
"purpose": "Detect material energy, emissions, water or hardware impacts above approved lifecycle budgets.",
"formula": "actual or estimated impact minus approved budget, divided by approved budget * 100",
"cadence": "monthly and per release",
"direction": "within-range",
"thresholds": {
"amber": "more than 10% above budget",
"red": "more than 25% above budget or any unapproved material regression"
},
"controlIds": [
"ctrl-environmental-performance"
],
"gateIds": [
"measure",
"prove"
],
"sourceIds": [
"src-iso-42001",
"src-iso-42005"
],
"caveat": "Budgets and calculations require organization-specific boundaries and should not hide absolute impacts behind efficiency ratios."
},
{
"indicatorId": "kpi-ai-literacy-competence-rate",
"type": "KPI",
"name": "Role-based AI competence demonstration rate",
"purpose": "Measure whether people in AI roles demonstrate the required knowledge and practical control behavior for their responsibilities.",
"formula": "in-scope people passing current role-based competence assessment / in-scope people * 100",
"cadence": "quarterly and after material role or system change",
"direction": "higher-is-better",
"thresholds": {
"amber": "below 95%",
"red": "below 85% or any unqualified high-authority role"
},
"controlIds": [
"ctrl-ai-literacy-effectiveness"
],
"gateIds": [
"frame",
"control",
"measure",
"prove"
],
"sourceIds": [
"src-eu-ai-act",
"src-iso-42001"
],
"caveat": "Attendance or quiz completion alone is insufficient; assessment must test role-relevant judgment and control use."
},
{
"indicatorId": "kri-trained-control-error-rate",
"type": "KRI",
"name": "Post-training control error rate",
"purpose": "Detect repeated governance or operational errors by trained roles that indicate ineffective learning or unclear procedures.",
"formula": "confirmed role-relevant control errors by currently trained people / reviewed role-relevant actions * 100",
"cadence": "monthly",
"direction": "lower-is-better",
"thresholds": {
"amber": "above 2%",
"red": "above 5% or any severe preventable error"
},
"controlIds": [
"ctrl-ai-literacy-effectiveness"
],
"gateIds": [
"measure",
"prove"
],
"sourceIds": [
"src-eu-ai-act",
"src-iso-42001"
],
"caveat": "Error attribution must account for system, procedure, workload and authority-design failures rather than blaming individuals by default."
},
{
"indicatorId": "kpi-aims-objective-coverage",
"type": "KPI",
"name": "AIMS objective measurement coverage",
"purpose": "Track measurable, owned and reviewed objectives for material AI management risks and opportunities within the declared AIMS scope.",
"formula": "applicable AIMS objectives with owner, measure, target and review evidence / applicable AIMS objectives * 100",
"cadence": "quarterly",
"direction": "higher-is-better",
"thresholds": {
"amber": "below 100%",
"red": "any material risk without an owned measurable objective"
},
"controlIds": [
"ctrl-aims-leadership-objectives",
"ctrl-aims-management-review-capa"
],
"gateIds": [
"frame",
"classify",
"measure",
"prove"
],
"sourceIds": [
"src-iso-42001"
],
"caveat": "Coverage does not establish ISO/IEC 42001 conformity or the adequacy of selected objectives."
},
{
"indicatorId": "kpi-aims-audit-completion",
"type": "KPI",
"name": "Risk-based AIMS audit completion",
"purpose": "Track completion and accountable reporting of planned internal audits within the approved programme.",
"formula": "completed planned audits with accepted report / audits due in period * 100",
"cadence": "quarterly",
"direction": "higher-is-better",
"thresholds": {
"amber": "below 95%",
"red": "below 85% or any critical scope repeatedly unaudited"
},
"controlIds": [
"ctrl-aims-internal-audit"
],
"gateIds": [
"measure",
"prove"
],
"sourceIds": [
"src-iso-42001"
],
"caveat": "Completion does not establish auditor competence, independence, audit depth or certification."
},
{
"indicatorId": "kpi-corrective-action-closure",
"type": "KPI",
"name": "Corrective action effective closure",
"purpose": "Track timely closure of nonconformities only after root-cause and effectiveness evidence is accepted.",
"formula": "corrective actions closed on time with accepted effectiveness check / corrective actions due * 100",
"cadence": "monthly",
"direction": "higher-is-better",
"thresholds": {
"amber": "below 95%",
"red": "below 85% or any critical nonconformity overdue"
},
"controlIds": [
"ctrl-aims-internal-audit",
"ctrl-aims-management-review-capa"
],
"gateIds": [
"measure",
"prove"
],
"sourceIds": [
"src-iso-42001"
],
"caveat": "Administrative closure without effectiveness verification must not count as completed."
},
{
"indicatorId": "kpi-production-admission-coverage",
"type": "KPI",
"name": "PALO-AI production admission evidence coverage",
"purpose": "Track accepted identity, tenancy, persistence, key-custody, connector, recovery and bypass-resistance evidence before production admission.",
"formula": "accepted mandatory production admission checks / applicable mandatory production admission checks * 100",
"cadence": "per release and quarterly",
"direction": "higher-is-better",
"thresholds": {
"amber": "below 100%",
"red": "any mandatory check absent, failed or expired"
},
"controlIds": [
"ctrl-runtime-production-boundary"
],
"gateIds": [
"classify",
"control",
"measure",
"prove"
],
"sourceIds": [
"src-iso-42001",
"src-nist-ai-rmf"
],
"caveat": "Passing repository checks is not production admission; operational and independent evidence must match the deployed environment."
},
{
"indicatorId": "kri-execution-bypass-rate",
"type": "KRI",
"name": "Protected action bypass rate",
"purpose": "Detect consequential actions reaching external systems without a current claim, decision, capability, receipt and outcome-verification chain.",
"formula": "protected external effects without a valid complete governance chain / protected external effects * 100",
"cadence": "continuous with daily review",
"direction": "lower-is-better",
"thresholds": {
"amber": "above 0%",
"red": "any consequential bypass or unverifiable external effect"
},
"controlIds": [
"ctrl-runtime-production-boundary"
],
"gateIds": [
"control",
"measure",
"prove"
],
"sourceIds": [
"src-nist-ai-rmf",
"src-owasp-llm-top10"
],
"caveat": "The metric requires independent observation of external effects; runtime self-report alone cannot prove non-bypassability."
}
]Semantic spine nodes (46)
Source: data/semantic-spine.json · Download full registry
[
{
"id": "frame",
"label": "Frame",
"number": "01",
"type": "stage",
"phaseId": "frame",
"role": "Define the use case, its boundary, owners and affected people before governance choices are made.",
"status": "Operational phase",
"properties": {
"Core question": "What are we building, for whom, and why?",
"Lifecycle": "Phase 1 Ideation",
"Decision gate": "Is the use case sufficiently defined to classify?"
},
"outputs": [
"Use-case brief"
],
"action": "Describe purpose, scope, owners, affected people and the decision boundary.",
"intents": [
"what should I do first",
"start governance",
"define use case",
"assign owner"
],
"stakeholders": [
"accountable owner",
"product",
"governance"
],
"href": "#frame",
"semanticId": "https://paloframework.org/semantic/stage/frame",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "classify",
"label": "Classify",
"number": "02",
"type": "stage",
"phaseId": "classify",
"role": "Establish the applicable risk route, obligations and level of scrutiny.",
"status": "Operational phase",
"properties": {
"Core question": "What route, obligations, and level of scrutiny apply?",
"Lifecycle": "Phases 1-2 Screening and Assessment",
"Decision gate": "Is the initial risk route justified and current?"
},
"outputs": [
"Risk route"
],
"action": "Run the initial risk route and verify current obligations against official sources.",
"intents": [
"classify risk",
"risk tier",
"applicable obligations",
"high risk"
],
"stakeholders": [
"legal",
"risk",
"governance"
],
"href": "#classify",
"semanticId": "https://paloframework.org/semantic/stage/classify",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "assess",
"label": "Assess",
"number": "03",
"type": "stage",
"phaseId": "assess",
"role": "Evaluate impacts, rights, delegated authority, autonomy and oversight conditions.",
"status": "Operational phase",
"properties": {
"Core question": "What impacts, rights, authority, and oversight conditions exist?",
"Lifecycle": "Phase 2 Assessment and Planning",
"Decision gate": "Are impacts and delegated authority understood well enough to control?"
},
"outputs": [
"Impact assessment record"
],
"action": "Evaluate impacts, fundamental rights, authority, autonomy and human oversight.",
"intents": [
"fundamental rights",
"agent autonomy",
"assess impact",
"human oversight"
],
"stakeholders": [
"legal",
"risk",
"product",
"public sector"
],
"href": "#assess",
"semanticId": "https://paloframework.org/semantic/stage/assess",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "control",
"label": "Control",
"number": "04",
"type": "stage",
"phaseId": "control",
"role": "Translate findings into owned, testable engineering, process and assurance controls.",
"status": "Operational phase",
"properties": {
"Core question": "Which controls make the identified risks governable?",
"Lifecycle": "Phases 2-3 Planning, Development, and Validation",
"Decision gate": "Are controls implemented, testable, and owned?"
},
"outputs": [
"Control plan"
],
"action": "Convert findings into owned controls with tests, evidence and decision gates.",
"intents": [
"select controls",
"implement controls",
"assurance test",
"development governance"
],
"stakeholders": [
"engineering",
"product",
"assurance"
],
"href": "#control",
"semanticId": "https://paloframework.org/semantic/stage/control",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "measure",
"label": "Measure",
"number": "05",
"type": "stage",
"phaseId": "measure",
"role": "Define how accountability, performance, risk and drift will be observed over time.",
"status": "Operational phase",
"properties": {
"Core question": "How will accountability, performance, risk, and drift be observed?",
"Lifecycle": "Phase 2 definition and Phase 4 monitoring",
"Decision gate": "Can the team detect deterioration and act?"
},
"outputs": [
"KPI/KRI register"
],
"action": "Define indicators, thresholds, owners and cadence, then monitor material change.",
"intents": [
"KPI",
"KRI",
"monitor change",
"drift",
"threshold"
],
"stakeholders": [
"operations",
"assurance",
"board"
],
"href": "#measure",
"semanticId": "https://paloframework.org/semantic/stage/measure",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "prove",
"label": "Prove & Review",
"number": "06",
"type": "stage",
"phaseId": "prove",
"role": "Assemble reconstructable evidence, decide readiness and feed findings into the next cycle.",
"status": "Operational phase",
"properties": {
"Core question": "Can the decision be reconstructed, reviewed, and improved?",
"Lifecycle": "Phases 4-5 Deployment, Review, and Decommissioning",
"Decision gate": "Is the evidence complete enough for an accountable decision?"
},
"outputs": [
"Versioned evidence bundle",
"Next-cycle update"
],
"action": "Assemble versioned evidence, review readiness and record the accountable decision.",
"intents": [
"board evidence",
"evidence bundle",
"prove decision",
"review readiness"
],
"stakeholders": [
"board",
"executive",
"audit",
"assurance"
],
"href": "#prove",
"semanticId": "https://paloframework.org/semantic/stage/prove",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "model-canvas",
"label": "AI Model Canvas",
"type": "module",
"phaseId": "frame",
"role": "Structures purpose, scope, ownership and assumptions.",
"status": "Available",
"href": "../../PALO_ModelCanvasAI.html",
"properties": {
"When to use": "At initiation and after material scope change",
"Key properties": "purpose, scope, owners, stakeholders, lifecycle, assumptions",
"Weight": "W5 Core"
},
"outputs": [
"Structured Canvas",
"JSON/Markdown record"
],
"weight": "W5",
"action": "At initiation and after material scope change",
"intents": [
"what should I do first",
"start governance",
"define use case",
"assign owner"
],
"stakeholders": [
"accountable owner",
"product",
"governance"
],
"semanticId": "https://paloframework.org/semantic/module/model-canvas",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [
"src-nist-ai-rmf"
],
"lastReviewed": "2026-08-12"
},
{
"id": "agency-map",
"label": "Human Agency Risk Map",
"type": "module",
"phaseId": "frame",
"role": "Maps delegated activity and potential effects on human agency.",
"status": "Available",
"href": "../../PALO_HumanAgencyRiskMap.html",
"properties": {
"When to use": "When systems influence or replace human decisions",
"Key properties": "delegated activity, affected agency, oversight need",
"Weight": "W3 Contextual"
},
"outputs": [
"Agency-risk context"
],
"weight": "W3",
"action": "When systems influence or replace human decisions",
"intents": [
"what should I do first",
"start governance",
"define use case",
"assign owner"
],
"stakeholders": [
"accountable owner",
"product",
"governance"
],
"semanticId": "https://paloframework.org/semantic/module/agency-map",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [
"src-oecd-ai-principles"
],
"lastReviewed": "2026-08-12"
},
{
"id": "tech-trends",
"label": "Tech Trends Observatory",
"type": "module",
"phaseId": "frame",
"role": "Adds technology and horizon signals to the use-case context.",
"status": "Reference",
"href": "../../PALO_TechTrends2026.html",
"properties": {
"When to use": "For emerging capabilities or uncertain technical trajectories",
"Key properties": "technology signal, horizon, governance impact",
"Weight": "W2 Supporting"
},
"outputs": [
"Horizon context"
],
"weight": "W2",
"action": "For emerging capabilities or uncertain technical trajectories",
"intents": [
"what should I do first",
"start governance",
"define use case",
"assign owner"
],
"stakeholders": [
"accountable owner",
"product",
"governance"
],
"semanticId": "https://paloframework.org/semantic/module/tech-trends",
"definitionVersion": "3.0.0",
"evidenceClass": "source-backed-context",
"authorityBoundary": "Source-backed context informs governance work but does not independently determine legal applicability, compliance, or deployment authorization.",
"sourceRefs": [
"src-nist-ai-rmf"
],
"lastReviewed": "2026-08-12"
},
{
"id": "risk-tiering",
"label": "Risk Tiering Calculator",
"type": "module",
"phaseId": "classify",
"role": "Routes the use case through an initial EU AI Act risk screen.",
"status": "Available",
"href": "../../PALO_RiskTiering.html",
"properties": {
"When to use": "For every use case before detailed assessment",
"Key properties": "tier, prohibited-practice signals, high-risk context",
"Weight": "W5 Core"
},
"outputs": [
"Markdown risk report"
],
"weight": "W5",
"action": "For every use case before detailed assessment",
"intents": [
"classify risk",
"risk tier",
"applicable obligations",
"high risk"
],
"stakeholders": [
"legal",
"risk",
"governance"
],
"semanticId": "https://paloframework.org/semantic/module/risk-tiering",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [
"src-eu-ai-act"
],
"lastReviewed": "2026-08-12"
},
{
"id": "comparison",
"label": "Framework Comparison",
"type": "module",
"phaseId": "classify",
"role": "Cross-checks overlapping governance frameworks and gaps.",
"status": "Available",
"href": "../../PALO_ComparisonTool.html",
"properties": {
"When to use": "When multiple standards or frameworks apply",
"Key properties": "applicable framework, overlap, gaps",
"Weight": "W3 Contextual"
},
"outputs": [
"Comparison record"
],
"weight": "W3",
"action": "When multiple standards or frameworks apply",
"intents": [
"classify risk",
"risk tier",
"applicable obligations",
"high risk"
],
"stakeholders": [
"legal",
"risk",
"governance"
],
"semanticId": "https://paloframework.org/semantic/module/comparison",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [
"src-nist-ai-rmf",
"src-iso-42001"
],
"lastReviewed": "2026-08-12"
},
{
"id": "reg-watch",
"label": "Regulatory Watch 2026",
"type": "module",
"phaseId": "classify",
"role": "Keeps the route anchored to current official sources.",
"status": "Reviewed source",
"href": "../../PALO_RegulatoryWatch.html",
"properties": {
"When to use": "At classification and each formal review",
"Key properties": "article, date, status, source",
"Weight": "W4 Strong"
},
"outputs": [
"Current obligation context"
],
"weight": "W4",
"action": "At classification and each formal review",
"intents": [
"classify risk",
"risk tier",
"applicable obligations",
"high risk"
],
"stakeholders": [
"legal",
"risk",
"governance"
],
"semanticId": "https://paloframework.org/semantic/module/reg-watch",
"definitionVersion": "3.0.0",
"evidenceClass": "source-backed-context",
"authorityBoundary": "Source-backed context informs governance work but does not independently determine legal applicability, compliance, or deployment authorization.",
"sourceRefs": [
"src-eu-ai-act"
],
"lastReviewed": "2026-08-12"
},
{
"id": "fria",
"label": "FRIA Assessment",
"type": "module",
"phaseId": "assess",
"role": "Evaluates fundamental-rights impact scenarios and mitigations.",
"status": "Available",
"href": "../../PALO_FRIA.html",
"properties": {
"When to use": "When deployment may affect people or protected rights",
"Key properties": "affected right, scenario, likelihood, gravity, reversibility, mitigation",
"Weight": "W4 Strong"
},
"outputs": [
"FRIA JSON/Markdown/template"
],
"weight": "W4",
"action": "When deployment may affect people or protected rights",
"intents": [
"fundamental rights",
"agent autonomy",
"assess impact",
"human oversight"
],
"stakeholders": [
"legal",
"risk",
"product",
"public sector"
],
"semanticId": "https://paloframework.org/semantic/module/fria",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [
"src-eu-ai-act"
],
"lastReviewed": "2026-08-12"
},
{
"id": "palo-am",
"label": "PALO-AM",
"type": "module",
"phaseId": "assess",
"role": "Examines identity, authority and action space in agentic systems.",
"status": "Available",
"href": "../../PALO_AgenticGovernance.html",
"properties": {
"When to use": "For agents, tools and delegated action",
"Key properties": "identity, authority, tools, action space, autonomy, oversight",
"Weight": "W4 Strong"
},
"outputs": [
"Agentic governance record"
],
"weight": "W4",
"action": "For agents, tools and delegated action",
"intents": [
"fundamental rights",
"agent autonomy",
"assess impact",
"human oversight"
],
"stakeholders": [
"legal",
"risk",
"product",
"public sector"
],
"semanticId": "https://paloframework.org/semantic/module/palo-am",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [
"src-nist-ai-rmf",
"src-iso-42001"
],
"lastReviewed": "2026-08-12"
},
{
"id": "assessment-path",
"label": "Assessment Path",
"type": "module",
"phaseId": "assess",
"role": "Connects context, risk route, readiness and sources.",
"status": "Available",
"href": "../../PALO_AssessmentPath.html",
"properties": {
"When to use": "As the backbone of the contextual assessment",
"Key properties": "context, route, readiness, sources",
"Weight": "W5 Core"
},
"outputs": [
"Contextual assessment record",
"Evidence bundle"
],
"weight": "W5",
"action": "As the backbone of the contextual assessment",
"intents": [
"fundamental rights",
"agent autonomy",
"assess impact",
"human oversight"
],
"stakeholders": [
"legal",
"risk",
"product",
"public sector"
],
"semanticId": "https://paloframework.org/semantic/module/assessment-path",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [
"src-nist-ai-rmf"
],
"lastReviewed": "2026-08-12"
},
{
"id": "vibe",
"label": "Vibe Coding Governance",
"type": "module",
"phaseId": "control",
"role": "Governs AI-assisted development through explicit delivery gates.",
"status": "Available",
"href": "../../PALO_VibeCoding.html",
"properties": {
"When to use": "When AI assists software development",
"Key properties": "functional intent, controlled environment, evidence, delivery gates",
"Weight": "W3 Contextual"
},
"outputs": [
"AI-assisted development controls"
],
"weight": "W3",
"action": "When AI assists software development",
"intents": [
"select controls",
"implement controls",
"assurance test",
"development governance"
],
"stakeholders": [
"engineering",
"product",
"assurance"
],
"semanticId": "https://paloframework.org/semantic/module/vibe",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [
"src-nist-genai-profile",
"src-owasp-llm-top10"
],
"lastReviewed": "2026-08-12"
},
{
"id": "auditbench",
"label": "AuditBench Explorer",
"type": "module",
"phaseId": "control",
"role": "Tests hidden behavior and alignment evidence.",
"status": "Available",
"href": "../../PALO_AuditBench.html",
"properties": {
"When to use": "During validation and assurance",
"Key properties": "hidden behavior, audit technique, test status",
"Weight": "W3 Contextual"
},
"outputs": [
"Alignment audit assessment/report"
],
"weight": "W3",
"action": "During validation and assurance",
"intents": [
"select controls",
"implement controls",
"assurance test",
"development governance"
],
"stakeholders": [
"engineering",
"product",
"assurance"
],
"semanticId": "https://paloframework.org/semantic/module/auditbench",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [
"src-nist-genai-profile"
],
"lastReviewed": "2026-08-12"
},
{
"id": "poisoning",
"label": "Poisoning Boomerang",
"type": "module",
"phaseId": "control",
"role": "Frames data and model integrity threats across the lifecycle.",
"status": "Reference",
"href": "../../PALO_PoisoningStudy.html",
"properties": {
"When to use": "Where provenance or integrity risks are material",
"Key properties": "threat, provenance, detection, integrity control",
"Weight": "W3 Contextual"
},
"outputs": [
"Data/model integrity controls"
],
"weight": "W3",
"action": "Where provenance or integrity risks are material",
"intents": [
"select controls",
"implement controls",
"assurance test",
"development governance"
],
"stakeholders": [
"engineering",
"product",
"assurance"
],
"semanticId": "https://paloframework.org/semantic/module/poisoning",
"definitionVersion": "3.0.0",
"evidenceClass": "source-backed-context",
"authorityBoundary": "Source-backed context informs governance work but does not independently determine legal applicability, compliance, or deployment authorization.",
"sourceRefs": [
"src-nist-ai-rmf"
],
"lastReviewed": "2026-08-12"
},
{
"id": "kpi",
"label": "KPI and KRI Generator",
"type": "module",
"phaseId": "measure",
"role": "Creates the measurable indicator set for governance monitoring.",
"status": "Available",
"href": "../../PALO_KPIGenerator.html",
"properties": {
"When to use": "When controls need observable performance and risk signals",
"Current properties": "category, indicator, definition, formula",
"Required downstream": "threshold, owner, cadence, current value, status",
"Weight": "W5 Core"
},
"outputs": [
"CSV/Markdown indicator set"
],
"weight": "W5",
"action": "When controls need observable performance and risk signals",
"intents": [
"KPI",
"KRI",
"monitor change",
"drift",
"threshold"
],
"stakeholders": [
"operations",
"assurance",
"board"
],
"semanticId": "https://paloframework.org/semantic/module/kpi",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [
"src-nist-ai-rmf",
"src-iso-42001"
],
"lastReviewed": "2026-08-12"
},
{
"id": "toolbox",
"label": "P.A.L.O. Toolbox",
"type": "module",
"phaseId": "measure",
"role": "Captures portable operational evidence locally.",
"status": "Android and iOS",
"href": "../../PALO_CompanionApp.html",
"properties": {
"When to use": "During field work and ongoing evidence capture",
"Key properties": "local record, Evidence Vault, portable report",
"Weight": "W3 Contextual"
},
"outputs": [
"Local operational evidence",
"Portable evidence package"
],
"weight": "W3",
"action": "During field work and ongoing evidence capture",
"intents": [
"KPI",
"KRI",
"monitor change",
"drift",
"threshold"
],
"stakeholders": [
"operations",
"assurance",
"board"
],
"semanticId": "https://paloframework.org/semantic/module/toolbox",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "docs",
"label": "Documentation Library",
"type": "module",
"phaseId": "prove",
"role": "Connects evidence to lifecycle guidance and source artifacts.",
"status": "Available",
"href": "../../PALO_DocumentationLibrary.html",
"properties": {
"When to use": "When reconstructing decisions or preparing review",
"Key properties": "lifecycle guidance, source artifact, version",
"Weight": "W4 Strong"
},
"outputs": [
"Source and guidance context"
],
"weight": "W4",
"action": "When reconstructing decisions or preparing review",
"intents": [
"board evidence",
"evidence bundle",
"prove decision",
"review readiness"
],
"stakeholders": [
"board",
"executive",
"audit",
"assurance"
],
"semanticId": "https://paloframework.org/semantic/module/docs",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "brief",
"label": "Use-case brief",
"type": "artifact",
"phaseId": "frame",
"role": "Versioned operational output transferred to the next governance decision.",
"status": "Produced output",
"properties": {
"Owner": "Assigned by the operating team",
"Versioning": "Required",
"Review state": "Tracked in the evidence path"
},
"outputs": [
"Use-case brief"
],
"action": "Create, version and hand this artifact to the next accountable decision.",
"intents": [
"what should I do first",
"start governance",
"define use case",
"assign owner",
"Use-case brief"
],
"stakeholders": [
"accountable owner",
"product",
"governance"
],
"semanticId": "https://paloframework.org/semantic/artifact/brief",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "route",
"label": "Risk route",
"type": "artifact",
"phaseId": "classify",
"role": "Versioned operational output transferred to the next governance decision.",
"status": "Produced output",
"properties": {
"Owner": "Assigned by the operating team",
"Versioning": "Required",
"Review state": "Tracked in the evidence path"
},
"outputs": [
"Risk route"
],
"action": "Create, version and hand this artifact to the next accountable decision.",
"intents": [
"classify risk",
"risk tier",
"applicable obligations",
"high risk",
"Risk route"
],
"stakeholders": [
"legal",
"risk",
"governance"
],
"semanticId": "https://paloframework.org/semantic/artifact/route",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "impact-record",
"label": "Impact assessment record",
"type": "artifact",
"phaseId": "assess",
"role": "Versioned operational output transferred to the next governance decision.",
"status": "Produced output",
"properties": {
"Owner": "Assigned by the operating team",
"Versioning": "Required",
"Review state": "Tracked in the evidence path"
},
"outputs": [
"Impact assessment record"
],
"action": "Create, version and hand this artifact to the next accountable decision.",
"intents": [
"fundamental rights",
"agent autonomy",
"assess impact",
"human oversight",
"Impact assessment record"
],
"stakeholders": [
"legal",
"risk",
"product",
"public sector"
],
"semanticId": "https://paloframework.org/semantic/artifact/impact-record",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "control-plan",
"label": "Control plan",
"type": "artifact",
"phaseId": "control",
"role": "Versioned operational output transferred to the next governance decision.",
"status": "Produced output",
"properties": {
"Owner": "Assigned by the operating team",
"Versioning": "Required",
"Review state": "Tracked in the evidence path"
},
"outputs": [
"Control plan"
],
"action": "Create, version and hand this artifact to the next accountable decision.",
"intents": [
"select controls",
"implement controls",
"assurance test",
"development governance",
"Control plan"
],
"stakeholders": [
"engineering",
"product",
"assurance"
],
"semanticId": "https://paloframework.org/semantic/artifact/control-plan",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "indicator-register",
"label": "KPI/KRI register",
"type": "artifact",
"phaseId": "measure",
"role": "Versioned operational output transferred to the next governance decision.",
"status": "Produced output",
"properties": {
"Owner": "Assigned by the operating team",
"Versioning": "Required",
"Review state": "Tracked in the evidence path"
},
"outputs": [
"KPI/KRI register"
],
"action": "Create, version and hand this artifact to the next accountable decision.",
"intents": [
"KPI",
"KRI",
"monitor change",
"drift",
"threshold",
"KPI/KRI register"
],
"stakeholders": [
"operations",
"assurance",
"board"
],
"semanticId": "https://paloframework.org/semantic/artifact/indicator-register",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "evidence-bundle",
"label": "Evidence Bundle",
"type": "artifact",
"phaseId": "prove",
"role": "Versioned operational output transferred to the next governance decision.",
"status": "Produced output",
"properties": {
"Owner": "Assigned by the operating team",
"Versioning": "Required",
"Review state": "Tracked in the evidence path"
},
"outputs": [
"Evidence Bundle"
],
"action": "Create, version and hand this artifact to the next accountable decision.",
"intents": [
"board evidence",
"evidence bundle",
"prove decision",
"review readiness",
"Evidence Bundle"
],
"stakeholders": [
"board",
"executive",
"audit",
"assurance"
],
"semanticId": "https://paloframework.org/semantic/artifact/evidence-bundle",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "accountable-owner",
"label": "Accountable Owner",
"type": "actor",
"phaseId": "frame",
"role": "Owns the use case and accepts decision accountability.",
"status": "Required role",
"properties": {
"Responsibility": "Purpose, resources and decision escalation"
},
"outputs": [
"Ownership record"
],
"semanticId": "https://paloframework.org/semantic/actor/accountable-owner",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "board-reviewer",
"label": "Board and Review Body",
"type": "actor",
"phaseId": "prove",
"role": "Reviews decision readiness, residual exposure and the evidence supporting approval or escalation.",
"status": "Decision role",
"stakeholder": "Board, executive and assurance",
"properties": {
"Responsibility": "Challenge evidence, record the decision and request remediation where needed"
},
"outputs": [
"Board review record"
],
"semanticId": "https://paloframework.org/semantic/actor/board-reviewer",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "product-engineering",
"label": "Product and Engineering Team",
"type": "actor",
"phaseId": "control",
"role": "Turns assessment findings into implemented, owned and testable controls.",
"status": "Delivery role",
"stakeholder": "Product and engineering",
"properties": {
"Responsibility": "Control implementation, testing and operational handoff"
},
"outputs": [
"Implementation evidence"
],
"semanticId": "https://paloframework.org/semantic/actor/product-engineering",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "legal-governance",
"label": "Legal and Governance Team",
"type": "actor",
"phaseId": "classify",
"role": "Interprets the use-case context, obligations and fundamental-rights route without replacing accountable ownership.",
"status": "Advisory role",
"stakeholder": "Legal, risk and governance",
"properties": {
"Responsibility": "Classification rationale, source review and escalation"
},
"outputs": [
"Governance rationale"
],
"semanticId": "https://paloframework.org/semantic/actor/legal-governance",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "official-sources",
"label": "Official Sources",
"type": "source",
"phaseId": "classify",
"role": "Provide authoritative regulatory context.",
"status": "Verified sources",
"properties": {
"Evidence rule": "Source, date and reviewed status recorded"
},
"outputs": [
"Source register"
],
"semanticId": "https://paloframework.org/semantic/source/official-sources",
"definitionVersion": "3.0.0",
"evidenceClass": "source-backed-context",
"authorityBoundary": "Source-backed context informs governance work but does not independently determine legal applicability, compliance, or deployment authorization.",
"sourceRefs": [
"src-eu-ai-act",
"src-nist-ai-rmf",
"src-iso-42001",
"src-oecd-ai-principles"
],
"lastReviewed": "2026-08-12"
},
{
"id": "assurance-control",
"label": "Assurance Control",
"type": "control",
"phaseId": "control",
"role": "Links a finding to an owner, test and decision gate.",
"status": "Required control",
"properties": {
"Minimum fields": "risk link, owner, evidence, test status, residual risk"
},
"outputs": [
"Control evidence"
],
"semanticId": "https://paloframework.org/semantic/control/assurance-control",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "drift-indicator",
"label": "Drift Indicator",
"type": "metric",
"phaseId": "measure",
"role": "Signals deterioration or material change.",
"status": "Required metric",
"properties": {
"Minimum fields": "formula, threshold, owner, cadence, status"
},
"outputs": [
"Monitoring signal"
],
"semanticId": "https://paloframework.org/semantic/metric/drift-indicator",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "nav-model",
"label": "Define the use case",
"type": "navigation",
"phaseId": "frame",
"role": "Routes a stakeholder intent to a working destination and named artifact.",
"href": "../../PALO_ModelCanvasAI.html",
"stakeholder": "Accountable owner",
"artifact": "Use-case brief",
"status": "Implemented",
"navigationGroup": "orient",
"outputs": [
"Use-case brief"
],
"properties": {
"Destination": "AI Model Canvas",
"Stakeholder": "Accountable owner",
"Phase": "frame",
"Artifact": "Use-case brief",
"Status": "Implemented"
},
"action": "Open AI Model Canvas to define the use case.",
"intents": [
"Define the use case",
"AI Model Canvas",
"Accountable owner",
"Use-case brief"
],
"stakeholders": [
"Accountable owner"
],
"semanticId": "https://paloframework.org/semantic/navigation/nav-model",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "nav-onboard",
"label": "Find a practical route",
"type": "navigation",
"phaseId": "frame",
"role": "Routes a stakeholder intent to a working destination and named artifact.",
"href": "#onboarding",
"stakeholder": "Any stakeholder",
"artifact": "Local route record",
"status": "Implemented",
"navigationGroup": "orient",
"outputs": [
"Local route record"
],
"properties": {
"Destination": "Stakeholder Onboarding",
"Stakeholder": "Any stakeholder",
"Phase": "frame",
"Artifact": "Local route record",
"Status": "Implemented"
},
"action": "Open Stakeholder Onboarding to find a practical route.",
"intents": [
"Find a practical route",
"Stakeholder Onboarding",
"Any stakeholder",
"Local route record",
"what should I do first",
"start governance",
"find my path"
],
"stakeholders": [
"Any stakeholder"
],
"semanticId": "https://paloframework.org/semantic/navigation/nav-onboard",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "nav-docs",
"label": "Locate source guidance",
"type": "navigation",
"phaseId": "frame",
"role": "Routes a stakeholder intent to a working destination and named artifact.",
"href": "../../PALO_DocumentationLibrary.html",
"stakeholder": "Assurance and board",
"artifact": "Source and lifecycle context",
"status": "Implemented",
"navigationGroup": "orient",
"outputs": [
"Source and lifecycle context"
],
"properties": {
"Destination": "Documentation Library",
"Stakeholder": "Assurance and board",
"Phase": "frame",
"Artifact": "Source and lifecycle context",
"Status": "Implemented"
},
"action": "Open Documentation Library to locate source guidance.",
"intents": [
"Locate source guidance",
"Documentation Library",
"Assurance and board",
"Source and lifecycle context"
],
"stakeholders": [
"Assurance and board"
],
"semanticId": "https://paloframework.org/semantic/navigation/nav-docs",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "nav-tier",
"label": "Establish an initial risk route",
"type": "navigation",
"phaseId": "classify",
"role": "Routes a stakeholder intent to a working destination and named artifact.",
"href": "../../PALO_RiskTiering.html",
"stakeholder": "Risk and legal",
"artifact": "Risk classification report",
"status": "Implemented",
"navigationGroup": "assess",
"outputs": [
"Risk classification report"
],
"properties": {
"Destination": "Risk Tiering Calculator",
"Stakeholder": "Risk and legal",
"Phase": "classify",
"Artifact": "Risk classification report",
"Status": "Implemented"
},
"action": "Open Risk Tiering Calculator to establish an initial risk route.",
"intents": [
"Establish an initial risk route",
"Risk Tiering Calculator",
"Risk and legal",
"Risk classification report"
],
"stakeholders": [
"Risk and legal"
],
"semanticId": "https://paloframework.org/semantic/navigation/nav-tier",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [
"src-eu-ai-act"
],
"lastReviewed": "2026-08-12"
},
{
"id": "nav-fria",
"label": "Evaluate rights impacts",
"type": "navigation",
"phaseId": "assess",
"role": "Routes a stakeholder intent to a working destination and named artifact.",
"href": "../../PALO_FRIA.html",
"stakeholder": "Risk and legal",
"artifact": "FRIA record",
"status": "Implemented",
"navigationGroup": "assess",
"outputs": [
"FRIA record"
],
"properties": {
"Destination": "FRIA Assessment",
"Stakeholder": "Risk and legal",
"Phase": "assess",
"Artifact": "FRIA record",
"Status": "Implemented"
},
"action": "Open FRIA Assessment to evaluate rights impacts.",
"intents": [
"Evaluate rights impacts",
"FRIA Assessment",
"Risk and legal",
"FRIA record"
],
"stakeholders": [
"Risk and legal"
],
"semanticId": "https://paloframework.org/semantic/navigation/nav-fria",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [
"src-eu-ai-act"
],
"lastReviewed": "2026-08-12"
},
{
"id": "nav-agentic",
"label": "Bound delegated action",
"type": "navigation",
"phaseId": "assess",
"role": "Routes a stakeholder intent to a working destination and named artifact.",
"href": "../../PALO_AgenticGovernance.html#simulator",
"stakeholder": "Product and engineering",
"artifact": "Agentic evidence plan",
"status": "Implemented",
"navigationGroup": "assess",
"outputs": [
"Agentic evidence plan"
],
"properties": {
"Destination": "PALO-AM",
"Stakeholder": "Product and engineering",
"Phase": "assess",
"Artifact": "Agentic evidence plan",
"Status": "Implemented"
},
"action": "Open PALO-AM to bound delegated action.",
"intents": [
"Bound delegated action",
"PALO-AM",
"Product and engineering",
"Agentic evidence plan"
],
"stakeholders": [
"Product and engineering"
],
"semanticId": "https://paloframework.org/semantic/navigation/nav-agentic",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "nav-controls",
"label": "Select owned controls",
"type": "navigation",
"phaseId": "control",
"role": "Routes a stakeholder intent to a working destination and named artifact.",
"href": "../../data/control-library.json",
"stakeholder": "Product and engineering",
"artifact": "Calibrated control plan",
"status": "Foundation",
"navigationGroup": "operate",
"outputs": [
"Calibrated control plan"
],
"properties": {
"Destination": "Control Library",
"Stakeholder": "Product and engineering",
"Phase": "control",
"Artifact": "Calibrated control plan",
"Status": "Foundation"
},
"action": "Open Control Library to select owned controls.",
"intents": [
"Select owned controls",
"Control Library",
"Product and engineering",
"Calibrated control plan"
],
"stakeholders": [
"Product and engineering"
],
"semanticId": "https://paloframework.org/semantic/navigation/nav-controls",
"definitionVersion": "3.0.0",
"evidenceClass": "illustrative-local-preview",
"authorityBoundary": "Illustrative local foundation; it is not production state, approval evidence, or an authorization boundary.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "nav-vibe",
"label": "Govern AI-assisted delivery",
"type": "navigation",
"phaseId": "control",
"role": "Routes a stakeholder intent to a working destination and named artifact.",
"href": "../../PALO_VibeCoding.html",
"stakeholder": "Product and engineering",
"artifact": "Development controls",
"status": "Implemented",
"navigationGroup": "operate",
"outputs": [
"Development controls"
],
"properties": {
"Destination": "Vibe Coding Governance",
"Stakeholder": "Product and engineering",
"Phase": "control",
"Artifact": "Development controls",
"Status": "Implemented"
},
"action": "Open Vibe Coding Governance to govern ai-assisted delivery.",
"intents": [
"Govern AI-assisted delivery",
"Vibe Coding Governance",
"Product and engineering",
"Development controls"
],
"stakeholders": [
"Product and engineering"
],
"semanticId": "https://paloframework.org/semantic/navigation/nav-vibe",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "nav-kpi",
"label": "Define observable indicators",
"type": "navigation",
"phaseId": "measure",
"role": "Routes a stakeholder intent to a working destination and named artifact.",
"href": "../../PALO_KPIGenerator.html",
"stakeholder": "Assurance and board",
"artifact": "KPI/KRI register",
"status": "Implemented",
"navigationGroup": "operate",
"outputs": [
"KPI/KRI register"
],
"properties": {
"Destination": "KPI and KRI Generator",
"Stakeholder": "Assurance and board",
"Phase": "measure",
"Artifact": "KPI/KRI register",
"Status": "Implemented"
},
"action": "Open KPI and KRI Generator to define observable indicators.",
"intents": [
"Define observable indicators",
"KPI and KRI Generator",
"Assurance and board",
"KPI/KRI register"
],
"stakeholders": [
"Assurance and board"
],
"semanticId": "https://paloframework.org/semantic/navigation/nav-kpi",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "nav-evidence",
"label": "Assemble the working record",
"type": "navigation",
"phaseId": "prove",
"role": "Routes a stakeholder intent to a working destination and named artifact.",
"href": "../../PALO_AssessmentPath.html",
"stakeholder": "Assurance and board",
"artifact": "Evidence Bundle and board pack",
"status": "Implemented",
"navigationGroup": "prove",
"outputs": [
"Evidence Bundle and board pack"
],
"properties": {
"Destination": "Assessment Path",
"Stakeholder": "Assurance and board",
"Phase": "prove",
"Artifact": "Evidence Bundle and board pack",
"Status": "Implemented"
},
"action": "Open Assessment Path to assemble the working record.",
"intents": [
"Assemble the working record",
"Assessment Path",
"Assurance and board",
"Evidence Bundle and board pack",
"board evidence",
"prepare board pack",
"evidence bundle"
],
"stakeholders": [
"Assurance and board"
],
"semanticId": "https://paloframework.org/semantic/navigation/nav-evidence",
"definitionVersion": "3.0.0",
"evidenceClass": "canonical-definition",
"authorityBoundary": "Canonical PALO framework definition; it structures governance but does not create legal obligations or authorize deployment.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
},
{
"id": "nav-monitor",
"label": "Receive monitoring signals",
"type": "navigation",
"phaseId": "measure",
"role": "Routes a stakeholder intent to a working destination and named artifact.",
"href": "https://www.policywatcher.online/",
"stakeholder": "Risk and legal",
"artifact": "Non-authoritative monitoring signal pending human review",
"status": "Foundation",
"navigationGroup": "prove",
"outputs": [
"Non-authoritative monitoring signal pending human review"
],
"properties": {
"Destination": "PolicyWatcher",
"External companion": "PolicyWatcher",
"Live destination": "https://www.policywatcher.online/",
"Contract / schema": "../../schemas/policywatcher-signal.schema.json",
"Stakeholder": "Risk and legal",
"Phase": "measure",
"Lifecycle phase": "measure",
"Artifact": "Non-authoritative monitoring signal pending human review",
"Status": "Foundation",
"Authority boundary": "Non-authoritative monitoring signal pending human review"
},
"action": "Open PolicyWatcher to receive monitoring signals.",
"intents": [
"Receive monitoring signals",
"PolicyWatcher",
"Risk and legal",
"Non-authoritative monitoring signal pending human review",
"monitor change",
"policy change",
"terms of service change",
"PolicyWatcher"
],
"stakeholders": [
"Risk and legal"
],
"semanticId": "https://paloframework.org/semantic/navigation/nav-monitor",
"definitionVersion": "3.0.0",
"evidenceClass": "human-review-required",
"authorityBoundary": "Non-authoritative monitoring input; an accountable reviewer must verify the primary source and materiality.",
"sourceRefs": [
"src-eu-ai-act"
],
"lastReviewed": "2026-08-12"
},
{
"id": "nav-review",
"label": "Run an accountable review",
"type": "navigation",
"phaseId": "prove",
"role": "Routes a stakeholder intent to a working destination and named artifact.",
"href": "../../data/decision-gates.json",
"stakeholder": "Accountable owner",
"artifact": "Gate decision and next-cycle update",
"status": "Foundation",
"navigationGroup": "prove",
"outputs": [
"Gate decision and next-cycle update"
],
"properties": {
"Destination": "Decision Gates",
"Stakeholder": "Accountable owner",
"Phase": "prove",
"Artifact": "Gate decision and next-cycle update",
"Status": "Foundation"
},
"action": "Open Decision Gates to run an accountable review.",
"intents": [
"Run an accountable review",
"Decision Gates",
"Accountable owner",
"Gate decision and next-cycle update"
],
"stakeholders": [
"Accountable owner"
],
"semanticId": "https://paloframework.org/semantic/navigation/nav-review",
"definitionVersion": "3.0.0",
"evidenceClass": "illustrative-local-preview",
"authorityBoundary": "Illustrative local foundation; it is not production state, approval evidence, or an authorization boundary.",
"sourceRefs": [],
"lastReviewed": "2026-08-12"
}
]Semantic spine relationships (48)
Source: data/semantic-spine.json · Download full registry
[
{
"source": "frame",
"target": "classify",
"verb": "classifies",
"weight": "W5",
"meaning": "A defined use case is the mandatory input to risk routing.",
"artifactTransferred": "Use-case brief",
"relationType": "operational",
"semanticId": "https://paloframework.org/semantic/relationship/frame-classifies-classify",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "classify",
"target": "assess",
"verb": "routes",
"weight": "W5",
"meaning": "The risk route determines the depth and scope of assessment.",
"artifactTransferred": "Risk route",
"relationType": "operational",
"semanticId": "https://paloframework.org/semantic/relationship/classify-routes-assess",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "assess",
"target": "control",
"verb": "requires",
"weight": "W5",
"meaning": "Material findings require owned and testable controls.",
"artifactTransferred": "Impact assessment record",
"relationType": "operational",
"semanticId": "https://paloframework.org/semantic/relationship/assess-requires-control",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "control",
"target": "measure",
"verb": "measures",
"weight": "W4",
"meaning": "Implemented controls need indicators that reveal performance and deterioration.",
"artifactTransferred": "Control plan",
"relationType": "operational",
"semanticId": "https://paloframework.org/semantic/relationship/control-measures-measure",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "measure",
"target": "prove",
"verb": "records",
"weight": "W5",
"meaning": "Monitoring evidence is recorded in the accountable decision bundle.",
"artifactTransferred": "KPI/KRI register",
"relationType": "evidence",
"semanticId": "https://paloframework.org/semantic/relationship/measure-records-prove",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "prove",
"target": "frame",
"verb": "updates context",
"weight": "W4",
"meaning": "Findings, incidents and changes update the next use-case cycle.",
"artifactTransferred": "Next-cycle update",
"relationType": "feedback",
"semanticId": "https://paloframework.org/semantic/relationship/prove-updates-context-frame",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "model-canvas",
"target": "frame",
"verb": "activates",
"weight": "W5",
"meaning": "Structures purpose, scope, ownership and assumptions.",
"artifactTransferred": "Structured Canvas",
"relationType": "operational",
"semanticId": "https://paloframework.org/semantic/relationship/model-canvas-activates-frame",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "agency-map",
"target": "frame",
"verb": "activates",
"weight": "W3",
"meaning": "Maps delegated activity and potential effects on human agency.",
"artifactTransferred": "Agency-risk context",
"relationType": "operational",
"semanticId": "https://paloframework.org/semantic/relationship/agency-map-activates-frame",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "tech-trends",
"target": "frame",
"verb": "activates",
"weight": "W2",
"meaning": "Adds technology and horizon signals to the use-case context.",
"artifactTransferred": "Horizon context",
"relationType": "context",
"semanticId": "https://paloframework.org/semantic/relationship/tech-trends-activates-frame",
"relationshipVersion": "1.0.0",
"mappingBasis": "phase-support-assignment"
},
{
"source": "risk-tiering",
"target": "classify",
"verb": "activates",
"weight": "W5",
"meaning": "Routes the use case through an initial EU AI Act risk screen.",
"artifactTransferred": "Markdown risk report",
"relationType": "operational",
"semanticId": "https://paloframework.org/semantic/relationship/risk-tiering-activates-classify",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "comparison",
"target": "classify",
"verb": "activates",
"weight": "W3",
"meaning": "Cross-checks overlapping governance frameworks and gaps.",
"artifactTransferred": "Comparison record",
"relationType": "operational",
"semanticId": "https://paloframework.org/semantic/relationship/comparison-activates-classify",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "reg-watch",
"target": "classify",
"verb": "activates",
"weight": "W4",
"meaning": "Keeps the route anchored to current official sources.",
"artifactTransferred": "Current obligation context",
"relationType": "operational",
"semanticId": "https://paloframework.org/semantic/relationship/reg-watch-activates-classify",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "fria",
"target": "assess",
"verb": "activates",
"weight": "W4",
"meaning": "Evaluates fundamental-rights impact scenarios and mitigations.",
"artifactTransferred": "FRIA JSON/Markdown/template",
"relationType": "operational",
"semanticId": "https://paloframework.org/semantic/relationship/fria-activates-assess",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "palo-am",
"target": "assess",
"verb": "activates",
"weight": "W4",
"meaning": "Examines identity, authority and action space in agentic systems.",
"artifactTransferred": "Agentic governance record",
"relationType": "operational",
"semanticId": "https://paloframework.org/semantic/relationship/palo-am-activates-assess",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "assessment-path",
"target": "assess",
"verb": "activates",
"weight": "W5",
"meaning": "Connects context, risk route, readiness and sources.",
"artifactTransferred": "Contextual assessment record",
"relationType": "operational",
"semanticId": "https://paloframework.org/semantic/relationship/assessment-path-activates-assess",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "vibe",
"target": "control",
"verb": "activates",
"weight": "W3",
"meaning": "Governs AI-assisted development through explicit delivery gates.",
"artifactTransferred": "AI-assisted development controls",
"relationType": "operational",
"semanticId": "https://paloframework.org/semantic/relationship/vibe-activates-control",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "auditbench",
"target": "control",
"verb": "activates",
"weight": "W3",
"meaning": "Tests hidden behavior and alignment evidence.",
"artifactTransferred": "Alignment audit assessment/report",
"relationType": "operational",
"semanticId": "https://paloframework.org/semantic/relationship/auditbench-activates-control",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "poisoning",
"target": "control",
"verb": "activates",
"weight": "W3",
"meaning": "Frames data and model integrity threats across the lifecycle.",
"artifactTransferred": "Data/model integrity controls",
"relationType": "operational",
"semanticId": "https://paloframework.org/semantic/relationship/poisoning-activates-control",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "kpi",
"target": "measure",
"verb": "activates",
"weight": "W5",
"meaning": "Creates the measurable indicator set for governance monitoring.",
"artifactTransferred": "CSV/Markdown indicator set",
"relationType": "operational",
"semanticId": "https://paloframework.org/semantic/relationship/kpi-activates-measure",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "toolbox",
"target": "measure",
"verb": "activates",
"weight": "W3",
"meaning": "Captures portable operational evidence locally.",
"artifactTransferred": "Local operational evidence",
"relationType": "operational",
"semanticId": "https://paloframework.org/semantic/relationship/toolbox-activates-measure",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "docs",
"target": "prove",
"verb": "activates",
"weight": "W4",
"meaning": "Connects evidence to lifecycle guidance and source artifacts.",
"artifactTransferred": "Source and guidance context",
"relationType": "operational",
"semanticId": "https://paloframework.org/semantic/relationship/docs-activates-prove",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "frame",
"target": "brief",
"verb": "produces",
"weight": "W5",
"meaning": "The phase gate produces a versioned operational artifact.",
"artifactTransferred": "Use-case brief",
"relationType": "evidence",
"semanticId": "https://paloframework.org/semantic/relationship/frame-produces-brief",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "classify",
"target": "route",
"verb": "produces",
"weight": "W5",
"meaning": "The phase gate produces a versioned operational artifact.",
"artifactTransferred": "Risk route",
"relationType": "evidence",
"semanticId": "https://paloframework.org/semantic/relationship/classify-produces-route",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "assess",
"target": "impact-record",
"verb": "produces",
"weight": "W5",
"meaning": "The phase gate produces a versioned operational artifact.",
"artifactTransferred": "Impact assessment record",
"relationType": "evidence",
"semanticId": "https://paloframework.org/semantic/relationship/assess-produces-impact-record",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "control",
"target": "control-plan",
"verb": "produces",
"weight": "W5",
"meaning": "The phase gate produces a versioned operational artifact.",
"artifactTransferred": "Control plan",
"relationType": "evidence",
"semanticId": "https://paloframework.org/semantic/relationship/control-produces-control-plan",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "measure",
"target": "indicator-register",
"verb": "produces",
"weight": "W5",
"meaning": "The phase gate produces a versioned operational artifact.",
"artifactTransferred": "KPI/KRI register",
"relationType": "evidence",
"semanticId": "https://paloframework.org/semantic/relationship/measure-produces-indicator-register",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "prove",
"target": "evidence-bundle",
"verb": "produces",
"weight": "W5",
"meaning": "The phase gate produces a versioned operational artifact.",
"artifactTransferred": "Evidence Bundle",
"relationType": "evidence",
"semanticId": "https://paloframework.org/semantic/relationship/prove-produces-evidence-bundle",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "accountable-owner",
"target": "frame",
"verb": "owns",
"weight": "W5",
"meaning": "Supporting operational entity connected to the active phase.",
"artifactTransferred": "Operational evidence",
"relationType": "context",
"semanticId": "https://paloframework.org/semantic/relationship/accountable-owner-owns-frame",
"relationshipVersion": "1.0.0",
"mappingBasis": "phase-support-assignment"
},
{
"source": "official-sources",
"target": "classify",
"verb": "grounds",
"weight": "W4",
"meaning": "Supporting operational entity connected to the active phase.",
"artifactTransferred": "Operational evidence",
"relationType": "context",
"semanticId": "https://paloframework.org/semantic/relationship/official-sources-grounds-classify",
"relationshipVersion": "1.0.0",
"mappingBasis": "phase-support-assignment"
},
{
"source": "assurance-control",
"target": "control",
"verb": "implements",
"weight": "W4",
"meaning": "Supporting operational entity connected to the active phase.",
"artifactTransferred": "Operational evidence",
"relationType": "context",
"semanticId": "https://paloframework.org/semantic/relationship/assurance-control-implements-control",
"relationshipVersion": "1.0.0",
"mappingBasis": "phase-support-assignment"
},
{
"source": "drift-indicator",
"target": "measure",
"verb": "signals",
"weight": "W4",
"meaning": "Supporting operational entity connected to the active phase.",
"artifactTransferred": "Operational evidence",
"relationType": "context",
"semanticId": "https://paloframework.org/semantic/relationship/drift-indicator-signals-measure",
"relationshipVersion": "1.0.0",
"mappingBasis": "phase-support-assignment"
},
{
"source": "legal-governance",
"target": "classify",
"verb": "advises",
"weight": "W4",
"meaning": "The stakeholder role supports this decision while accountability remains explicit.",
"artifactTransferred": "Governance rationale",
"relationType": "context",
"semanticId": "https://paloframework.org/semantic/relationship/legal-governance-advises-classify",
"relationshipVersion": "1.0.0",
"mappingBasis": "phase-support-assignment"
},
{
"source": "product-engineering",
"target": "control",
"verb": "implements",
"weight": "W4",
"meaning": "The stakeholder role supports this decision while accountability remains explicit.",
"artifactTransferred": "Implementation evidence",
"relationType": "context",
"semanticId": "https://paloframework.org/semantic/relationship/product-engineering-implements-control",
"relationshipVersion": "1.0.0",
"mappingBasis": "phase-support-assignment"
},
{
"source": "board-reviewer",
"target": "prove",
"verb": "reviews",
"weight": "W5",
"meaning": "The stakeholder role supports this decision while accountability remains explicit.",
"artifactTransferred": "Board review record",
"relationType": "context",
"semanticId": "https://paloframework.org/semantic/relationship/board-reviewer-reviews-prove",
"relationshipVersion": "1.0.0",
"mappingBasis": "phase-support-assignment"
},
{
"source": "assessment-path",
"target": "prove",
"verb": "supports review",
"weight": "W5",
"meaning": "Existing module evidence is assembled or refreshed during review.",
"artifactTransferred": "Evidence bundle",
"relationType": "evidence",
"semanticId": "https://paloframework.org/semantic/relationship/assessment-path-supports-review-prove",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "reg-watch",
"target": "prove",
"verb": "supports review",
"weight": "W3",
"meaning": "Existing module evidence is assembled or refreshed during review.",
"artifactTransferred": "Review context",
"relationType": "evidence",
"semanticId": "https://paloframework.org/semantic/relationship/reg-watch-supports-review-prove",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "toolbox",
"target": "prove",
"verb": "supports review",
"weight": "W3",
"meaning": "Existing module evidence is assembled or refreshed during review.",
"artifactTransferred": "Review context",
"relationType": "evidence",
"semanticId": "https://paloframework.org/semantic/relationship/toolbox-supports-review-prove",
"relationshipVersion": "1.0.0",
"mappingBasis": "canonical-lifecycle-flow"
},
{
"source": "nav-model",
"target": "nav-onboard",
"verb": "leads to",
"weight": "W3",
"meaning": "Related stakeholder intents can be followed as one operational route.",
"artifactTransferred": "Local route record",
"relationType": "navigation",
"semanticId": "https://paloframework.org/semantic/relationship/nav-model-leads-to-nav-onboard",
"relationshipVersion": "1.0.0",
"mappingBasis": "stakeholder-intent-route"
},
{
"source": "nav-onboard",
"target": "nav-docs",
"verb": "leads to",
"weight": "W3",
"meaning": "Related stakeholder intents can be followed as one operational route.",
"artifactTransferred": "Source and lifecycle context",
"relationType": "navigation",
"semanticId": "https://paloframework.org/semantic/relationship/nav-onboard-leads-to-nav-docs",
"relationshipVersion": "1.0.0",
"mappingBasis": "stakeholder-intent-route"
},
{
"source": "nav-tier",
"target": "nav-fria",
"verb": "leads to",
"weight": "W3",
"meaning": "Related stakeholder intents can be followed as one operational route.",
"artifactTransferred": "FRIA record",
"relationType": "navigation",
"semanticId": "https://paloframework.org/semantic/relationship/nav-tier-leads-to-nav-fria",
"relationshipVersion": "1.0.0",
"mappingBasis": "stakeholder-intent-route"
},
{
"source": "nav-fria",
"target": "nav-agentic",
"verb": "leads to",
"weight": "W3",
"meaning": "Related stakeholder intents can be followed as one operational route.",
"artifactTransferred": "Agentic evidence plan",
"relationType": "navigation",
"semanticId": "https://paloframework.org/semantic/relationship/nav-fria-leads-to-nav-agentic",
"relationshipVersion": "1.0.0",
"mappingBasis": "stakeholder-intent-route"
},
{
"source": "nav-controls",
"target": "nav-vibe",
"verb": "leads to",
"weight": "W3",
"meaning": "Related stakeholder intents can be followed as one operational route.",
"artifactTransferred": "Development controls",
"relationType": "navigation",
"semanticId": "https://paloframework.org/semantic/relationship/nav-controls-leads-to-nav-vibe",
"relationshipVersion": "1.0.0",
"mappingBasis": "stakeholder-intent-route"
},
{
"source": "nav-vibe",
"target": "nav-kpi",
"verb": "leads to",
"weight": "W3",
"meaning": "Related stakeholder intents can be followed as one operational route.",
"artifactTransferred": "KPI/KRI register",
"relationType": "navigation",
"semanticId": "https://paloframework.org/semantic/relationship/nav-vibe-leads-to-nav-kpi",
"relationshipVersion": "1.0.0",
"mappingBasis": "stakeholder-intent-route"
},
{
"source": "nav-evidence",
"target": "nav-monitor",
"verb": "leads to",
"weight": "W3",
"meaning": "Related stakeholder intents can be followed as one operational route.",
"artifactTransferred": "Non-authoritative monitoring signal pending human review",
"relationType": "navigation",
"semanticId": "https://paloframework.org/semantic/relationship/nav-evidence-leads-to-nav-monitor",
"relationshipVersion": "1.0.0",
"mappingBasis": "stakeholder-intent-route"
},
{
"source": "nav-monitor",
"target": "nav-review",
"verb": "leads to",
"weight": "W3",
"meaning": "Related stakeholder intents can be followed as one operational route.",
"artifactTransferred": "Gate decision and next-cycle update",
"relationType": "navigation",
"semanticId": "https://paloframework.org/semantic/relationship/nav-monitor-leads-to-nav-review",
"relationshipVersion": "1.0.0",
"mappingBasis": "stakeholder-intent-route"
},
{
"source": "nav-docs",
"target": "nav-tier",
"verb": "hands off to",
"weight": "W4",
"meaning": "The output supports the next governance intent.",
"artifactTransferred": "Risk classification report",
"relationType": "navigation",
"semanticId": "https://paloframework.org/semantic/relationship/nav-docs-hands-off-to-nav-tier",
"relationshipVersion": "1.0.0",
"mappingBasis": "stakeholder-intent-route"
},
{
"source": "nav-agentic",
"target": "nav-controls",
"verb": "hands off to",
"weight": "W4",
"meaning": "The output supports the next governance intent.",
"artifactTransferred": "Calibrated control plan",
"relationType": "navigation",
"semanticId": "https://paloframework.org/semantic/relationship/nav-agentic-hands-off-to-nav-controls",
"relationshipVersion": "1.0.0",
"mappingBasis": "stakeholder-intent-route"
},
{
"source": "nav-kpi",
"target": "nav-evidence",
"verb": "hands off to",
"weight": "W4",
"meaning": "The output supports the next governance intent.",
"artifactTransferred": "Evidence Bundle and board pack",
"relationType": "navigation",
"semanticId": "https://paloframework.org/semantic/relationship/nav-kpi-hands-off-to-nav-evidence",
"relationshipVersion": "1.0.0",
"mappingBasis": "stakeholder-intent-route"
}
]All 409 atomic mappings (409)
Source: data/semantic-mappings.json · Download full registry
[
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-adversarial-testing/assess",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-adversarial-testing",
"semanticId": "https://paloframework.org/semantic/control/ctrl-adversarial-testing?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-adversarial-testing/measure",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-adversarial-testing",
"semanticId": "https://paloframework.org/semantic/control/ctrl-adversarial-testing?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-adversarial-testing/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-adversarial-testing",
"semanticId": "https://paloframework.org/semantic/control/ctrl-adversarial-testing?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-affected-person-notice/classify",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-affected-person-notice",
"semanticId": "https://paloframework.org/semantic/control/ctrl-affected-person-notice?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "classify",
"semanticId": "https://paloframework.org/semantic/gate/classify?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-affected-person-notice/control",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-affected-person-notice",
"semanticId": "https://paloframework.org/semantic/control/ctrl-affected-person-notice?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-affected-person-notice/measure",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-affected-person-notice",
"semanticId": "https://paloframework.org/semantic/control/ctrl-affected-person-notice?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-agentic-authority/assess",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-agentic-authority",
"semanticId": "https://paloframework.org/semantic/control/ctrl-agentic-authority?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-agentic-authority/control",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-agentic-authority",
"semanticId": "https://paloframework.org/semantic/control/ctrl-agentic-authority?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-ai-literacy-effectiveness/control",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-ai-literacy-effectiveness",
"semanticId": "https://paloframework.org/semantic/control/ctrl-ai-literacy-effectiveness?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-ai-literacy-effectiveness/frame",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-ai-literacy-effectiveness",
"semanticId": "https://paloframework.org/semantic/control/ctrl-ai-literacy-effectiveness?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "frame",
"semanticId": "https://paloframework.org/semantic/gate/frame?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-ai-literacy-effectiveness/measure",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-ai-literacy-effectiveness",
"semanticId": "https://paloframework.org/semantic/control/ctrl-ai-literacy-effectiveness?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-ai-literacy-effectiveness/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-ai-literacy-effectiveness",
"semanticId": "https://paloframework.org/semantic/control/ctrl-ai-literacy-effectiveness?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-ai-output-accessibility/assess",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-ai-output-accessibility",
"semanticId": "https://paloframework.org/semantic/control/ctrl-ai-output-accessibility?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-ai-output-accessibility/control",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-ai-output-accessibility",
"semanticId": "https://paloframework.org/semantic/control/ctrl-ai-output-accessibility?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-ai-output-accessibility/measure",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-ai-output-accessibility",
"semanticId": "https://paloframework.org/semantic/control/ctrl-ai-output-accessibility?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-ai-output-accessibility/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-ai-output-accessibility",
"semanticId": "https://paloframework.org/semantic/control/ctrl-ai-output-accessibility?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-aims-internal-audit/measure",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-aims-internal-audit",
"semanticId": "https://paloframework.org/semantic/control/ctrl-aims-internal-audit?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-aims-internal-audit/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-aims-internal-audit",
"semanticId": "https://paloframework.org/semantic/control/ctrl-aims-internal-audit?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-aims-leadership-objectives/classify",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-aims-leadership-objectives",
"semanticId": "https://paloframework.org/semantic/control/ctrl-aims-leadership-objectives?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "classify",
"semanticId": "https://paloframework.org/semantic/gate/classify?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-aims-leadership-objectives/frame",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-aims-leadership-objectives",
"semanticId": "https://paloframework.org/semantic/control/ctrl-aims-leadership-objectives?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "frame",
"semanticId": "https://paloframework.org/semantic/gate/frame?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-aims-leadership-objectives/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-aims-leadership-objectives",
"semanticId": "https://paloframework.org/semantic/control/ctrl-aims-leadership-objectives?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-aims-management-review-capa/measure",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-aims-management-review-capa",
"semanticId": "https://paloframework.org/semantic/control/ctrl-aims-management-review-capa?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-aims-management-review-capa/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-aims-management-review-capa",
"semanticId": "https://paloframework.org/semantic/control/ctrl-aims-management-review-capa?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-annotation-quality/assess",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-annotation-quality",
"semanticId": "https://paloframework.org/semantic/control/ctrl-annotation-quality?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-annotation-quality/measure",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-annotation-quality",
"semanticId": "https://paloframework.org/semantic/control/ctrl-annotation-quality?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-annotation-quality/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-annotation-quality",
"semanticId": "https://paloframework.org/semantic/control/ctrl-annotation-quality?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-appeal-remedy/control",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-appeal-remedy",
"semanticId": "https://paloframework.org/semantic/control/ctrl-appeal-remedy?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-appeal-remedy/measure",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-appeal-remedy",
"semanticId": "https://paloframework.org/semantic/control/ctrl-appeal-remedy?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-appeal-remedy/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-appeal-remedy",
"semanticId": "https://paloframework.org/semantic/control/ctrl-appeal-remedy?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-article50-transparency/classify",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-article50-transparency",
"semanticId": "https://paloframework.org/semantic/control/ctrl-article50-transparency?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "classify",
"semanticId": "https://paloframework.org/semantic/gate/classify?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-article50-transparency/control",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-article50-transparency",
"semanticId": "https://paloframework.org/semantic/control/ctrl-article50-transparency?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-article50-transparency/measure",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-article50-transparency",
"semanticId": "https://paloframework.org/semantic/control/ctrl-article50-transparency?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-article50-transparency/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-article50-transparency",
"semanticId": "https://paloframework.org/semantic/control/ctrl-article50-transparency?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-change-gate/assess",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-change-gate",
"semanticId": "https://paloframework.org/semantic/control/ctrl-change-gate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-change-gate/classify",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-change-gate",
"semanticId": "https://paloframework.org/semantic/control/ctrl-change-gate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "classify",
"semanticId": "https://paloframework.org/semantic/gate/classify?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-change-gate/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-change-gate",
"semanticId": "https://paloframework.org/semantic/control/ctrl-change-gate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-data-governance-lifecycle/assess",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-data-governance-lifecycle",
"semanticId": "https://paloframework.org/semantic/control/ctrl-data-governance-lifecycle?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-data-governance-lifecycle/control",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-data-governance-lifecycle",
"semanticId": "https://paloframework.org/semantic/control/ctrl-data-governance-lifecycle?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-data-governance-lifecycle/frame",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-data-governance-lifecycle",
"semanticId": "https://paloframework.org/semantic/control/ctrl-data-governance-lifecycle?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "frame",
"semanticId": "https://paloframework.org/semantic/gate/frame?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-data-governance-lifecycle/measure",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-data-governance-lifecycle",
"semanticId": "https://paloframework.org/semantic/control/ctrl-data-governance-lifecycle?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-data-governance-lifecycle/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-data-governance-lifecycle",
"semanticId": "https://paloframework.org/semantic/control/ctrl-data-governance-lifecycle?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-data-provenance/assess",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-data-provenance",
"semanticId": "https://paloframework.org/semantic/control/ctrl-data-provenance?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-data-provenance/control",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-data-provenance",
"semanticId": "https://paloframework.org/semantic/control/ctrl-data-provenance?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-decision-trace/measure",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-decision-trace",
"semanticId": "https://paloframework.org/semantic/control/ctrl-decision-trace?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-decision-trace/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-decision-trace",
"semanticId": "https://paloframework.org/semantic/control/ctrl-decision-trace?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-decommissioning/control",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-decommissioning",
"semanticId": "https://paloframework.org/semantic/control/ctrl-decommissioning?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-decommissioning/measure",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-decommissioning",
"semanticId": "https://paloframework.org/semantic/control/ctrl-decommissioning?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-decommissioning/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-decommissioning",
"semanticId": "https://paloframework.org/semantic/control/ctrl-decommissioning?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-environmental-performance/assess",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-environmental-performance",
"semanticId": "https://paloframework.org/semantic/control/ctrl-environmental-performance?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-environmental-performance/frame",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-environmental-performance",
"semanticId": "https://paloframework.org/semantic/control/ctrl-environmental-performance?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "frame",
"semanticId": "https://paloframework.org/semantic/gate/frame?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-environmental-performance/measure",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-environmental-performance",
"semanticId": "https://paloframework.org/semantic/control/ctrl-environmental-performance?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-environmental-performance/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-environmental-performance",
"semanticId": "https://paloframework.org/semantic/control/ctrl-environmental-performance?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-fair-allocation/assess",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-fair-allocation",
"semanticId": "https://paloframework.org/semantic/control/ctrl-fair-allocation?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-fair-allocation/classify",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-fair-allocation",
"semanticId": "https://paloframework.org/semantic/control/ctrl-fair-allocation?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "classify",
"semanticId": "https://paloframework.org/semantic/gate/classify?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-fair-allocation/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-fair-allocation",
"semanticId": "https://paloframework.org/semantic/control/ctrl-fair-allocation?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-fairness-quality-of-service/assess",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-fairness-quality-of-service",
"semanticId": "https://paloframework.org/semantic/control/ctrl-fairness-quality-of-service?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-fairness-quality-of-service/measure",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-fairness-quality-of-service",
"semanticId": "https://paloframework.org/semantic/control/ctrl-fairness-quality-of-service?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-fairness-quality-of-service/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-fairness-quality-of-service",
"semanticId": "https://paloframework.org/semantic/control/ctrl-fairness-quality-of-service?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-gpai-deployer/assess",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-gpai-deployer",
"semanticId": "https://paloframework.org/semantic/control/ctrl-gpai-deployer?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-gpai-deployer/classify",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-gpai-deployer",
"semanticId": "https://paloframework.org/semantic/control/ctrl-gpai-deployer?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "classify",
"semanticId": "https://paloframework.org/semantic/gate/classify?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-gpai-deployer/control",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-gpai-deployer",
"semanticId": "https://paloframework.org/semantic/control/ctrl-gpai-deployer?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-gpai-deployer/measure",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-gpai-deployer",
"semanticId": "https://paloframework.org/semantic/control/ctrl-gpai-deployer?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-gpai-deployer/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-gpai-deployer",
"semanticId": "https://paloframework.org/semantic/control/ctrl-gpai-deployer?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-gpai-provider/classify",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-gpai-provider",
"semanticId": "https://paloframework.org/semantic/control/ctrl-gpai-provider?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "classify",
"semanticId": "https://paloframework.org/semantic/gate/classify?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-gpai-provider/control",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-gpai-provider",
"semanticId": "https://paloframework.org/semantic/control/ctrl-gpai-provider?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-gpai-provider/measure",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-gpai-provider",
"semanticId": "https://paloframework.org/semantic/control/ctrl-gpai-provider?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-gpai-provider/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-gpai-provider",
"semanticId": "https://paloframework.org/semantic/control/ctrl-gpai-provider?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-harmful-representation/assess",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-harmful-representation",
"semanticId": "https://paloframework.org/semantic/control/ctrl-harmful-representation?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-harmful-representation/measure",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-harmful-representation",
"semanticId": "https://paloframework.org/semantic/control/ctrl-harmful-representation?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-harmful-representation/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-harmful-representation",
"semanticId": "https://paloframework.org/semantic/control/ctrl-harmful-representation?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-human-review/control",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-human-review",
"semanticId": "https://paloframework.org/semantic/control/ctrl-human-review?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-human-review/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-human-review",
"semanticId": "https://paloframework.org/semantic/control/ctrl-human-review?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-incident-response/control",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-incident-response",
"semanticId": "https://paloframework.org/semantic/control/ctrl-incident-response?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-incident-response/measure",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-incident-response",
"semanticId": "https://paloframework.org/semantic/control/ctrl-incident-response?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-incident-response/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-incident-response",
"semanticId": "https://paloframework.org/semantic/control/ctrl-incident-response?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-privacy-lifecycle/assess",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-privacy-lifecycle",
"semanticId": "https://paloframework.org/semantic/control/ctrl-privacy-lifecycle?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-privacy-lifecycle/classify",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-privacy-lifecycle",
"semanticId": "https://paloframework.org/semantic/control/ctrl-privacy-lifecycle?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "classify",
"semanticId": "https://paloframework.org/semantic/gate/classify?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-privacy-lifecycle/control",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-privacy-lifecycle",
"semanticId": "https://paloframework.org/semantic/control/ctrl-privacy-lifecycle?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-privacy-lifecycle/frame",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-privacy-lifecycle",
"semanticId": "https://paloframework.org/semantic/control/ctrl-privacy-lifecycle?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "frame",
"semanticId": "https://paloframework.org/semantic/gate/frame?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-privacy-lifecycle/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-privacy-lifecycle",
"semanticId": "https://paloframework.org/semantic/control/ctrl-privacy-lifecycle?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-purpose-boundary/classify",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-purpose-boundary",
"semanticId": "https://paloframework.org/semantic/control/ctrl-purpose-boundary?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "classify",
"semanticId": "https://paloframework.org/semantic/gate/classify?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-purpose-boundary/frame",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-purpose-boundary",
"semanticId": "https://paloframework.org/semantic/control/ctrl-purpose-boundary?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "frame",
"semanticId": "https://paloframework.org/semantic/gate/frame?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-regulatory-incident-reporting/control",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-regulatory-incident-reporting",
"semanticId": "https://paloframework.org/semantic/control/ctrl-regulatory-incident-reporting?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-regulatory-incident-reporting/measure",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-regulatory-incident-reporting",
"semanticId": "https://paloframework.org/semantic/control/ctrl-regulatory-incident-reporting?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-regulatory-incident-reporting/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-regulatory-incident-reporting",
"semanticId": "https://paloframework.org/semantic/control/ctrl-regulatory-incident-reporting?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-runtime-production-boundary/classify",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-runtime-production-boundary",
"semanticId": "https://paloframework.org/semantic/control/ctrl-runtime-production-boundary?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "classify",
"semanticId": "https://paloframework.org/semantic/gate/classify?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-runtime-production-boundary/control",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-runtime-production-boundary",
"semanticId": "https://paloframework.org/semantic/control/ctrl-runtime-production-boundary?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-runtime-production-boundary/measure",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-runtime-production-boundary",
"semanticId": "https://paloframework.org/semantic/control/ctrl-runtime-production-boundary?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-runtime-production-boundary/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-runtime-production-boundary",
"semanticId": "https://paloframework.org/semantic/control/ctrl-runtime-production-boundary?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-system-card-explanations/assess",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-system-card-explanations",
"semanticId": "https://paloframework.org/semantic/control/ctrl-system-card-explanations?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-system-card-explanations/control",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-system-card-explanations",
"semanticId": "https://paloframework.org/semantic/control/ctrl-system-card-explanations?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-system-card-explanations/frame",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-system-card-explanations",
"semanticId": "https://paloframework.org/semantic/control/ctrl-system-card-explanations?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "frame",
"semanticId": "https://paloframework.org/semantic/gate/frame?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-system-card-explanations/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-system-card-explanations",
"semanticId": "https://paloframework.org/semantic/control/ctrl-system-card-explanations?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-systemic-risk/assess",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-systemic-risk",
"semanticId": "https://paloframework.org/semantic/control/ctrl-systemic-risk?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-systemic-risk/classify",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-systemic-risk",
"semanticId": "https://paloframework.org/semantic/control/ctrl-systemic-risk?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "classify",
"semanticId": "https://paloframework.org/semantic/gate/classify?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-systemic-risk/control",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-systemic-risk",
"semanticId": "https://paloframework.org/semantic/control/ctrl-systemic-risk?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-systemic-risk/measure",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-systemic-risk",
"semanticId": "https://paloframework.org/semantic/control/ctrl-systemic-risk?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-systemic-risk/prove",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-systemic-risk",
"semanticId": "https://paloframework.org/semantic/control/ctrl-systemic-risk?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-third-party-due-diligence/assess",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-third-party-due-diligence",
"semanticId": "https://paloframework.org/semantic/control/ctrl-third-party-due-diligence?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-third-party-due-diligence/classify",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-third-party-due-diligence",
"semanticId": "https://paloframework.org/semantic/control/ctrl-third-party-due-diligence?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "classify",
"semanticId": "https://paloframework.org/semantic/gate/classify?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-gate/ctrl-third-party-due-diligence/control",
"mappingVersion": "1.0.0",
"mappingType": "control-to-gate",
"source": {
"entityType": "control",
"entityId": "ctrl-third-party-due-diligence",
"semanticId": "https://paloframework.org/semantic/control/ctrl-third-party-due-diligence?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "conditional",
"conditions": [
"Confirm applicability and ownership for the actual case."
],
"rationale": "The control is relevant to the named gate when the case scope activates it.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-adversarial-testing/kri-critical-test-failure-rate",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-adversarial-testing",
"semanticId": "https://paloframework.org/semantic/control/ctrl-adversarial-testing?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kri-critical-test-failure-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-critical-test-failure-rate?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-affected-person-notice/kpi-notice-delivery-coverage",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-affected-person-notice",
"semanticId": "https://paloframework.org/semantic/control/ctrl-affected-person-notice?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-notice-delivery-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-notice-delivery-coverage?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-agentic-authority/kpi-review-completion",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-agentic-authority",
"semanticId": "https://paloframework.org/semantic/control/ctrl-agentic-authority?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-review-completion",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-review-completion?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-agentic-authority/kri-scope-change-rate",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-agentic-authority",
"semanticId": "https://paloframework.org/semantic/control/ctrl-agentic-authority?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kri-scope-change-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-scope-change-rate?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-ai-literacy-effectiveness/kpi-ai-literacy-competence-rate",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-ai-literacy-effectiveness",
"semanticId": "https://paloframework.org/semantic/control/ctrl-ai-literacy-effectiveness?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-ai-literacy-competence-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-ai-literacy-competence-rate?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-ai-literacy-effectiveness/kri-trained-control-error-rate",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-ai-literacy-effectiveness",
"semanticId": "https://paloframework.org/semantic/control/ctrl-ai-literacy-effectiveness?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kri-trained-control-error-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-trained-control-error-rate?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-ai-output-accessibility/kpi-accessibility-test-pass-rate",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-ai-output-accessibility",
"semanticId": "https://paloframework.org/semantic/control/ctrl-ai-output-accessibility?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-accessibility-test-pass-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-accessibility-test-pass-rate?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-ai-output-accessibility/kri-accessibility-blocker-rate",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-ai-output-accessibility",
"semanticId": "https://paloframework.org/semantic/control/ctrl-ai-output-accessibility?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kri-accessibility-blocker-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-accessibility-blocker-rate?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-aims-internal-audit/kpi-aims-audit-completion",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-aims-internal-audit",
"semanticId": "https://paloframework.org/semantic/control/ctrl-aims-internal-audit?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-aims-audit-completion",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-aims-audit-completion?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-aims-internal-audit/kpi-corrective-action-closure",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-aims-internal-audit",
"semanticId": "https://paloframework.org/semantic/control/ctrl-aims-internal-audit?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-corrective-action-closure",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-corrective-action-closure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-aims-leadership-objectives/kpi-aims-objective-coverage",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-aims-leadership-objectives",
"semanticId": "https://paloframework.org/semantic/control/ctrl-aims-leadership-objectives?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-aims-objective-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-aims-objective-coverage?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-aims-management-review-capa/kpi-aims-objective-coverage",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-aims-management-review-capa",
"semanticId": "https://paloframework.org/semantic/control/ctrl-aims-management-review-capa?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-aims-objective-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-aims-objective-coverage?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-aims-management-review-capa/kpi-corrective-action-closure",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-aims-management-review-capa",
"semanticId": "https://paloframework.org/semantic/control/ctrl-aims-management-review-capa?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-corrective-action-closure",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-corrective-action-closure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-annotation-quality/kpi-annotation-quality-coverage",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-annotation-quality",
"semanticId": "https://paloframework.org/semantic/control/ctrl-annotation-quality?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-annotation-quality-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-annotation-quality-coverage?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-appeal-remedy/kpi-appeal-resolution-sla",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-appeal-remedy",
"semanticId": "https://paloframework.org/semantic/control/ctrl-appeal-remedy?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-appeal-resolution-sla",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-appeal-resolution-sla?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-appeal-remedy/kri-overdue-remedy-rate",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-appeal-remedy",
"semanticId": "https://paloframework.org/semantic/control/ctrl-appeal-remedy?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kri-overdue-remedy-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-overdue-remedy-rate?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-article50-transparency/kpi-machine-readable-marking-coverage",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-article50-transparency",
"semanticId": "https://paloframework.org/semantic/control/ctrl-article50-transparency?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-machine-readable-marking-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-machine-readable-marking-coverage?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-article50-transparency/kri-provenance-verification-failure-rate",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-article50-transparency",
"semanticId": "https://paloframework.org/semantic/control/ctrl-article50-transparency?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kri-provenance-verification-failure-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-provenance-verification-failure-rate?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-change-gate/kpi-review-completion",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-change-gate",
"semanticId": "https://paloframework.org/semantic/control/ctrl-change-gate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-review-completion",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-review-completion?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-change-gate/kri-scope-change-rate",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-change-gate",
"semanticId": "https://paloframework.org/semantic/control/ctrl-change-gate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kri-scope-change-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-scope-change-rate?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-data-governance-lifecycle/kpi-data-lifecycle-coverage",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-data-governance-lifecycle",
"semanticId": "https://paloframework.org/semantic/control/ctrl-data-governance-lifecycle?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-data-lifecycle-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-data-lifecycle-coverage?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-data-governance-lifecycle/kpi-deletion-verification-coverage",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-data-governance-lifecycle",
"semanticId": "https://paloframework.org/semantic/control/ctrl-data-governance-lifecycle?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-deletion-verification-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-deletion-verification-coverage?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-data-governance-lifecycle/kpi-provenance-coverage",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-data-governance-lifecycle",
"semanticId": "https://paloframework.org/semantic/control/ctrl-data-governance-lifecycle?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-provenance-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-provenance-coverage?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-data-provenance/kpi-provenance-coverage",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-data-provenance",
"semanticId": "https://paloframework.org/semantic/control/ctrl-data-provenance?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-provenance-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-provenance-coverage?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-data-provenance/kri-sensitive-data-events",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-data-provenance",
"semanticId": "https://paloframework.org/semantic/control/ctrl-data-provenance?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kri-sensitive-data-events",
"semanticId": "https://paloframework.org/semantic/indicator/kri-sensitive-data-events?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-decision-trace/kpi-provenance-coverage",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-decision-trace",
"semanticId": "https://paloframework.org/semantic/control/ctrl-decision-trace?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-provenance-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-provenance-coverage?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-decision-trace/kpi-review-completion",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-decision-trace",
"semanticId": "https://paloframework.org/semantic/control/ctrl-decision-trace?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-review-completion",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-review-completion?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-decommissioning/kpi-decommissioning-evidence-coverage",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-decommissioning",
"semanticId": "https://paloframework.org/semantic/control/ctrl-decommissioning?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-decommissioning-evidence-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-decommissioning-evidence-coverage?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-environmental-performance/kpi-energy-measurement-coverage",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-environmental-performance",
"semanticId": "https://paloframework.org/semantic/control/ctrl-environmental-performance?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-energy-measurement-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-energy-measurement-coverage?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-environmental-performance/kri-environmental-budget-variance",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-environmental-performance",
"semanticId": "https://paloframework.org/semantic/control/ctrl-environmental-performance?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kri-environmental-budget-variance",
"semanticId": "https://paloframework.org/semantic/indicator/kri-environmental-budget-variance?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-fair-allocation/kpi-subgroup-evaluation-coverage",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-fair-allocation",
"semanticId": "https://paloframework.org/semantic/control/ctrl-fair-allocation?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-subgroup-evaluation-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-subgroup-evaluation-coverage?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-fair-allocation/kri-residual-disparity-rate",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-fair-allocation",
"semanticId": "https://paloframework.org/semantic/control/ctrl-fair-allocation?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kri-residual-disparity-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-residual-disparity-rate?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-fairness-quality-of-service/kpi-subgroup-evaluation-coverage",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-fairness-quality-of-service",
"semanticId": "https://paloframework.org/semantic/control/ctrl-fairness-quality-of-service?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-subgroup-evaluation-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-subgroup-evaluation-coverage?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-fairness-quality-of-service/kri-residual-disparity-rate",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-fairness-quality-of-service",
"semanticId": "https://paloframework.org/semantic/control/ctrl-fairness-quality-of-service?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kri-residual-disparity-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-residual-disparity-rate?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-gpai-deployer/kpi-gpai-obligation-evidence-coverage",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-gpai-deployer",
"semanticId": "https://paloframework.org/semantic/control/ctrl-gpai-deployer?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-gpai-obligation-evidence-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-gpai-obligation-evidence-coverage?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-gpai-deployer/kpi-vendor-evidence-coverage",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-gpai-deployer",
"semanticId": "https://paloframework.org/semantic/control/ctrl-gpai-deployer?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-vendor-evidence-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-vendor-evidence-coverage?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-gpai-provider/kpi-gpai-obligation-evidence-coverage",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-gpai-provider",
"semanticId": "https://paloframework.org/semantic/control/ctrl-gpai-provider?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-gpai-obligation-evidence-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-gpai-obligation-evidence-coverage?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-harmful-representation/kri-harmful-representation-rate",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-harmful-representation",
"semanticId": "https://paloframework.org/semantic/control/ctrl-harmful-representation?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kri-harmful-representation-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-harmful-representation-rate?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-human-review/kpi-review-completion",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-human-review",
"semanticId": "https://paloframework.org/semantic/control/ctrl-human-review?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-review-completion",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-review-completion?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-human-review/kri-override-failure-rate",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-human-review",
"semanticId": "https://paloframework.org/semantic/control/ctrl-human-review?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kri-override-failure-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-override-failure-rate?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-incident-response/kpi-incident-triage-time",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-incident-response",
"semanticId": "https://paloframework.org/semantic/control/ctrl-incident-response?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-incident-triage-time",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-incident-triage-time?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-incident-response/kri-sensitive-data-events",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-incident-response",
"semanticId": "https://paloframework.org/semantic/control/ctrl-incident-response?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kri-sensitive-data-events",
"semanticId": "https://paloframework.org/semantic/indicator/kri-sensitive-data-events?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-privacy-lifecycle/kpi-data-lifecycle-coverage",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-privacy-lifecycle",
"semanticId": "https://paloframework.org/semantic/control/ctrl-privacy-lifecycle?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-data-lifecycle-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-data-lifecycle-coverage?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-privacy-lifecycle/kpi-deletion-verification-coverage",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-privacy-lifecycle",
"semanticId": "https://paloframework.org/semantic/control/ctrl-privacy-lifecycle?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-deletion-verification-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-deletion-verification-coverage?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-privacy-lifecycle/kri-sensitive-data-events",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-privacy-lifecycle",
"semanticId": "https://paloframework.org/semantic/control/ctrl-privacy-lifecycle?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kri-sensitive-data-events",
"semanticId": "https://paloframework.org/semantic/indicator/kri-sensitive-data-events?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-purpose-boundary/kri-scope-change-rate",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-purpose-boundary",
"semanticId": "https://paloframework.org/semantic/control/ctrl-purpose-boundary?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kri-scope-change-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-scope-change-rate?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-regulatory-incident-reporting/kpi-incident-triage-time",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-regulatory-incident-reporting",
"semanticId": "https://paloframework.org/semantic/control/ctrl-regulatory-incident-reporting?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-incident-triage-time",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-incident-triage-time?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-regulatory-incident-reporting/kpi-regulatory-reporting-clock-compliance",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-regulatory-incident-reporting",
"semanticId": "https://paloframework.org/semantic/control/ctrl-regulatory-incident-reporting?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-regulatory-reporting-clock-compliance",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-regulatory-reporting-clock-compliance?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-runtime-production-boundary/kpi-production-admission-coverage",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-runtime-production-boundary",
"semanticId": "https://paloframework.org/semantic/control/ctrl-runtime-production-boundary?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-production-admission-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-production-admission-coverage?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-runtime-production-boundary/kri-execution-bypass-rate",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-runtime-production-boundary",
"semanticId": "https://paloframework.org/semantic/control/ctrl-runtime-production-boundary?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kri-execution-bypass-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-execution-bypass-rate?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-system-card-explanations/kpi-explanation-comprehension",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-system-card-explanations",
"semanticId": "https://paloframework.org/semantic/control/ctrl-system-card-explanations?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-explanation-comprehension",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-explanation-comprehension?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-system-card-explanations/kpi-system-card-coverage",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-system-card-explanations",
"semanticId": "https://paloframework.org/semantic/control/ctrl-system-card-explanations?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-system-card-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-system-card-coverage?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-systemic-risk/kri-critical-test-failure-rate",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-systemic-risk",
"semanticId": "https://paloframework.org/semantic/control/ctrl-systemic-risk?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kri-critical-test-failure-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-critical-test-failure-rate?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-systemic-risk/kri-systemic-risk-finding-rate",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-systemic-risk",
"semanticId": "https://paloframework.org/semantic/control/ctrl-systemic-risk?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kri-systemic-risk-finding-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-systemic-risk-finding-rate?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-indicator/ctrl-third-party-due-diligence/kpi-vendor-evidence-coverage",
"mappingVersion": "1.0.0",
"mappingType": "control-to-indicator",
"source": {
"entityType": "control",
"entityId": "ctrl-third-party-due-diligence",
"semanticId": "https://paloframework.org/semantic/control/ctrl-third-party-due-diligence?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "indicator",
"entityId": "kpi-vendor-evidence-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-vendor-evidence-coverage?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can provide a signal about the control without proving control effectiveness.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-indicator: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-adversarial-testing/src-nist-genai-profile",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-adversarial-testing",
"semanticId": "https://paloframework.org/semantic/control/ctrl-adversarial-testing?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-genai-profile",
"semanticId": "https://paloframework.org/semantic/source/src-nist-genai-profile?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-adversarial-testing/src-owasp-llm-top10",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-adversarial-testing",
"semanticId": "https://paloframework.org/semantic/control/ctrl-adversarial-testing?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-owasp-llm-top10",
"semanticId": "https://paloframework.org/semantic/source/src-owasp-llm-top10?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-affected-person-notice/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-affected-person-notice",
"semanticId": "https://paloframework.org/semantic/control/ctrl-affected-person-notice?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-affected-person-notice/src-eu-article50-guidelines",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-affected-person-notice",
"semanticId": "https://paloframework.org/semantic/control/ctrl-affected-person-notice?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-article50-guidelines",
"semanticId": "https://paloframework.org/semantic/source/src-eu-article50-guidelines?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-affected-person-notice/src-wcag-22",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-affected-person-notice",
"semanticId": "https://paloframework.org/semantic/control/ctrl-affected-person-notice?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-wcag-22",
"semanticId": "https://paloframework.org/semantic/source/src-wcag-22?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-agentic-authority/src-iso-42001",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-agentic-authority",
"semanticId": "https://paloframework.org/semantic/control/ctrl-agentic-authority?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42001",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42001?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-agentic-authority/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-agentic-authority",
"semanticId": "https://paloframework.org/semantic/control/ctrl-agentic-authority?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-ai-literacy-effectiveness/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-ai-literacy-effectiveness",
"semanticId": "https://paloframework.org/semantic/control/ctrl-ai-literacy-effectiveness?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-ai-literacy-effectiveness/src-iso-42001",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-ai-literacy-effectiveness",
"semanticId": "https://paloframework.org/semantic/control/ctrl-ai-literacy-effectiveness?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42001",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42001?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-ai-output-accessibility/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-ai-output-accessibility",
"semanticId": "https://paloframework.org/semantic/control/ctrl-ai-output-accessibility?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-ai-output-accessibility/src-iso-42005",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-ai-output-accessibility",
"semanticId": "https://paloframework.org/semantic/control/ctrl-ai-output-accessibility?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42005",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42005?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-ai-output-accessibility/src-wcag-22",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-ai-output-accessibility",
"semanticId": "https://paloframework.org/semantic/control/ctrl-ai-output-accessibility?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-wcag-22",
"semanticId": "https://paloframework.org/semantic/source/src-wcag-22?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-aims-internal-audit/src-iso-42001",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-aims-internal-audit",
"semanticId": "https://paloframework.org/semantic/control/ctrl-aims-internal-audit?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42001",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42001?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-aims-leadership-objectives/src-iso-42001",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-aims-leadership-objectives",
"semanticId": "https://paloframework.org/semantic/control/ctrl-aims-leadership-objectives?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42001",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42001?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-aims-management-review-capa/src-iso-42001",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-aims-management-review-capa",
"semanticId": "https://paloframework.org/semantic/control/ctrl-aims-management-review-capa?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42001",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42001?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-annotation-quality/src-iso-42005",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-annotation-quality",
"semanticId": "https://paloframework.org/semantic/control/ctrl-annotation-quality?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42005",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42005?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-annotation-quality/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-annotation-quality",
"semanticId": "https://paloframework.org/semantic/control/ctrl-annotation-quality?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-appeal-remedy/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-appeal-remedy",
"semanticId": "https://paloframework.org/semantic/control/ctrl-appeal-remedy?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-appeal-remedy/src-iso-42005",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-appeal-remedy",
"semanticId": "https://paloframework.org/semantic/control/ctrl-appeal-remedy?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42005",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42005?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-article50-transparency/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-article50-transparency",
"semanticId": "https://paloframework.org/semantic/control/ctrl-article50-transparency?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-article50-transparency/src-eu-article50-guidelines",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-article50-transparency",
"semanticId": "https://paloframework.org/semantic/control/ctrl-article50-transparency?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-article50-guidelines",
"semanticId": "https://paloframework.org/semantic/source/src-eu-article50-guidelines?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-change-gate/src-iso-42001",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-change-gate",
"semanticId": "https://paloframework.org/semantic/control/ctrl-change-gate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42001",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42001?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-change-gate/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-change-gate",
"semanticId": "https://paloframework.org/semantic/control/ctrl-change-gate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-data-governance-lifecycle/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-data-governance-lifecycle",
"semanticId": "https://paloframework.org/semantic/control/ctrl-data-governance-lifecycle?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-data-governance-lifecycle/src-eu-gdpr",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-data-governance-lifecycle",
"semanticId": "https://paloframework.org/semantic/control/ctrl-data-governance-lifecycle?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-gdpr",
"semanticId": "https://paloframework.org/semantic/source/src-eu-gdpr?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-data-governance-lifecycle/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-data-governance-lifecycle",
"semanticId": "https://paloframework.org/semantic/control/ctrl-data-governance-lifecycle?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-data-provenance/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-data-provenance",
"semanticId": "https://paloframework.org/semantic/control/ctrl-data-provenance?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-data-provenance/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-data-provenance",
"semanticId": "https://paloframework.org/semantic/control/ctrl-data-provenance?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-decision-trace/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-decision-trace",
"semanticId": "https://paloframework.org/semantic/control/ctrl-decision-trace?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-decision-trace/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-decision-trace",
"semanticId": "https://paloframework.org/semantic/control/ctrl-decision-trace?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-decommissioning/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-decommissioning",
"semanticId": "https://paloframework.org/semantic/control/ctrl-decommissioning?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-decommissioning/src-iso-42001",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-decommissioning",
"semanticId": "https://paloframework.org/semantic/control/ctrl-decommissioning?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42001",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42001?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-decommissioning/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-decommissioning",
"semanticId": "https://paloframework.org/semantic/control/ctrl-decommissioning?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-environmental-performance/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-environmental-performance",
"semanticId": "https://paloframework.org/semantic/control/ctrl-environmental-performance?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-environmental-performance/src-iso-42001",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-environmental-performance",
"semanticId": "https://paloframework.org/semantic/control/ctrl-environmental-performance?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42001",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42001?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-environmental-performance/src-iso-42005",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-environmental-performance",
"semanticId": "https://paloframework.org/semantic/control/ctrl-environmental-performance?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42005",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42005?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-fair-allocation/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-fair-allocation",
"semanticId": "https://paloframework.org/semantic/control/ctrl-fair-allocation?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-fair-allocation/src-iso-42005",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-fair-allocation",
"semanticId": "https://paloframework.org/semantic/control/ctrl-fair-allocation?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42005",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42005?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-fair-allocation/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-fair-allocation",
"semanticId": "https://paloframework.org/semantic/control/ctrl-fair-allocation?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-fairness-quality-of-service/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-fairness-quality-of-service",
"semanticId": "https://paloframework.org/semantic/control/ctrl-fairness-quality-of-service?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-fairness-quality-of-service/src-iso-42005",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-fairness-quality-of-service",
"semanticId": "https://paloframework.org/semantic/control/ctrl-fairness-quality-of-service?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42005",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42005?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-fairness-quality-of-service/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-fairness-quality-of-service",
"semanticId": "https://paloframework.org/semantic/control/ctrl-fairness-quality-of-service?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-gpai-deployer/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-gpai-deployer",
"semanticId": "https://paloframework.org/semantic/control/ctrl-gpai-deployer?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-gpai-deployer/src-eu-gpai-code",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-gpai-deployer",
"semanticId": "https://paloframework.org/semantic/control/ctrl-gpai-deployer?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-gpai-code",
"semanticId": "https://paloframework.org/semantic/source/src-eu-gpai-code?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-gpai-deployer/src-nist-genai-profile",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-gpai-deployer",
"semanticId": "https://paloframework.org/semantic/control/ctrl-gpai-deployer?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-genai-profile",
"semanticId": "https://paloframework.org/semantic/source/src-nist-genai-profile?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-gpai-provider/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-gpai-provider",
"semanticId": "https://paloframework.org/semantic/control/ctrl-gpai-provider?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-gpai-provider/src-eu-gpai-code",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-gpai-provider",
"semanticId": "https://paloframework.org/semantic/control/ctrl-gpai-provider?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-gpai-code",
"semanticId": "https://paloframework.org/semantic/source/src-eu-gpai-code?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-harmful-representation/src-iso-42005",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-harmful-representation",
"semanticId": "https://paloframework.org/semantic/control/ctrl-harmful-representation?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42005",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42005?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-harmful-representation/src-nist-genai-profile",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-harmful-representation",
"semanticId": "https://paloframework.org/semantic/control/ctrl-harmful-representation?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-genai-profile",
"semanticId": "https://paloframework.org/semantic/source/src-nist-genai-profile?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-human-review/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-human-review",
"semanticId": "https://paloframework.org/semantic/control/ctrl-human-review?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-human-review/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-human-review",
"semanticId": "https://paloframework.org/semantic/control/ctrl-human-review?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-human-review/src-oecd-ai-principles",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-human-review",
"semanticId": "https://paloframework.org/semantic/control/ctrl-human-review?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-oecd-ai-principles",
"semanticId": "https://paloframework.org/semantic/source/src-oecd-ai-principles?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-incident-response/src-iso-42001",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-incident-response",
"semanticId": "https://paloframework.org/semantic/control/ctrl-incident-response?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42001",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42001?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-incident-response/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-incident-response",
"semanticId": "https://paloframework.org/semantic/control/ctrl-incident-response?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-privacy-lifecycle/src-eu-gdpr",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-privacy-lifecycle",
"semanticId": "https://paloframework.org/semantic/control/ctrl-privacy-lifecycle?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-gdpr",
"semanticId": "https://paloframework.org/semantic/source/src-eu-gdpr?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-privacy-lifecycle/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-privacy-lifecycle",
"semanticId": "https://paloframework.org/semantic/control/ctrl-privacy-lifecycle?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-purpose-boundary/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-purpose-boundary",
"semanticId": "https://paloframework.org/semantic/control/ctrl-purpose-boundary?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-purpose-boundary/src-oecd-ai-principles",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-purpose-boundary",
"semanticId": "https://paloframework.org/semantic/control/ctrl-purpose-boundary?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-oecd-ai-principles",
"semanticId": "https://paloframework.org/semantic/source/src-oecd-ai-principles?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-regulatory-incident-reporting/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-regulatory-incident-reporting",
"semanticId": "https://paloframework.org/semantic/control/ctrl-regulatory-incident-reporting?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-regulatory-incident-reporting/src-iso-42001",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-regulatory-incident-reporting",
"semanticId": "https://paloframework.org/semantic/control/ctrl-regulatory-incident-reporting?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42001",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42001?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-runtime-production-boundary/src-iso-42001",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-runtime-production-boundary",
"semanticId": "https://paloframework.org/semantic/control/ctrl-runtime-production-boundary?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42001",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42001?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-runtime-production-boundary/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-runtime-production-boundary",
"semanticId": "https://paloframework.org/semantic/control/ctrl-runtime-production-boundary?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-runtime-production-boundary/src-owasp-llm-top10",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-runtime-production-boundary",
"semanticId": "https://paloframework.org/semantic/control/ctrl-runtime-production-boundary?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-owasp-llm-top10",
"semanticId": "https://paloframework.org/semantic/source/src-owasp-llm-top10?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-system-card-explanations/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-system-card-explanations",
"semanticId": "https://paloframework.org/semantic/control/ctrl-system-card-explanations?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-system-card-explanations/src-iso-42005",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-system-card-explanations",
"semanticId": "https://paloframework.org/semantic/control/ctrl-system-card-explanations?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42005",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42005?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-system-card-explanations/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-system-card-explanations",
"semanticId": "https://paloframework.org/semantic/control/ctrl-system-card-explanations?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-systemic-risk/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-systemic-risk",
"semanticId": "https://paloframework.org/semantic/control/ctrl-systemic-risk?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-systemic-risk/src-eu-gpai-code",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-systemic-risk",
"semanticId": "https://paloframework.org/semantic/control/ctrl-systemic-risk?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-gpai-code",
"semanticId": "https://paloframework.org/semantic/source/src-eu-gpai-code?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-systemic-risk/src-nist-genai-profile",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-systemic-risk",
"semanticId": "https://paloframework.org/semantic/control/ctrl-systemic-risk?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-genai-profile",
"semanticId": "https://paloframework.org/semantic/source/src-nist-genai-profile?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-systemic-risk/src-owasp-llm-top10",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-systemic-risk",
"semanticId": "https://paloframework.org/semantic/control/ctrl-systemic-risk?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-owasp-llm-top10",
"semanticId": "https://paloframework.org/semantic/source/src-owasp-llm-top10?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-third-party-due-diligence/src-iso-42001",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-third-party-due-diligence",
"semanticId": "https://paloframework.org/semantic/control/ctrl-third-party-due-diligence?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42001",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42001?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/control-to-source/ctrl-third-party-due-diligence/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "control-to-source",
"source": {
"entityType": "control",
"entityId": "ctrl-third-party-due-diligence",
"semanticId": "https://paloframework.org/semantic/control/ctrl-third-party-due-diligence?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The registered source informs the control objective and tailoring context.",
"basis": "Declared relationship in data/control-library.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/control-library.json",
"generationRule": "control-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/gate-to-source/assess/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "gate-to-source",
"source": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source provides context for accountable gate deliberation.",
"basis": "Declared relationship in data/decision-gates.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/decision-gates.json",
"generationRule": "gate-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/gate-to-source/assess/src-nist-genai-profile",
"mappingVersion": "1.0.0",
"mappingType": "gate-to-source",
"source": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-genai-profile",
"semanticId": "https://paloframework.org/semantic/source/src-nist-genai-profile?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source provides context for accountable gate deliberation.",
"basis": "Declared relationship in data/decision-gates.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/decision-gates.json",
"generationRule": "gate-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/gate-to-source/classify/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "gate-to-source",
"source": {
"entityType": "gate",
"entityId": "classify",
"semanticId": "https://paloframework.org/semantic/gate/classify?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source provides context for accountable gate deliberation.",
"basis": "Declared relationship in data/decision-gates.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/decision-gates.json",
"generationRule": "gate-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/gate-to-source/classify/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "gate-to-source",
"source": {
"entityType": "gate",
"entityId": "classify",
"semanticId": "https://paloframework.org/semantic/gate/classify?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source provides context for accountable gate deliberation.",
"basis": "Declared relationship in data/decision-gates.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/decision-gates.json",
"generationRule": "gate-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/gate-to-source/control/src-iso-42001",
"mappingVersion": "1.0.0",
"mappingType": "gate-to-source",
"source": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42001",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42001?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source provides context for accountable gate deliberation.",
"basis": "Declared relationship in data/decision-gates.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/decision-gates.json",
"generationRule": "gate-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/gate-to-source/control/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "gate-to-source",
"source": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source provides context for accountable gate deliberation.",
"basis": "Declared relationship in data/decision-gates.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/decision-gates.json",
"generationRule": "gate-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/gate-to-source/frame/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "gate-to-source",
"source": {
"entityType": "gate",
"entityId": "frame",
"semanticId": "https://paloframework.org/semantic/gate/frame?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source provides context for accountable gate deliberation.",
"basis": "Declared relationship in data/decision-gates.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/decision-gates.json",
"generationRule": "gate-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/gate-to-source/frame/src-oecd-ai-principles",
"mappingVersion": "1.0.0",
"mappingType": "gate-to-source",
"source": {
"entityType": "gate",
"entityId": "frame",
"semanticId": "https://paloframework.org/semantic/gate/frame?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-oecd-ai-principles",
"semanticId": "https://paloframework.org/semantic/source/src-oecd-ai-principles?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source provides context for accountable gate deliberation.",
"basis": "Declared relationship in data/decision-gates.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/decision-gates.json",
"generationRule": "gate-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/gate-to-source/measure/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "gate-to-source",
"source": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source provides context for accountable gate deliberation.",
"basis": "Declared relationship in data/decision-gates.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/decision-gates.json",
"generationRule": "gate-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/gate-to-source/prove/src-iso-42001",
"mappingVersion": "1.0.0",
"mappingType": "gate-to-source",
"source": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42001",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42001?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source provides context for accountable gate deliberation.",
"basis": "Declared relationship in data/decision-gates.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/decision-gates.json",
"generationRule": "gate-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/gate-to-source/prove/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "gate-to-source",
"source": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source provides context for accountable gate deliberation.",
"basis": "Declared relationship in data/decision-gates.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/decision-gates.json",
"generationRule": "gate-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-accessibility-test-pass-rate/assess",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-accessibility-test-pass-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-accessibility-test-pass-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-accessibility-test-pass-rate/control",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-accessibility-test-pass-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-accessibility-test-pass-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-accessibility-test-pass-rate/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-accessibility-test-pass-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-accessibility-test-pass-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-accessibility-test-pass-rate/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-accessibility-test-pass-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-accessibility-test-pass-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-ai-literacy-competence-rate/control",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-ai-literacy-competence-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-ai-literacy-competence-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-ai-literacy-competence-rate/frame",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-ai-literacy-competence-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-ai-literacy-competence-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "frame",
"semanticId": "https://paloframework.org/semantic/gate/frame?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-ai-literacy-competence-rate/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-ai-literacy-competence-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-ai-literacy-competence-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-ai-literacy-competence-rate/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-ai-literacy-competence-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-ai-literacy-competence-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-aims-audit-completion/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-aims-audit-completion",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-aims-audit-completion?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-aims-audit-completion/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-aims-audit-completion",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-aims-audit-completion?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-aims-objective-coverage/classify",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-aims-objective-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-aims-objective-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "classify",
"semanticId": "https://paloframework.org/semantic/gate/classify?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-aims-objective-coverage/frame",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-aims-objective-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-aims-objective-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "frame",
"semanticId": "https://paloframework.org/semantic/gate/frame?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-aims-objective-coverage/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-aims-objective-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-aims-objective-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-aims-objective-coverage/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-aims-objective-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-aims-objective-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-annotation-quality-coverage/assess",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-annotation-quality-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-annotation-quality-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-annotation-quality-coverage/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-annotation-quality-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-annotation-quality-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-annotation-quality-coverage/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-annotation-quality-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-annotation-quality-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-appeal-resolution-sla/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-appeal-resolution-sla",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-appeal-resolution-sla?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-appeal-resolution-sla/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-appeal-resolution-sla",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-appeal-resolution-sla?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-corrective-action-closure/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-corrective-action-closure",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-corrective-action-closure?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-corrective-action-closure/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-corrective-action-closure",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-corrective-action-closure?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-data-lifecycle-coverage/assess",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-data-lifecycle-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-data-lifecycle-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-data-lifecycle-coverage/control",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-data-lifecycle-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-data-lifecycle-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-data-lifecycle-coverage/frame",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-data-lifecycle-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-data-lifecycle-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "frame",
"semanticId": "https://paloframework.org/semantic/gate/frame?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-data-lifecycle-coverage/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-data-lifecycle-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-data-lifecycle-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-decommissioning-evidence-coverage/control",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-decommissioning-evidence-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-decommissioning-evidence-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-decommissioning-evidence-coverage/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-decommissioning-evidence-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-decommissioning-evidence-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-decommissioning-evidence-coverage/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-decommissioning-evidence-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-decommissioning-evidence-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-deletion-verification-coverage/control",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-deletion-verification-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-deletion-verification-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-deletion-verification-coverage/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-deletion-verification-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-deletion-verification-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-deletion-verification-coverage/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-deletion-verification-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-deletion-verification-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-energy-measurement-coverage/assess",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-energy-measurement-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-energy-measurement-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-energy-measurement-coverage/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-energy-measurement-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-energy-measurement-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-energy-measurement-coverage/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-energy-measurement-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-energy-measurement-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-explanation-comprehension/assess",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-explanation-comprehension",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-explanation-comprehension?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-explanation-comprehension/control",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-explanation-comprehension",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-explanation-comprehension?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-explanation-comprehension/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-explanation-comprehension",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-explanation-comprehension?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-gpai-obligation-evidence-coverage/classify",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-gpai-obligation-evidence-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-gpai-obligation-evidence-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "classify",
"semanticId": "https://paloframework.org/semantic/gate/classify?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-gpai-obligation-evidence-coverage/control",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-gpai-obligation-evidence-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-gpai-obligation-evidence-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-gpai-obligation-evidence-coverage/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-gpai-obligation-evidence-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-gpai-obligation-evidence-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-gpai-obligation-evidence-coverage/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-gpai-obligation-evidence-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-gpai-obligation-evidence-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-incident-triage-time/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-incident-triage-time",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-incident-triage-time?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-incident-triage-time/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-incident-triage-time",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-incident-triage-time?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-machine-readable-marking-coverage/control",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-machine-readable-marking-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-machine-readable-marking-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-machine-readable-marking-coverage/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-machine-readable-marking-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-machine-readable-marking-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-machine-readable-marking-coverage/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-machine-readable-marking-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-machine-readable-marking-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-notice-delivery-coverage/control",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-notice-delivery-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-notice-delivery-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-notice-delivery-coverage/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-notice-delivery-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-notice-delivery-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-production-admission-coverage/classify",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-production-admission-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-production-admission-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "classify",
"semanticId": "https://paloframework.org/semantic/gate/classify?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-production-admission-coverage/control",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-production-admission-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-production-admission-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-production-admission-coverage/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-production-admission-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-production-admission-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-production-admission-coverage/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-production-admission-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-production-admission-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-provenance-coverage/assess",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-provenance-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-provenance-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-provenance-coverage/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-provenance-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-provenance-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-regulatory-reporting-clock-compliance/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-regulatory-reporting-clock-compliance",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-regulatory-reporting-clock-compliance?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-regulatory-reporting-clock-compliance/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-regulatory-reporting-clock-compliance",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-regulatory-reporting-clock-compliance?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-review-completion/control",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-review-completion",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-review-completion?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-review-completion/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-review-completion",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-review-completion?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-review-completion/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-review-completion",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-review-completion?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-subgroup-evaluation-coverage/assess",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-subgroup-evaluation-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-subgroup-evaluation-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-subgroup-evaluation-coverage/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-subgroup-evaluation-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-subgroup-evaluation-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-subgroup-evaluation-coverage/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-subgroup-evaluation-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-subgroup-evaluation-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-system-card-coverage/assess",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-system-card-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-system-card-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-system-card-coverage/frame",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-system-card-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-system-card-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "frame",
"semanticId": "https://paloframework.org/semantic/gate/frame?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-system-card-coverage/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-system-card-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-system-card-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-vendor-evidence-coverage/assess",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-vendor-evidence-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-vendor-evidence-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kpi-vendor-evidence-coverage/control",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kpi-vendor-evidence-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-vendor-evidence-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-accessibility-blocker-rate/control",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-accessibility-blocker-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-accessibility-blocker-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-accessibility-blocker-rate/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-accessibility-blocker-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-accessibility-blocker-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-accessibility-blocker-rate/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-accessibility-blocker-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-accessibility-blocker-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-critical-test-failure-rate/assess",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-critical-test-failure-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-critical-test-failure-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-critical-test-failure-rate/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-critical-test-failure-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-critical-test-failure-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-critical-test-failure-rate/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-critical-test-failure-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-critical-test-failure-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-environmental-budget-variance/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-environmental-budget-variance",
"semanticId": "https://paloframework.org/semantic/indicator/kri-environmental-budget-variance?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-environmental-budget-variance/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-environmental-budget-variance",
"semanticId": "https://paloframework.org/semantic/indicator/kri-environmental-budget-variance?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-execution-bypass-rate/control",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-execution-bypass-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-execution-bypass-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-execution-bypass-rate/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-execution-bypass-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-execution-bypass-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-execution-bypass-rate/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-execution-bypass-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-execution-bypass-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-harmful-representation-rate/assess",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-harmful-representation-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-harmful-representation-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-harmful-representation-rate/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-harmful-representation-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-harmful-representation-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-harmful-representation-rate/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-harmful-representation-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-harmful-representation-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-multi-agent-conflict-rate/control",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-multi-agent-conflict-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-multi-agent-conflict-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-multi-agent-conflict-rate/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-multi-agent-conflict-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-multi-agent-conflict-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-overdue-remedy-rate/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-overdue-remedy-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-overdue-remedy-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-overdue-remedy-rate/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-overdue-remedy-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-overdue-remedy-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-override-failure-rate/control",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-override-failure-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-override-failure-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-override-failure-rate/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-override-failure-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-override-failure-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-provenance-verification-failure-rate/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-provenance-verification-failure-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-provenance-verification-failure-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-provenance-verification-failure-rate/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-provenance-verification-failure-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-provenance-verification-failure-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-residual-disparity-rate/assess",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-residual-disparity-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-residual-disparity-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-residual-disparity-rate/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-residual-disparity-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-residual-disparity-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-residual-disparity-rate/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-residual-disparity-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-residual-disparity-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-scope-change-rate/classify",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-scope-change-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-scope-change-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "classify",
"semanticId": "https://paloframework.org/semantic/gate/classify?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-scope-change-rate/frame",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-scope-change-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-scope-change-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "frame",
"semanticId": "https://paloframework.org/semantic/gate/frame?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-scope-change-rate/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-scope-change-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-scope-change-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-sensitive-data-events/control",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-sensitive-data-events",
"semanticId": "https://paloframework.org/semantic/indicator/kri-sensitive-data-events?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-sensitive-data-events/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-sensitive-data-events",
"semanticId": "https://paloframework.org/semantic/indicator/kri-sensitive-data-events?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-sensitive-data-events/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-sensitive-data-events",
"semanticId": "https://paloframework.org/semantic/indicator/kri-sensitive-data-events?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-systemic-risk-finding-rate/assess",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-systemic-risk-finding-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-systemic-risk-finding-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "assess",
"semanticId": "https://paloframework.org/semantic/gate/assess?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-systemic-risk-finding-rate/control",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-systemic-risk-finding-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-systemic-risk-finding-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-systemic-risk-finding-rate/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-systemic-risk-finding-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-systemic-risk-finding-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-systemic-risk-finding-rate/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-systemic-risk-finding-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-systemic-risk-finding-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-tool-call-error-rate/control",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-tool-call-error-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-tool-call-error-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "control",
"semanticId": "https://paloframework.org/semantic/gate/control?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-tool-call-error-rate/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-tool-call-error-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-tool-call-error-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-trained-control-error-rate/measure",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-trained-control-error-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-trained-control-error-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "measure",
"semanticId": "https://paloframework.org/semantic/gate/measure?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-gate/kri-trained-control-error-rate/prove",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-gate",
"source": {
"entityType": "indicator",
"entityId": "kri-trained-control-error-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-trained-control-error-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "gate",
"entityId": "prove",
"semanticId": "https://paloframework.org/semantic/gate/prove?v=3.1.0",
"version": "3.1.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The indicator can inform the named gate but cannot make the gate decision.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-gate: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-accessibility-test-pass-rate/src-wcag-22",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-accessibility-test-pass-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-accessibility-test-pass-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-wcag-22",
"semanticId": "https://paloframework.org/semantic/source/src-wcag-22?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-ai-literacy-competence-rate/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-ai-literacy-competence-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-ai-literacy-competence-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-ai-literacy-competence-rate/src-iso-42001",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-ai-literacy-competence-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-ai-literacy-competence-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42001",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42001?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-aims-audit-completion/src-iso-42001",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-aims-audit-completion",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-aims-audit-completion?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42001",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42001?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-aims-objective-coverage/src-iso-42001",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-aims-objective-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-aims-objective-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42001",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42001?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-annotation-quality-coverage/src-iso-42005",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-annotation-quality-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-annotation-quality-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42005",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42005?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-annotation-quality-coverage/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-annotation-quality-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-annotation-quality-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-appeal-resolution-sla/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-appeal-resolution-sla",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-appeal-resolution-sla?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-appeal-resolution-sla/src-iso-42005",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-appeal-resolution-sla",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-appeal-resolution-sla?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42005",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42005?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-corrective-action-closure/src-iso-42001",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-corrective-action-closure",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-corrective-action-closure?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42001",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42001?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-data-lifecycle-coverage/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-data-lifecycle-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-data-lifecycle-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-data-lifecycle-coverage/src-eu-gdpr",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-data-lifecycle-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-data-lifecycle-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-gdpr",
"semanticId": "https://paloframework.org/semantic/source/src-eu-gdpr?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-data-lifecycle-coverage/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-data-lifecycle-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-data-lifecycle-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-decommissioning-evidence-coverage/src-iso-42001",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-decommissioning-evidence-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-decommissioning-evidence-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42001",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42001?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-decommissioning-evidence-coverage/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-decommissioning-evidence-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-decommissioning-evidence-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-deletion-verification-coverage/src-eu-gdpr",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-deletion-verification-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-deletion-verification-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-gdpr",
"semanticId": "https://paloframework.org/semantic/source/src-eu-gdpr?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-energy-measurement-coverage/src-iso-42001",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-energy-measurement-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-energy-measurement-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42001",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42001?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-energy-measurement-coverage/src-iso-42005",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-energy-measurement-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-energy-measurement-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42005",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42005?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-explanation-comprehension/src-iso-42005",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-explanation-comprehension",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-explanation-comprehension?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42005",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42005?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-explanation-comprehension/src-wcag-22",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-explanation-comprehension",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-explanation-comprehension?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-wcag-22",
"semanticId": "https://paloframework.org/semantic/source/src-wcag-22?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-gpai-obligation-evidence-coverage/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-gpai-obligation-evidence-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-gpai-obligation-evidence-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-gpai-obligation-evidence-coverage/src-eu-gpai-code",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-gpai-obligation-evidence-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-gpai-obligation-evidence-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-gpai-code",
"semanticId": "https://paloframework.org/semantic/source/src-eu-gpai-code?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-incident-triage-time/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-incident-triage-time",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-incident-triage-time?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-machine-readable-marking-coverage/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-machine-readable-marking-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-machine-readable-marking-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-machine-readable-marking-coverage/src-eu-article50-guidelines",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-machine-readable-marking-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-machine-readable-marking-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-article50-guidelines",
"semanticId": "https://paloframework.org/semantic/source/src-eu-article50-guidelines?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-notice-delivery-coverage/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-notice-delivery-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-notice-delivery-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-notice-delivery-coverage/src-eu-article50-guidelines",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-notice-delivery-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-notice-delivery-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-article50-guidelines",
"semanticId": "https://paloframework.org/semantic/source/src-eu-article50-guidelines?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-notice-delivery-coverage/src-wcag-22",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-notice-delivery-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-notice-delivery-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-wcag-22",
"semanticId": "https://paloframework.org/semantic/source/src-wcag-22?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-production-admission-coverage/src-iso-42001",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-production-admission-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-production-admission-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42001",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42001?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-production-admission-coverage/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-production-admission-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-production-admission-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-provenance-coverage/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-provenance-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-provenance-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-regulatory-reporting-clock-compliance/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-regulatory-reporting-clock-compliance",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-regulatory-reporting-clock-compliance?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-review-completion/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-review-completion",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-review-completion?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-review-completion/src-oecd-ai-principles",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-review-completion",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-review-completion?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-oecd-ai-principles",
"semanticId": "https://paloframework.org/semantic/source/src-oecd-ai-principles?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-subgroup-evaluation-coverage/src-iso-42005",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-subgroup-evaluation-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-subgroup-evaluation-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42005",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42005?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-subgroup-evaluation-coverage/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-subgroup-evaluation-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-subgroup-evaluation-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-system-card-coverage/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-system-card-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-system-card-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-system-card-coverage/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-system-card-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-system-card-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kpi-vendor-evidence-coverage/src-iso-42001",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kpi-vendor-evidence-coverage",
"semanticId": "https://paloframework.org/semantic/indicator/kpi-vendor-evidence-coverage?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42001",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42001?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-accessibility-blocker-rate/src-iso-42005",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-accessibility-blocker-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-accessibility-blocker-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42005",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42005?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-accessibility-blocker-rate/src-wcag-22",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-accessibility-blocker-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-accessibility-blocker-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-wcag-22",
"semanticId": "https://paloframework.org/semantic/source/src-wcag-22?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-critical-test-failure-rate/src-nist-genai-profile",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-critical-test-failure-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-critical-test-failure-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-genai-profile",
"semanticId": "https://paloframework.org/semantic/source/src-nist-genai-profile?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-critical-test-failure-rate/src-owasp-llm-top10",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-critical-test-failure-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-critical-test-failure-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-owasp-llm-top10",
"semanticId": "https://paloframework.org/semantic/source/src-owasp-llm-top10?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-environmental-budget-variance/src-iso-42001",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-environmental-budget-variance",
"semanticId": "https://paloframework.org/semantic/indicator/kri-environmental-budget-variance?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42001",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42001?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-environmental-budget-variance/src-iso-42005",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-environmental-budget-variance",
"semanticId": "https://paloframework.org/semantic/indicator/kri-environmental-budget-variance?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42005",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42005?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-execution-bypass-rate/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-execution-bypass-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-execution-bypass-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-execution-bypass-rate/src-owasp-llm-top10",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-execution-bypass-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-execution-bypass-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-owasp-llm-top10",
"semanticId": "https://paloframework.org/semantic/source/src-owasp-llm-top10?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-harmful-representation-rate/src-iso-42005",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-harmful-representation-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-harmful-representation-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42005",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42005?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-harmful-representation-rate/src-nist-genai-profile",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-harmful-representation-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-harmful-representation-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-genai-profile",
"semanticId": "https://paloframework.org/semantic/source/src-nist-genai-profile?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-multi-agent-conflict-rate/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-multi-agent-conflict-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-multi-agent-conflict-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-overdue-remedy-rate/src-iso-42005",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-overdue-remedy-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-overdue-remedy-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42005",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42005?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-override-failure-rate/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-override-failure-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-override-failure-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-override-failure-rate/src-oecd-ai-principles",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-override-failure-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-override-failure-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-oecd-ai-principles",
"semanticId": "https://paloframework.org/semantic/source/src-oecd-ai-principles?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-provenance-verification-failure-rate/src-eu-article50-guidelines",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-provenance-verification-failure-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-provenance-verification-failure-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-article50-guidelines",
"semanticId": "https://paloframework.org/semantic/source/src-eu-article50-guidelines?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-residual-disparity-rate/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-residual-disparity-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-residual-disparity-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-residual-disparity-rate/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-residual-disparity-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-residual-disparity-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-scope-change-rate/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-scope-change-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-scope-change-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-sensitive-data-events/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-sensitive-data-events",
"semanticId": "https://paloframework.org/semantic/indicator/kri-sensitive-data-events?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-sensitive-data-events/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-sensitive-data-events",
"semanticId": "https://paloframework.org/semantic/indicator/kri-sensitive-data-events?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-systemic-risk-finding-rate/src-eu-gpai-code",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-systemic-risk-finding-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-systemic-risk-finding-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-gpai-code",
"semanticId": "https://paloframework.org/semantic/source/src-eu-gpai-code?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-systemic-risk-finding-rate/src-nist-genai-profile",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-systemic-risk-finding-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-systemic-risk-finding-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-genai-profile",
"semanticId": "https://paloframework.org/semantic/source/src-nist-genai-profile?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-tool-call-error-rate/src-nist-ai-rmf",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-tool-call-error-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-tool-call-error-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-nist-ai-rmf",
"semanticId": "https://paloframework.org/semantic/source/src-nist-ai-rmf?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-trained-control-error-rate/src-eu-ai-act",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-trained-control-error-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-trained-control-error-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-eu-ai-act",
"semanticId": "https://paloframework.org/semantic/source/src-eu-ai-act?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
},
{
"mappingId": "https://paloframework.org/semantic/mapping/indicator-to-source/kri-trained-control-error-rate/src-iso-42001",
"mappingVersion": "1.0.0",
"mappingType": "indicator-to-source",
"source": {
"entityType": "indicator",
"entityId": "kri-trained-control-error-rate",
"semanticId": "https://paloframework.org/semantic/indicator/kri-trained-control-error-rate?v=3.1.0",
"version": "3.1.0"
},
"target": {
"entityType": "source",
"entityId": "src-iso-42001",
"semanticId": "https://paloframework.org/semantic/source/src-iso-42001?v=1.0.0",
"version": "1.0.0"
},
"coverageType": "supporting",
"conditions": [],
"rationale": "The source informs the indicator definition; the published threshold remains illustrative.",
"basis": "Declared relationship in data/kpi-kri-registry.json; no legal-equivalence or compliance claim is created.",
"approval": {
"status": "approved",
"scope": "PALO framework publication only; not a legal applicability or certification decision.",
"decidedAt": "2026-08-23T08:00:00Z",
"decidedBy": "PALO framework release process"
},
"validFrom": "2026-08-23T00:00:00Z",
"provenance": {
"generatedFrom": "data/kpi-kri-registry.json",
"generationRule": "indicator-to-source: one immutable source-target pair per declared ID reference."
}
}
]Fourteen declared invariants (14)
Source: data/semantic-invariants.json · Download full registry
[
{
"invariantId": "SEM-01",
"statement": "Every semantic entity has exactly one stable identifier.",
"enforcedBy": [
"SHACL",
"JSON Schema"
]
},
{
"invariantId": "SEM-02",
"statement": "Every canonical definition has exactly one semantic version.",
"enforcedBy": [
"SHACL",
"generator"
]
},
{
"invariantId": "SEM-03",
"statement": "Released definitions are superseded, never overwritten.",
"enforcedBy": [
"release validation",
"documentation"
]
},
{
"invariantId": "SEM-04",
"statement": "Lifecycle definitions, phase definitions and gate definitions are distinct from runtime instances.",
"enforcedBy": [
"OWL",
"JSON Schema"
]
},
{
"invariantId": "SEM-05",
"statement": "Every gate instance references exactly one versioned gate definition and one case.",
"enforcedBy": [
"SHACL",
"JSON Schema"
]
},
{
"invariantId": "SEM-06",
"statement": "Every consequential gate decision is append-only, digest-bound and attributable.",
"enforcedBy": [
"SHACL",
"JSON Schema"
]
},
{
"invariantId": "SEM-07",
"statement": "An evidence claim references exactly one artifact, one target and one case scope.",
"enforcedBy": [
"SHACL",
"JSON Schema"
]
},
{
"invariantId": "SEM-08",
"statement": "Evidence evaluation is separate from evidence assertion.",
"enforcedBy": [
"OWL",
"SHACL"
]
},
{
"invariantId": "SEM-09",
"statement": "Evidence bundles are manifests of digest-bound records, not duplicate evidence stores.",
"enforcedBy": [
"SHACL",
"JSON Schema"
]
},
{
"invariantId": "SEM-10",
"statement": "Each cross-framework mapping represents one source version and one target version.",
"enforcedBy": [
"SHACL",
"JSON Schema"
]
},
{
"invariantId": "SEM-11",
"statement": "Every assessment and evidence manifest is pinned to an immutable semantic release manifest.",
"enforcedBy": [
"SHACL",
"release validation"
]
},
{
"invariantId": "SEM-12",
"statement": "Delivery status and evidence authority class remain separate properties.",
"enforcedBy": [
"semantic spine schema",
"browser tests"
]
},
{
"invariantId": "SEM-13",
"statement": "Framework guidance does not create legal obligations or deployment authorization.",
"enforcedBy": [
"authority boundary",
"documentation"
]
},
{
"invariantId": "SEM-14",
"statement": "Non-authoritative monitoring signals require accountable human review before changing case state.",
"enforcedBy": [
"semantic spine schema",
"module contract"
]
}
]Draft stack entity types (25)
Source: data/stack-governance-model.json · Download full registry
[
{
"id": "Layer",
"semanticId": "https://paloframework.org/semantic/Layer",
"origin": "stack-extension-0.1"
},
{
"id": "Capability",
"semanticId": "https://paloframework.org/semantic/Capability",
"origin": "stack-extension-0.1"
},
{
"id": "GovernancePlane",
"semanticId": "https://paloframework.org/semantic/GovernancePlane",
"origin": "stack-extension-0.1"
},
{
"id": "ComponentVersion",
"semanticId": "https://paloframework.org/semantic/ComponentVersion",
"origin": "stack-extension-0.1"
},
{
"id": "AISystemVersion",
"semanticId": "https://paloframework.org/semantic/AISystemVersion",
"origin": "stack-extension-0.1"
},
{
"id": "Agent",
"semanticId": "https://paloframework.org/semantic/Agent",
"origin": "stack-extension-0.1"
},
{
"id": "ModelVersion",
"semanticId": "https://paloframework.org/semantic/ModelVersion",
"origin": "stack-extension-0.1"
},
{
"id": "Tool",
"semanticId": "https://paloframework.org/semantic/Tool",
"origin": "stack-extension-0.1"
},
{
"id": "DataAsset",
"semanticId": "https://paloframework.org/semantic/DataAsset",
"origin": "stack-extension-0.1"
},
{
"id": "Provider",
"semanticId": "https://paloframework.org/semantic/Provider",
"origin": "stack-extension-0.1"
},
{
"id": "Service",
"semanticId": "https://paloframework.org/semantic/Service",
"origin": "stack-extension-0.1"
},
{
"id": "PublicPolicy",
"semanticId": "https://paloframework.org/semantic/PublicPolicy",
"origin": "stack-extension-0.1"
},
{
"id": "PolicyVersion",
"semanticId": "https://paloframework.org/semantic/PolicyVersion",
"origin": "stack-extension-0.1"
},
{
"id": "ChangeSignal",
"semanticId": "https://paloframework.org/semantic/ChangeSignal",
"origin": "stack-extension-0.1"
},
{
"id": "GovernanceCase",
"semanticId": "https://paloframework.org/semantic/GovernanceCase",
"origin": "palo-3.1"
},
{
"id": "ApplicabilityAssessment",
"semanticId": "https://paloframework.org/semantic/ApplicabilityAssessment",
"origin": "stack-extension-0.1"
},
{
"id": "RequirementVersion",
"semanticId": "https://paloframework.org/semantic/RequirementVersion",
"origin": "stack-extension-0.1"
},
{
"id": "ControlDefinition",
"semanticId": "https://paloframework.org/semantic/ControlDefinition",
"origin": "stack-extension-0.1"
},
{
"id": "ControlImplementation",
"semanticId": "https://paloframework.org/semantic/ControlImplementation",
"origin": "palo-3.1"
},
{
"id": "EvidenceArtifact",
"semanticId": "https://paloframework.org/semantic/EvidenceArtifact",
"origin": "palo-3.1"
},
{
"id": "EvidenceClaim",
"semanticId": "https://paloframework.org/semantic/EvidenceClaim",
"origin": "palo-3.1"
},
{
"id": "EvidenceEvaluation",
"semanticId": "https://paloframework.org/semantic/EvidenceEvaluation",
"origin": "palo-3.1"
},
{
"id": "GateInstance",
"semanticId": "https://paloframework.org/semantic/GateInstance",
"origin": "palo-3.1"
},
{
"id": "GateDecisionRecord",
"semanticId": "https://paloframework.org/semantic/GateDecisionRecord",
"origin": "palo-3.1"
},
{
"id": "Actor",
"semanticId": "https://paloframework.org/semantic/Actor",
"origin": "stack-extension-0.1"
}
]Draft stack relationship types (31)
Source: data/stack-governance-model.json · Download full registry
[
{
"id": "PROVIDES_CAPABILITY",
"sourceTypes": [
"ComponentVersion",
"GovernancePlane"
],
"targetTypes": [
"Capability"
],
"meaning": "Provides capability within the recorded source, time and case scope."
},
{
"id": "BELONGS_TO_LAYER",
"sourceTypes": [
"Capability"
],
"targetTypes": [
"Layer"
],
"meaning": "Belongs to layer within the recorded source, time and case scope."
},
{
"id": "GOVERNS_LAYER",
"sourceTypes": [
"GovernancePlane"
],
"targetTypes": [
"Layer"
],
"meaning": "Governs layer within the recorded source, time and case scope."
},
{
"id": "INFORMS",
"sourceTypes": [
"ComponentVersion"
],
"targetTypes": [
"GovernancePlane"
],
"meaning": "Informs within the recorded source, time and case scope."
},
{
"id": "OFFERS",
"sourceTypes": [
"Provider"
],
"targetTypes": [
"Service"
],
"meaning": "Offers within the recorded source, time and case scope."
},
{
"id": "USES_SERVICE",
"sourceTypes": [
"AISystemVersion",
"Agent",
"ComponentVersion",
"Tool",
"ModelVersion"
],
"targetTypes": [
"Service"
],
"meaning": "Uses service within the recorded source, time and case scope."
},
{
"id": "DEPENDS_ON",
"sourceTypes": [
"AISystemVersion",
"Agent",
"ComponentVersion",
"Tool",
"ModelVersion"
],
"targetTypes": [
"AISystemVersion",
"Agent",
"ComponentVersion",
"Tool",
"ModelVersion",
"Service",
"DataAsset"
],
"meaning": "Depends on within the recorded source, time and case scope."
},
{
"id": "USES_MODEL",
"sourceTypes": [
"AISystemVersion",
"Agent"
],
"targetTypes": [
"ModelVersion"
],
"meaning": "Uses model within the recorded source, time and case scope."
},
{
"id": "CALLS_TOOL",
"sourceTypes": [
"AISystemVersion",
"Agent"
],
"targetTypes": [
"Tool"
],
"meaning": "Calls tool within the recorded source, time and case scope."
},
{
"id": "READS",
"sourceTypes": [
"AISystemVersion",
"Agent",
"Tool"
],
"targetTypes": [
"DataAsset"
],
"meaning": "Reads within the recorded source, time and case scope."
},
{
"id": "HAS_VERSION",
"sourceTypes": [
"PublicPolicy"
],
"targetTypes": [
"PolicyVersion"
],
"meaning": "Has version within the recorded source, time and case scope."
},
{
"id": "FROM_VERSION",
"sourceTypes": [
"ChangeSignal"
],
"targetTypes": [
"PolicyVersion"
],
"meaning": "From version within the recorded source, time and case scope.",
"maxPerSource": 1
},
{
"id": "TO_VERSION",
"sourceTypes": [
"ChangeSignal"
],
"targetTypes": [
"PolicyVersion"
],
"meaning": "To version within the recorded source, time and case scope.",
"maxPerSource": 1,
"minPerSource": 1
},
{
"id": "AFFECTS_SERVICE",
"sourceTypes": [
"ChangeSignal"
],
"targetTypes": [
"Service"
],
"meaning": "Affects service within the recorded source, time and case scope."
},
{
"id": "GOVERNS_VERSION",
"sourceTypes": [
"GovernanceCase"
],
"targetTypes": [
"AISystemVersion"
],
"meaning": "Governs version within the recorded source, time and case scope."
},
{
"id": "ASSESSES_SIGNAL",
"sourceTypes": [
"ApplicabilityAssessment"
],
"targetTypes": [
"ChangeSignal"
],
"meaning": "Assesses signal within the recorded source, time and case scope.",
"maxPerSource": 1,
"minPerSource": 1
},
{
"id": "ASSESSES_SYSTEM",
"sourceTypes": [
"ApplicabilityAssessment"
],
"targetTypes": [
"AISystemVersion"
],
"meaning": "Assesses system within the recorded source, time and case scope.",
"maxPerSource": 1,
"minPerSource": 1
},
{
"id": "IN_CASE",
"sourceTypes": [
"ApplicabilityAssessment",
"GateInstance",
"ControlImplementation"
],
"targetTypes": [
"GovernanceCase"
],
"meaning": "In case within the recorded source, time and case scope.",
"maxPerSource": 1,
"minPerSource": 1
},
{
"id": "CONSIDERS_REQUIREMENT",
"sourceTypes": [
"ApplicabilityAssessment"
],
"targetTypes": [
"RequirementVersion"
],
"meaning": "Considers requirement within the recorded source, time and case scope."
},
{
"id": "REVIEWED_BY",
"sourceTypes": [
"ApplicabilityAssessment"
],
"targetTypes": [
"Actor"
],
"meaning": "Reviewed by within the recorded source, time and case scope.",
"maxPerSource": 1
},
{
"id": "IMPLEMENTS",
"sourceTypes": [
"ControlImplementation"
],
"targetTypes": [
"ControlDefinition"
],
"meaning": "Implements within the recorded source, time and case scope.",
"maxPerSource": 1,
"minPerSource": 1
},
{
"id": "ADDRESSES_REQUIREMENT",
"sourceTypes": [
"ControlDefinition"
],
"targetTypes": [
"RequirementVersion"
],
"meaning": "Addresses requirement within the recorded source, time and case scope."
},
{
"id": "APPLIES_TO_SYSTEM",
"sourceTypes": [
"ControlImplementation"
],
"targetTypes": [
"AISystemVersion"
],
"meaning": "Applies to system within the recorded source, time and case scope.",
"minPerSource": 1
},
{
"id": "USES_ARTIFACT",
"sourceTypes": [
"EvidenceClaim"
],
"targetTypes": [
"EvidenceArtifact"
],
"meaning": "Uses artifact within the recorded source, time and case scope.",
"maxPerSource": 1,
"minPerSource": 1
},
{
"id": "SUPPORTS_TARGET",
"sourceTypes": [
"EvidenceClaim"
],
"targetTypes": [
"ControlImplementation",
"ApplicabilityAssessment"
],
"meaning": "Supports target within the recorded source, time and case scope.",
"maxPerSource": 1,
"minPerSource": 1
},
{
"id": "EVALUATES_CLAIM",
"sourceTypes": [
"EvidenceEvaluation"
],
"targetTypes": [
"EvidenceClaim"
],
"meaning": "Evaluates claim within the recorded source, time and case scope.",
"maxPerSource": 1,
"minPerSource": 1
},
{
"id": "REVIEWS_SYSTEM",
"sourceTypes": [
"GateInstance"
],
"targetTypes": [
"AISystemVersion"
],
"meaning": "Reviews system within the recorded source, time and case scope.",
"minPerSource": 1
},
{
"id": "DECISION_FOR_GATE",
"sourceTypes": [
"GateDecisionRecord"
],
"targetTypes": [
"GateInstance"
],
"meaning": "Decision for gate within the recorded source, time and case scope.",
"maxPerSource": 1,
"minPerSource": 1
},
{
"id": "DECIDED_BY",
"sourceTypes": [
"GateDecisionRecord"
],
"targetTypes": [
"Actor"
],
"meaning": "Decided by within the recorded source, time and case scope.",
"maxPerSource": 1,
"minPerSource": 1
},
{
"id": "BASED_ON_ASSESSMENT",
"sourceTypes": [
"GateDecisionRecord"
],
"targetTypes": [
"ApplicabilityAssessment"
],
"meaning": "Based on assessment within the recorded source, time and case scope."
},
{
"id": "SUPERSEDES",
"sourceTypes": [
"GateDecisionRecord"
],
"targetTypes": [
"GateDecisionRecord"
],
"meaning": "Supersedes within the recorded source, time and case scope.",
"maxPerSource": 1
}
]RDF classes properties and shapes
palo-ontology-v3.shacl.ttl
231 triples. Exact declarations follow; absence of a domain/range is preserved.
| Shape | Target | Property constraints |
|---|---|---|
| palo:SemanticEntityShape | palo:SemanticEntity | 1 |
| palo:CanonicalDefinitionShape | palo:CanonicalDefinition | 1 |
| palo:ImmutableRecordShape | palo:ImmutableRecord | 3 |
| palo:LifecycleDefinitionShape | palo:LifecycleDefinition | 2 |
| palo:GateInstanceShape | palo:GateInstance | 3 |
| palo:GateDecisionRecordShape | palo:GateDecisionRecord | 5 |
| palo:EvidenceArtifactShape | palo:EvidenceArtifact | 2 |
| palo:EvidenceClaimShape | palo:EvidenceClaim | 5 |
| palo:EvidenceEvaluationShape | palo:EvidenceEvaluation | 2 |
| palo:EvidenceBundleManifestShape | palo:EvidenceBundleManifest | 3 |
| palo:MappingRecordShape | palo:MappingRecord | 5 |
| palo:SemanticReleaseManifestShape | palo:SemanticReleaseManifest | 2 |
palo-ontology-v3.ttl
163 triples. Exact declarations follow; absence of a domain/range is preserved.
| Term | Superclass | Domain | Range |
|---|---|---|---|
| palo:AssessmentRun | palo:ImmutableRecord | ||
| palo:AuthorityClass | palo:CanonicalDefinition | ||
| palo:CanonicalDefinition | palo:SemanticEntity | ||
| palo:ControlImplementation | palo:RuntimeRecord | ||
| palo:DecisionRecord | palo:ImmutableRecord | ||
| palo:EnforcementAdapterDefinition | palo:CanonicalDefinition | ||
| palo:EvidenceArtifact | palo:RuntimeRecord | ||
| palo:EvidenceBundleItem | palo:ImmutableRecord | ||
| palo:EvidenceBundleManifest | palo:ImmutableRecord | ||
| palo:EvidenceClaim | palo:ImmutableRecord | ||
| palo:EvidenceEvaluation | palo:ImmutableRecord | ||
| palo:GateDecisionRecord | palo:DecisionRecord | ||
| palo:GateDefinition | palo:CanonicalDefinition | ||
| palo:GateInstance | palo:RuntimeRecord | ||
| palo:GovernanceCase | palo:RuntimeRecord | ||
| palo:GovernanceFrameworkDefinition | palo:CanonicalDefinition | ||
| palo:ImmutableRecord | palo:SemanticEntity | ||
| palo:LifecycleDefinition | palo:CanonicalDefinition | ||
| palo:MappingRecord | palo:ImmutableRecord | ||
| palo:MetricObservation | palo:ImmutableRecord | ||
| palo:PhaseDefinition | palo:CanonicalDefinition | ||
| palo:RegimeDefinition | palo:CanonicalDefinition | ||
| palo:RuntimeRecord | palo:SemanticEntity | ||
| palo:SemanticEntity | |||
| palo:SemanticReleaseItem | palo:ImmutableRecord | ||
| palo:SemanticReleaseManifest | palo:ImmutableRecord | ||
| palo:WorkspaceDefinition | palo:CanonicalDefinition |
| Term | Superclass | Domain | Range |
|---|---|---|---|
| palo:bundleItemReferences | palo:EvidenceBundleItem | palo:ImmutableRecord | |
| palo:claimScope | palo:EvidenceClaim | palo:GovernanceCase | |
| palo:containsBundleItem | palo:EvidenceBundleManifest | palo:EvidenceBundleItem | |
| palo:containsReleaseItem | palo:SemanticReleaseManifest | palo:SemanticReleaseItem | |
| palo:decisionActor | palo:DecisionRecord | ||
| palo:decisionForGate | palo:GateDecisionRecord | palo:GateInstance | |
| palo:evaluatesClaim | palo:EvidenceEvaluation | palo:EvidenceClaim | |
| palo:gateInstanceCase | palo:GateInstance | palo:GovernanceCase | |
| palo:hasGateDefinition | palo:LifecycleDefinition | palo:GateDefinition | |
| palo:hasPhaseDefinition | palo:LifecycleDefinition | palo:PhaseDefinition | |
| palo:instantiatesGate | palo:GateInstance | palo:GateDefinition | |
| palo:mapsSourceVersion | palo:MappingRecord | palo:CanonicalDefinition | |
| palo:mapsTargetVersion | palo:MappingRecord | palo:CanonicalDefinition | |
| palo:pinnedToReleaseManifest | palo:SemanticReleaseManifest | ||
| palo:releaseItemReferences | palo:SemanticReleaseItem | palo:CanonicalDefinition | |
| palo:supersedes | palo:ImmutableRecord | palo:ImmutableRecord | |
| palo:supportsTarget | palo:EvidenceClaim | palo:SemanticEntity | |
| palo:usesArtifact | palo:EvidenceClaim | palo:EvidenceArtifact |
| Term | Superclass | Domain | Range |
|---|---|---|---|
| palo:appendOnly | palo:ImmutableRecord | http://www.w3.org/2001/XMLSchema#boolean | |
| palo:approvalStatus | palo:MappingRecord | http://www.w3.org/2001/XMLSchema#string | |
| palo:authorityBasis | palo:DecisionRecord | http://www.w3.org/2001/XMLSchema#string | |
| palo:bundleDigest | palo:EvidenceBundleManifest | http://www.w3.org/2001/XMLSchema#string | |
| palo:caseId | http://www.w3.org/2001/XMLSchema#string | ||
| palo:claimStatement | palo:EvidenceClaim | http://www.w3.org/2001/XMLSchema#string | |
| palo:contentDigest | http://www.w3.org/2001/XMLSchema#string | ||
| palo:coverageType | palo:MappingRecord | http://www.w3.org/2001/XMLSchema#string | |
| palo:definitionVersion | palo:CanonicalDefinition | http://www.w3.org/2001/XMLSchema#string | |
| palo:evaluationOutcome | palo:EvidenceEvaluation | http://www.w3.org/2001/XMLSchema#string | |
| palo:inputSnapshotHash | palo:DecisionRecord | http://www.w3.org/2001/XMLSchema#string | |
| palo:integrityReference | palo:EvidenceClaim | http://www.w3.org/2001/XMLSchema#string | |
| palo:manifestDigest | palo:SemanticReleaseManifest | http://www.w3.org/2001/XMLSchema#string | |
| palo:ordinal | palo:PhaseDefinition | http://www.w3.org/2001/XMLSchema#integer | |
| palo:rationale | http://www.w3.org/2001/XMLSchema#string | ||
| palo:recordDigest | palo:ImmutableRecord | http://www.w3.org/2001/XMLSchema#string | |
| palo:recordedAt | palo:ImmutableRecord | http://www.w3.org/2001/XMLSchema#dateTime | |
| palo:stableId | palo:SemanticEntity | http://www.w3.org/2001/XMLSchema#string |
palo-stack-governance.shacl.ttl
58 triples. Exact declarations follow; absence of a domain/range is preserved.
| Shape | Target | Property constraints |
|---|---|---|
| palo:StackPolicyVersionShape | palo:PolicyVersion | 1 |
| palo:StackSignalShape | palo:ChangeSignal | 2 |
| palo:StackApplicabilityShape | palo:ApplicabilityAssessment | 5 |
| palo:StackRequirementShape | palo:RequirementVersion | 1 |
palo-stack-governance.ttl
90 triples. Exact declarations follow; absence of a domain/range is preserved.
| Term | Superclass | Domain | Range |
|---|---|---|---|
| palo:AISystemVersion | palo:SemanticEntity | ||
| palo:Actor | palo:SemanticEntity | ||
| palo:Agent | palo:SemanticEntity | ||
| palo:ApplicabilityAssessment | palo:SemanticEntity | ||
| palo:Capability | palo:SemanticEntity | ||
| palo:ChangeSignal | palo:SemanticEntity | ||
| palo:ComponentVersion | palo:SemanticEntity | ||
| palo:ControlDefinition | palo:SemanticEntity | ||
| palo:DataAsset | palo:SemanticEntity | ||
| palo:GovernancePlane | palo:SemanticEntity | ||
| palo:Layer | palo:SemanticEntity | ||
| palo:ModelVersion | palo:SemanticEntity | ||
| palo:PolicyVersion | palo:SemanticEntity | ||
| palo:Provider | palo:SemanticEntity | ||
| palo:PublicPolicy | palo:SemanticEntity | ||
| palo:RequirementVersion | palo:SemanticEntity | ||
| palo:Service | palo:SemanticEntity | ||
| palo:Tool | palo:SemanticEntity |
| Term | Superclass | Domain | Range |
|---|---|---|---|
| palo:addressesRequirement | |||
| palo:affectsService | |||
| palo:appliesToSystem | |||
| palo:assessesSignal | |||
| palo:assessesSystem | |||
| palo:basedOnAssessment | |||
| palo:belongsToLayer | |||
| palo:callsTool | |||
| palo:considersRequirement | |||
| palo:dependsOn | |||
| palo:fromVersion | |||
| palo:governsLayer | |||
| palo:governsVersion | |||
| palo:hasVersion | |||
| palo:implements | |||
| palo:inCase | |||
| palo:informs | |||
| palo:offers | |||
| palo:providesCapability | |||
| palo:reads | |||
| palo:reviewedBy | |||
| palo:reviewsSystem | |||
| palo:toVersion | |||
| palo:usesModel | |||
| palo:usesService |
Field and controlled value dictionary
65 schemas shown
PALO Affected-Person Notice, Appeal and Remedy Case
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","caseId","systemCaseId","systemVersion","notice","intake","review","outcome","remedy","privacyBoundary","audit"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-affected-person-case"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.caseId | true | string | {"minLength":1} | |
| $.systemCaseId | true | string | {"minLength":1} | |
| $.systemVersion | true | string | {"minLength":1} | |
| $.notice | true | object | {"required":["noticeId","deliveredAt","channel","accessibleFormats","aiRole","significance","humanContact","appealRoute"],"additionalProperties":false} | |
| $.notice.noticeId | true | string | {} | |
| $.notice.deliveredAt | true | string | {"format":"date-time"} | |
| $.notice.channel | true | string | {} | |
| $.notice.accessibleFormats | true | array | {"minItems":1,"uniqueItems":true} | |
| $.notice.accessibleFormats[] | false | string | {} | |
| $.notice.aiRole | true | string | {"minLength":10} | |
| $.notice.significance | true | string | {"minLength":10} | |
| $.notice.humanContact | true | string | {"minLength":3} | |
| $.notice.appealRoute | true | string | {"minLength":3} | |
| $.intake | true | object | {"required":["receivedAt","acknowledgedAt","requestType","urgency","deadlineAt"],"additionalProperties":false} | |
| $.intake.receivedAt | true | string | {"format":"date-time"} | |
| $.intake.acknowledgedAt | true | string | {"format":"date-time"} | |
| $.intake.requestType | true | {"enum":["explanation","correction","appeal","human-review","remedy","other"]} | ||
| $.intake.urgency | true | {"enum":["standard","urgent","immediate-harm"]} | ||
| $.intake.deadlineAt | true | string | {"format":"date-time"} | |
| $.review | true | object | {"required":["reviewerId","reviewerRole","independentFromOriginalDecision","conflictCheck","evidenceReviewed","completedAt"],"additionalProperties":false} | |
| $.review.reviewerId | true | string | {} | |
| $.review.reviewerRole | true | string | {} | |
| $.review.independentFromOriginalDecision | true | {"const":true} | ||
| $.review.conflictCheck | true | string | {"minLength":10} | |
| $.review.evidenceReviewed | true | array | {"minItems":1} | |
| $.review.evidenceReviewed[] | false | string | {} | |
| $.review.completedAt | true | string | {"format":"date-time"} | |
| $.outcome | true | object | {"required":["decision","reasons","communicatedAt"],"additionalProperties":false} | |
| $.outcome.decision | true | {"enum":["upheld","varied","overturned","withdrawn","inconclusive"]} | ||
| $.outcome.reasons | true | string | {"minLength":20} | |
| $.outcome.communicatedAt | true | string | {"format":"date-time"} | |
| $.remedy | true | object | {"required":["required","actions","owner","dueAt","status","verified"],"additionalProperties":false} | |
| $.remedy.required | true | boolean | {} | |
| $.remedy.actions | true | array | {} | |
| $.remedy.actions[] | false | string | {} | |
| $.remedy.owner | true | string | {} | |
| $.remedy.dueAt | true | string | {"format":"date-time"} | |
| $.remedy.status | true | {"enum":["not-required","planned","in-progress","completed","overdue"]} | ||
| $.remedy.verified | true | boolean | {} | |
| $.privacyBoundary | true | string | {"minLength":20} | |
| $.audit | true | object | {"required":["createdAt","updatedAt","recordDigest"],"additionalProperties":false} | |
| $.audit.createdAt | true | string | {"format":"date-time"} | |
| $.audit.updatedAt | true | string | {"format":"date-time"} | |
| $.audit.recordDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} |
PALO Agentic Action Claim
Developer-preview interoperability contract for a proposed agent action. Schema validity is not authorization, safety evidence, legal approval, or proof of execution.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","claimId","agentId","caseId","action","requestedScopes","externalNetwork","delegation","requestedAt","expiresAt","nonce","idempotencyKey","sequenceNumber"],"additionalProperties":false} | Developer-preview interoperability contract for a proposed agent action. Schema validity is not authorization, safety evidence, legal approval, or proof of execution. |
| $.format | true | {"const":"palo-agentic-action-claim"} | ||
| $.schemaVersion | true | {"enum":["1.1.0","1.2.0","1.3.0","1.4.0"]} | ||
| $.claimId | true | string | {"pattern":"^claim-[a-f0-9-]{36}$"} | |
| $.agentId | true | string | {"pattern":"^agent-[a-zA-Z0-9][a-zA-Z0-9-]{5,63}$"} | |
| $.caseId | true | string | {"minLength":1,"maxLength":128} | |
| $.action | true | object | {"required":["tool","operation","resource","path","networkIntent","arguments","argumentsDigest","argumentSchemaDigest"],"additionalProperties":false} | |
| $.action.tool | true | string | {"minLength":1,"maxLength":200} | |
| $.action.operation | true | {"enum":["read","create","update","delete","execute","delegate"]} | ||
| $.action.resource | true | string | {"minLength":1,"maxLength":1000} | |
| $.action.path | true | string | {"minLength":1,"maxLength":1000,"pattern":"^/"} | |
| $.action.networkIntent | true | {"enum":["none","read","write","bidirectional"]} | ||
| $.action.networkHost | false | string | {"minLength":1,"maxLength":253,"pattern":"^[a-z0-9.-]+$"} | |
| $.action.arguments | true | object | {"maxProperties":100,"additionalProperties":true} | |
| $.action.argumentsDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.action.argumentSchemaDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.requestedScopes | true | object | {"required":["read","write"],"additionalProperties":false} | |
| $.requestedScopes.read | true | array | {"uniqueItems":true} | |
| $.requestedScopes.read[] | false | string | {"minLength":1} | |
| $.requestedScopes.write | true | array | {"uniqueItems":true} | |
| $.requestedScopes.write[] | false | string | {"minLength":1} | |
| $.externalNetwork | true | boolean | {} | |
| $.delegation | true | object | {"required":["depth","subagentCount"],"additionalProperties":false} | |
| $.delegation.depth | true | integer | {"minimum":0} | |
| $.delegation.subagentCount | true | integer | {"minimum":0} | |
| $.delegation.parentAgentId | false | string | {"pattern":"^agent-[a-zA-Z0-9][a-zA-Z0-9-]{5,63}$"} | |
| $.delegation.requestedSubagentRole | false | string | {"minLength":1} | |
| $.authorityContext | false | object | {"required":["authorityContextId","humanPrincipal","workloadIdentity","agentIdentity","delegationChain"],"additionalProperties":false} | |
| $.authorityContext.authorityContextId | true | string | {"pattern":"^authority-[a-f0-9-]{36}$"} | |
| $.authorityContext.humanPrincipal | true | object | {"required":["subject","issuer","authenticatedAt","credentialDigest"],"additionalProperties":false} | |
| $.authorityContext.humanPrincipal.subject | true | string | {"minLength":1,"maxLength":512} | |
| $.authorityContext.humanPrincipal.issuer | true | string | {"format":"uri","maxLength":1000} | |
| $.authorityContext.humanPrincipal.authenticatedAt | true | string | {"format":"date-time"} | |
| $.authorityContext.humanPrincipal.credentialDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.authorityContext.humanPrincipal.proofReference | false | string | {"format":"uri","maxLength":2000} | |
| $.authorityContext.workloadIdentity | true | object | {"required":["subject","issuer","audience","proofType","credentialDigest"],"additionalProperties":false} | |
| $.authorityContext.workloadIdentity.subject | true | string | {"minLength":1,"maxLength":1000} | |
| $.authorityContext.workloadIdentity.issuer | true | string | {"format":"uri","maxLength":1000} | |
| $.authorityContext.workloadIdentity.audience | true | string | {"minLength":1,"maxLength":1000} | |
| $.authorityContext.workloadIdentity.proofType | true | {"enum":["mtls","dpop","http-message-signature","spiffe-svid"]} | ||
| $.authorityContext.workloadIdentity.credentialDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.authorityContext.workloadIdentity.proofReference | false | string | {"format":"uri","maxLength":2000} | |
| $.authorityContext.agentIdentity | true | object | {"required":["agentId","instanceId"],"additionalProperties":false} | |
| $.authorityContext.agentIdentity.agentId | true | string | {"pattern":"^agent-[a-zA-Z0-9][a-zA-Z0-9-]{5,63}$"} | |
| $.authorityContext.agentIdentity.instanceId | true | string | {"minLength":1,"maxLength":256} | |
| $.authorityContext.tenantId | false | string | {"minLength":1,"maxLength":128} | |
| $.authorityContext.delegationChain | true | array | {"maxItems":16} | |
| $.authorityContext.delegationChain[] | false | object | {"required":["delegationId","from","to","scopes","issuedAt","expiresAt"],"additionalProperties":false} | |
| $.authorityContext.delegationChain[].delegationId | true | string | {"pattern":"^delegation-[a-f0-9-]{36}$"} | |
| $.authorityContext.delegationChain[].from | true | string | {"minLength":1,"maxLength":1000} | |
| $.authorityContext.delegationChain[].to | true | string | {"minLength":1,"maxLength":1000} | |
| $.authorityContext.delegationChain[].scopes | true | object | {"required":["read","write"],"additionalProperties":false} | |
| $.authorityContext.delegationChain[].scopes.read | true | array | {"uniqueItems":true} | |
| $.authorityContext.delegationChain[].scopes.read[] | false | string | {"minLength":1} | |
| $.authorityContext.delegationChain[].scopes.write | true | array | {"uniqueItems":true} | |
| $.authorityContext.delegationChain[].scopes.write[] | false | string | {"minLength":1} | |
| $.authorityContext.delegationChain[].issuedAt | true | string | {"format":"date-time"} | |
| $.authorityContext.delegationChain[].expiresAt | true | string | {"format":"date-time"} | |
| $.requestedAt | true | string | {"format":"date-time"} | |
| $.expiresAt | true | string | {"format":"date-time"} | |
| $.nonce | true | string | {"pattern":"^[a-zA-Z0-9_-]{16,128}$"} | |
| $.idempotencyKey | true | string | {"pattern":"^[a-zA-Z0-9._:-]{16,200}$"} | |
| $.sequenceNumber | true | integer | {"minimum":1,"maximum":9007199254740991} | |
| $.effectContract | false | / palo-agentic-effect-contract.schema.json | {} | |
| $.dataGovernance | false | object | {"required":["subject","purpose","fitnessDecisionId","fitnessDecisionDigest","disclosureContractId","disclosureContractDigest"],"additionalProperties":false} | |
| $.dataGovernance.subject | true | object | {"required":["type","id"],"additionalProperties":false} | |
| $.dataGovernance.subject.type | true | {"enum":["dataset","data-product","model","ai-system","agent","tool","access-entitlement","other"]} | ||
| $.dataGovernance.subject.id | true | string | {"minLength":1,"maxLength":1000} | |
| $.dataGovernance.purpose | true | string | {"minLength":1,"maxLength":300} | |
| $.dataGovernance.fitnessDecisionId | true | string | {"pattern":"^fitness-decision-[a-f0-9-]{36}$"} | |
| $.dataGovernance.fitnessDecisionDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.dataGovernance.disclosureContractId | true | string | {"pattern":"^disclosure-[a-f0-9-]{36}$"} | |
| $.dataGovernance.disclosureContractDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.metadata | false | object | {"additionalProperties":true} | |
| $.allOf[0] | false | {} | ||
| $.allOf[0].if | false | {"required":["schemaVersion"]} | ||
| $.allOf[0].if.schemaVersion | true | {"enum":["1.1.0","1.2.0"]} | ||
| $.allOf[0].then | false | {} | ||
| $.allOf[1] | false | {} | ||
| $.allOf[1].if | false | {"required":["schemaVersion"]} | ||
| $.allOf[1].if.schemaVersion | true | {"const":"1.2.0"} | ||
| $.allOf[1].then | false | {"required":["effectContract"]} | ||
| $.allOf[1].then.effectContract | true | / palo-agentic-effect-contract.schema.json | {} | |
| $.allOf[2] | false | {} | ||
| $.allOf[2].if | false | {"required":["schemaVersion"]} | ||
| $.allOf[2].if.schemaVersion | true | {"const":"1.3.0"} | ||
| $.allOf[2].then | false | {"required":["effectContract","authorityContext"]} | ||
| $.allOf[2].then.effectContract | true | / palo-agentic-effect-contract.schema.json | {} | |
| $.allOf[2].then.authorityContext | true | object | {} | |
| $.allOf[3] | false | {} | ||
| $.allOf[3].if | false | {"required":["schemaVersion"]} | ||
| $.allOf[3].if.schemaVersion | true | {"const":"1.4.0"} | ||
| $.allOf[3].then | false | {"required":["effectContract","authorityContext","dataGovernance"]} | ||
| $.allOf[3].then.effectContract | true | / palo-agentic-effect-contract.schema.json | {} | |
| $.allOf[3].then.authorityContext | true | object | {} | |
| $.allOf[3].then.dataGovernance | true | object | {} |
PALO Human Approval
Developer-preview approval-state contract. The reference clients do not yet provide production reviewer identity, device attestation or all context required for a consequential human decision.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","approvalId","claimId","claimDigest","caseId","agentId","status","requestedBy","requestedAt","expiresAt"],"additionalProperties":false} | Developer-preview approval-state contract. The reference clients do not yet provide production reviewer identity, device attestation or all context required for a consequential human decision. |
| $.format | true | {"const":"palo-agentic-approval"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.approvalId | true | string | {"pattern":"^approval-[a-f0-9-]{36}$"} | |
| $.claimId | true | string | {"pattern":"^claim-[a-f0-9-]{36}$"} | |
| $.claimDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.caseId | true | string | {"minLength":1,"maxLength":128} | |
| $.agentId | true | string | {"pattern":"^agent-[a-zA-Z0-9][a-zA-Z0-9-]{5,63}$"} | |
| $.status | true | {"enum":["pending","approved","denied","expired","cancelled"]} | ||
| $.requestedBy | true | string | {"minLength":1} | |
| $.requestedAt | true | string | {"format":"date-time"} | |
| $.expiresAt | true | string | {"format":"date-time"} | |
| $.resolvedBy | false | string | {"minLength":1} | |
| $.resolvedAt | false | string | {"format":"date-time"} | |
| $.rationale | false | string | {"maxLength":4000} | |
| $.allOf[0] | false | {} | ||
| $.allOf[0].if | false | {"required":["status"]} | ||
| $.allOf[0].if.status | true | {"enum":["approved","denied","cancelled"]} | ||
| $.allOf[0].then | false | {"required":["resolvedBy","resolvedAt","rationale"]} | ||
| $.allOf[0].then.resolvedBy | true | {} | ||
| $.allOf[0].then.resolvedAt | true | {} | ||
| $.allOf[0].then.rationale | true | {} |
PALO Assurance Incident
Developer-preview human-resolution record for a mismatched or inconclusive governed action.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","incidentId","executionId","claimId","caseId","status","severity","reason","resourceHold","createdAt","updatedAt"],"additionalProperties":false} | Developer-preview human-resolution record for a mismatched or inconclusive governed action. |
| $.format | true | {"const":"palo-agentic-assurance-incident"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.incidentId | true | string | {"pattern":"^incident-[a-f0-9-]{36}$"} | |
| $.executionId | true | string | {"pattern":"^execution-[a-f0-9-]{36}$"} | |
| $.claimId | true | string | {"pattern":"^claim-[a-f0-9-]{36}$"} | |
| $.caseId | true | string | {"minLength":1,"maxLength":128} | |
| $.status | true | {"enum":["open","acknowledged","resolved"]} | ||
| $.severity | true | {"enum":["low","medium","high","critical"]} | ||
| $.reason | true | string | {"minLength":1,"maxLength":4000} | |
| $.resourceHold | true | boolean | {} | |
| $.createdAt | true | string | {"format":"date-time"} | |
| $.updatedAt | true | string | {"format":"date-time"} | |
| $.resolvedBy | false | string | {"minLength":1,"maxLength":320} | |
| $.resolution | false | string | {"minLength":1,"maxLength":4000} | |
| $.resolvedAt | false | string | {"format":"date-time"} | |
| $.recommendedCompensation | false | object | {"required":["requiresNewActionClaim","action"],"additionalProperties":false} | |
| $.recommendedCompensation.requiresNewActionClaim | true | {"const":true} | ||
| $.recommendedCompensation.action | true | object | {"required":["tool","operation","resource","path"],"additionalProperties":false} | |
| $.recommendedCompensation.action.tool | true | string | {"minLength":1,"maxLength":200} | |
| $.recommendedCompensation.action.operation | true | {"enum":["create","update","delete","execute"]} | ||
| $.recommendedCompensation.action.resource | true | string | {"minLength":1,"maxLength":1000} | |
| $.recommendedCompensation.action.path | true | string | {"minLength":1,"maxLength":1000,"pattern":"^/"} |
PALO Agentic Capability Governance Crosswalk
PALO-owned governance responses and reviewed mappings from optional external capability taxonomies.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","crosswalkVersion","releasedAt","status","authorityBoundary","capabilities","providerMappings"],"additionalProperties":false} | PALO-owned governance responses and reviewed mappings from optional external capability taxonomies. |
| $.format | true | {"const":"palo-agentic-capability-crosswalk"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.crosswalkVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+$"} | |
| $.releasedAt | true | string | {"format":"date"} | |
| $.status | true | {"enum":["draft","in-review","approved-for-release","superseded"]} | ||
| $.authorityBoundary | true | string | {"minLength":80} | |
| $.capabilities | true | array | {"minItems":1} | |
| $.capabilities[] | false | / #/$defs/capability | {} | |
| $.providerMappings | true | array | {} | |
| $.providerMappings[] | false | / #/$defs/providerMapping | {} | |
| $.$defs.capability | false | object | {"required":["capabilityId","title","definition","primaryConcern","controlIds","evidenceKinds","indicatorIds","gateIds","assessmentQuestions","whatEvidenceWouldChangeThis","limitations"],"additionalProperties":false} | |
| $.$defs.capability.capabilityId | true | string | {"pattern":"^palo-cap-[a-z0-9-]+$"} | |
| $.$defs.capability.title | true | string | {"minLength":1,"maxLength":160} | |
| $.$defs.capability.definition | true | string | {"minLength":40,"maxLength":600} | |
| $.$defs.capability.primaryConcern | true | {"enum":["purpose","authority","oversight","identity","delegation","change","observability","resilience","physical-effect"]} | ||
| $.$defs.capability.controlIds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.$defs.capability.controlIds[] | false | string | {"pattern":"^ctrl-[a-z0-9-]+$"} | |
| $.$defs.capability.evidenceKinds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.$defs.capability.evidenceKinds[] | false | string | {"minLength":1} | |
| $.$defs.capability.indicatorIds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.$defs.capability.indicatorIds[] | false | string | {"pattern":"^(kpi|kri)-[a-z0-9-]+$"} | |
| $.$defs.capability.gateIds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.$defs.capability.gateIds[] | false | string | {"minLength":1} | |
| $.$defs.capability.assessmentQuestions | true | array | {"minItems":2,"uniqueItems":true} | |
| $.$defs.capability.assessmentQuestions[] | false | string | {"minLength":20} | |
| $.$defs.capability.whatEvidenceWouldChangeThis | true | array | {"minItems":2,"uniqueItems":true} | |
| $.$defs.capability.whatEvidenceWouldChangeThis[] | false | string | {"minLength":20} | |
| $.$defs.capability.limitations | true | string | {"minLength":40} | |
| $.$defs.providerMapping | false | object | {"required":["providerId","providerCapabilityId","providerLabel","providerRubricVersion","paloCapabilityIds","coverage","mappingVersion","reviewState","rationale","notUseCaseRiskScore"],"additionalProperties":false} | |
| $.$defs.providerMapping.providerId | true | string | {"pattern":"^[a-z][a-z0-9-]{2,63}$"} | |
| $.$defs.providerMapping.providerCapabilityId | true | string | {"minLength":1,"maxLength":120} | |
| $.$defs.providerMapping.providerLabel | true | string | {"minLength":1,"maxLength":160} | |
| $.$defs.providerMapping.providerRubricVersion | true | string | {"minLength":1,"maxLength":100} | |
| $.$defs.providerMapping.paloCapabilityIds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.$defs.providerMapping.paloCapabilityIds[] | false | string | {"pattern":"^palo-cap-[a-z0-9-]+$"} | |
| $.$defs.providerMapping.coverage | true | {"enum":["partial","supporting"]} | ||
| $.$defs.providerMapping.mappingVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+$"} | |
| $.$defs.providerMapping.reviewState | true | {"enum":["draft","in-review","approved","rejected","superseded"]} | ||
| $.$defs.providerMapping.rationale | true | string | {"minLength":40} | |
| $.$defs.providerMapping.notUseCaseRiskScore | true | {"const":true} |
PALO Agentic Effect Contract
Developer-preview contract describing observable preconditions, intended effects and forbidden effects for a governed action.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","effectContractId","resourceSelector","preconditions","expectedEffects","forbiddenEffects","verification"],"additionalProperties":false} | Developer-preview contract describing observable preconditions, intended effects and forbidden effects for a governed action. |
| $.format | true | {"const":"palo-agentic-effect-contract"} | ||
| $.schemaVersion | true | {"enum":["1.0.0","1.1.0"]} | ||
| $.effectContractId | true | string | {"pattern":"^effect-[a-f0-9-]{36}$"} | |
| $.resourceSelector | true | object | {"required":["resource","path"],"additionalProperties":false} | |
| $.resourceSelector.resource | true | string | {"minLength":1,"maxLength":1000} | |
| $.resourceSelector.path | true | string | {"minLength":1,"maxLength":1000,"pattern":"^/"} | |
| $.resourceSelector.tenantId | false | string | {"minLength":1,"maxLength":128} | |
| $.preconditions | true | / #/$defs/predicateList | {} | |
| $.expectedEffects | true | / #/$defs/predicateList | {} | |
| $.forbiddenEffects | true | / #/$defs/predicateList | {} | |
| $.verification | true | object | {"required":["windowSeconds","onInconclusive"],"additionalProperties":false} | |
| $.verification.windowSeconds | true | integer | {"minimum":1,"maximum":86400} | |
| $.verification.onInconclusive | true | {"enum":["hold_and_review","retry_then_review"]} | ||
| $.verification.maxAttempts | false | integer | {"minimum":1,"maximum":10} | |
| $.verification.initialDelaySeconds | false | integer | {"minimum":0,"maximum":86400} | |
| $.verification.retryBackoffSeconds | false | integer | {"minimum":1,"maximum":86400} | |
| $.recovery | false | object | {"required":["onMismatch"],"additionalProperties":false} | |
| $.recovery.onMismatch | true | {"enum":["hold_and_review","propose_compensation"]} | ||
| $.recovery.compensationAction | false | object | {"required":["tool","operation","resource","path"],"additionalProperties":false} | |
| $.recovery.compensationAction.tool | true | string | {"minLength":1,"maxLength":200} | |
| $.recovery.compensationAction.operation | true | {"enum":["create","update","delete","execute"]} | ||
| $.recovery.compensationAction.resource | true | string | {"minLength":1,"maxLength":1000} | |
| $.recovery.compensationAction.path | true | string | {"minLength":1,"maxLength":1000,"pattern":"^/"} | |
| $.recovery.allOf[0] | false | {} | ||
| $.recovery.allOf[0].if | false | {"required":["onMismatch"]} | ||
| $.recovery.allOf[0].if.onMismatch | true | {"const":"propose_compensation"} | ||
| $.recovery.allOf[0].then | false | {"required":["compensationAction"]} | ||
| $.recovery.allOf[0].then.compensationAction | true | object | {} | |
| $.$defs.legacyPredicateList | false | array | {} | |
| $.$defs.legacyPredicateList[] | false | {} | ||
| $.$defs.legacyPredicateList[].allOf[0] | false | / #/$defs/predicate | {} | |
| $.$defs.legacyPredicateList[].allOf[1] | false | object | {} | |
| $.$defs.legacyPredicateList[].allOf[1].operator | false | {"enum":["exists","equals","unchanged","changedTo","deltaWithin"]} | ||
| $.$defs.predicateList | false | array | {"maxItems":100} | |
| $.$defs.predicateList[] | false | / #/$defs/predicate | {} | |
| $.$defs.predicate | false | object | {"required":["predicateId","path","operator"],"additionalProperties":false} | |
| $.$defs.predicate.predicateId | true | string | {"pattern":"^predicate-[a-zA-Z0-9._-]{1,100}$"} | |
| $.$defs.predicate.path | true | string | {"pattern":"^(|/(?:[^~/]|~0|~1)*)$","maxLength":1000} | |
| $.$defs.predicate.operator | true | {"enum":["exists","notExists","equals","unchanged","changedTo","deltaWithin","numberWithin","containsAll","typeIs"]} | ||
| $.$defs.predicate.minimumDelta | false | number | {} | |
| $.$defs.predicate.maximumDelta | false | number | {} | |
| $.$defs.predicate.minimum | false | number | {} | |
| $.$defs.predicate.maximum | false | number | {} | |
| $.$defs.predicate.values | false | array | {"uniqueItems":true,"maxItems":100} | |
| $.$defs.predicate.expectedType | false | {"enum":["array","boolean","null","number","object","string"]} | ||
| $.$defs.predicate.description | false | string | {"maxLength":500} | |
| $.$defs.predicate.allOf[0] | false | {} | ||
| $.$defs.predicate.allOf[0].if | false | {"required":["operator"]} | ||
| $.$defs.predicate.allOf[0].if.operator | true | {"enum":["equals","changedTo"]} | ||
| $.$defs.predicate.allOf[0].then | false | {"required":["value"]} | ||
| $.$defs.predicate.allOf[1] | false | {} | ||
| $.$defs.predicate.allOf[1].if | false | {"required":["operator"]} | ||
| $.$defs.predicate.allOf[1].if.operator | true | {"const":"deltaWithin"} | ||
| $.$defs.predicate.allOf[1].then | false | {"required":["minimumDelta","maximumDelta"]} | ||
| $.$defs.predicate.allOf[1].then.minimumDelta | true | number | {} | |
| $.$defs.predicate.allOf[1].then.maximumDelta | true | number | {} | |
| $.$defs.predicate.allOf[2] | false | {} | ||
| $.$defs.predicate.allOf[2].if | false | {"required":["operator"]} | ||
| $.$defs.predicate.allOf[2].if.operator | true | {"const":"numberWithin"} | ||
| $.$defs.predicate.allOf[2].then | false | {"required":["minimum","maximum"]} | ||
| $.$defs.predicate.allOf[2].then.minimum | true | number | {} | |
| $.$defs.predicate.allOf[2].then.maximum | true | number | {} | |
| $.$defs.predicate.allOf[3] | false | {} | ||
| $.$defs.predicate.allOf[3].if | false | {"required":["operator"]} | ||
| $.$defs.predicate.allOf[3].if.operator | true | {"const":"containsAll"} | ||
| $.$defs.predicate.allOf[3].then | false | {"required":["values"]} | ||
| $.$defs.predicate.allOf[3].then.values | true | array | {} | |
| $.$defs.predicate.allOf[4] | false | {} | ||
| $.$defs.predicate.allOf[4].if | false | {"required":["operator"]} | ||
| $.$defs.predicate.allOf[4].if.operator | true | {"const":"typeIs"} | ||
| $.$defs.predicate.allOf[4].then | false | {"required":["expectedType"]} | ||
| $.$defs.predicate.allOf[4].then.expectedType | true | string | {} | |
| $.allOf[0] | false | {} | ||
| $.allOf[0].if | false | {"required":["schemaVersion"]} | ||
| $.allOf[0].if.schemaVersion | true | {"const":"1.0.0"} | ||
| $.allOf[0].then | false | {} | ||
| $.allOf[0].then.preconditions | false | / #/$defs/legacyPredicateList | {} | |
| $.allOf[0].then.expectedEffects | false | / #/$defs/legacyPredicateList | {} | |
| $.allOf[0].then.forbiddenEffects | false | / #/$defs/legacyPredicateList | {} | |
| $.allOf[0].then.verification | false | object | {} |
PALO Agentic Enforcement Provider
Vendor-neutral manifest for a policy runtime that returns fail-closed pre-action decisions to PALO. Provider registration does not make an external runtime trusted, production-ready, or endorsed by its vendor.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","providerId","providerVersion","displayName","providerType","capabilities","policyReference"],"additionalProperties":false} | Vendor-neutral manifest for a policy runtime that returns fail-closed pre-action decisions to PALO. Provider registration does not make an external runtime trusted, production-ready, or endorsed by its vendor. |
| $.format | true | {"const":"palo-agentic-enforcement-provider"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.providerId | true | string | {"pattern":"^provider-[a-zA-Z0-9][a-zA-Z0-9._-]{2,100}$"} | |
| $.providerVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$"} | |
| $.displayName | true | string | {"minLength":1,"maxLength":200} | |
| $.providerType | true | string | {"pattern":"^[a-z][a-z0-9._-]{2,100}$"} | |
| $.capabilities | true | array | {"minItems":1,"uniqueItems":true} | |
| $.capabilities[] | false | {"enum":["pre_action_decision","human_escalation","decision_evidence","argument_transformation","post_action_mediation"]} | ||
| $.capabilities.contains | false | {"const":"pre_action_decision"} | ||
| $.policyReference | true | string | {"minLength":1,"maxLength":500} | |
| $.vendor | false | string | {"minLength":1,"maxLength":200} | |
| $.metadata | false | object | {"additionalProperties":{"anyOf":[{"type":"string"},{"type":"number"},{"type":"boolean"},{"type":"null"}]}} | |
| $.metadata.additionalProperties | false | {} | ||
| $.metadata.additionalProperties.anyOf[0] | false | string | {} | |
| $.metadata.additionalProperties.anyOf[1] | false | number | {} | |
| $.metadata.additionalProperties.anyOf[2] | false | boolean | {} | |
| $.metadata.additionalProperties.anyOf[3] | false | null | {} |
PALO Signed Agentic Evidence Envelope
Developer-preview evidence-envelope contract. Version 1 uses a shared HMAC secret; version 2 supports RFC 8785 canonicalization and externally verifiable Ed25519 signatures. Neither version is external timestamping, legal evidence, or certification of the claimed execution.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","eventId","caseId","agentId","claimId","decisionId","outcome","recordedAt","payloadDigest","previousEventDigest","keyId","algorithm","signature"],"additionalProperties":false} | Developer-preview evidence-envelope contract. Version 1 uses a shared HMAC secret; version 2 supports RFC 8785 canonicalization and externally verifiable Ed25519 signatures. Neither version is external timestamping, legal evidence, or certification of the claimed execution. |
| $.format | true | {"const":"palo-agentic-evidence-envelope"} | ||
| $.schemaVersion | true | {"enum":["1.0.0","2.0.0"]} | ||
| $.eventId | true | string | {"pattern":"^event-[a-f0-9-]{36}$"} | |
| $.caseId | true | string | {"minLength":1,"maxLength":128} | |
| $.agentId | true | string | {"pattern":"^agent-[a-zA-Z0-9][a-zA-Z0-9-]{5,63}$"} | |
| $.claimId | true | string | {"pattern":"^claim-[a-f0-9-]{36}$"} | |
| $.decisionId | true | string | {"pattern":"^decision-[a-f0-9-]{36}$"} | |
| $.approvalId | false | string | {"pattern":"^approval-[a-f0-9-]{36}$"} | |
| $.executionId | false | string | {"pattern":"^execution-[a-f0-9-]{36}$"} | |
| $.attestationId | false | string | {"pattern":"^attestation-[a-f0-9-]{36}$"} | |
| $.incidentId | false | string | {"pattern":"^incident-[a-f0-9-]{36}$"} | |
| $.taskId | false | string | {"pattern":"^task-[a-f0-9-]{36}$"} | |
| $.traceId | false | string | {"pattern":"^[a-f0-9]{32}$"} | |
| $.outcome | true | {"enum":["allowed","denied","pending_approval","executed","failed","execution_started","execution_succeeded","execution_failed","execution_unknown","outcome_verified","outcome_mismatch","outcome_inconclusive","incident_opened","incident_resolved"]} | ||
| $.recordedAt | true | string | {"format":"date-time"} | |
| $.redactedPayload | false | object | {"additionalProperties":true} | |
| $.payloadDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.previousEventDigest | true | ["string","null"] | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.keyId | true | string | {"pattern":"^key-[a-zA-Z0-9._-]{3,100}$"} | |
| $.algorithm | true | {"enum":["HMAC-SHA256","Ed25519"]} | ||
| $.canonicalization | false | {"const":"RFC8785"} | ||
| $.verificationMethod | false | string | {"minLength":1,"maxLength":1000} | |
| $.signature | true | {} | ||
| $.signature.oneOf[0] | false | string | {"pattern":"^hmac-sha256:[a-f0-9]{64}$"} | |
| $.signature.oneOf[1] | false | string | {"pattern":"^ed25519:[A-Za-z0-9_-]{86}$"} | |
| $.allOf[0] | false | {} | ||
| $.allOf[0].if | false | {"required":["schemaVersion"]} | ||
| $.allOf[0].if.schemaVersion | true | {"const":"1.0.0"} | ||
| $.allOf[0].then | false | {} | ||
| $.allOf[0].then.algorithm | false | {"const":"HMAC-SHA256"} | ||
| $.allOf[0].then.signature | false | string | {"pattern":"^hmac-sha256:[a-f0-9]{64}$"} | |
| $.allOf[1] | false | {} | ||
| $.allOf[1].if | false | {"required":["schemaVersion"]} | ||
| $.allOf[1].if.schemaVersion | true | {"const":"2.0.0"} | ||
| $.allOf[1].then | false | {"required":["canonicalization","verificationMethod"]} | ||
| $.allOf[1].then.algorithm | false | {"const":"Ed25519"} | ||
| $.allOf[1].then.canonicalization | true | {"const":"RFC8785"} | ||
| $.allOf[1].then.verificationMethod | true | string | {} | |
| $.allOf[1].then.signature | false | string | {"pattern":"^ed25519:[A-Za-z0-9_-]{86}$"} |
PALO One-Time Execution Capability
Server-side developer-preview capability binding one authorized claim to one executor and verifier.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","capabilityId","claimId","claimDigest","decisionId","caseId","agentId","executorId","verifierId","resource","path","issuedAt","expiresAt","singleUse","status","keyId","algorithm","signature"],"additionalProperties":false} | Server-side developer-preview capability binding one authorized claim to one executor and verifier. |
| $.format | true | {"const":"palo-agentic-execution-capability"} | ||
| $.schemaVersion | true | {"enum":["1.0.0","1.1.0"]} | ||
| $.capabilityId | true | string | {"pattern":"^capability-[a-f0-9-]{36}$"} | |
| $.claimId | true | string | {"pattern":"^claim-[a-f0-9-]{36}$"} | |
| $.claimDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.decisionId | true | string | {"pattern":"^decision-[a-f0-9-]{36}$"} | |
| $.caseId | true | string | {"minLength":1,"maxLength":128} | |
| $.agentId | true | string | {"pattern":"^agent-[a-zA-Z0-9][a-zA-Z0-9-]{5,63}$"} | |
| $.executorId | true | string | {"pattern":"^executor-[a-zA-Z0-9][a-zA-Z0-9._-]{2,100}$"} | |
| $.verifierId | true | string | {"pattern":"^verifier-[a-zA-Z0-9][a-zA-Z0-9._-]{2,100}$"} | |
| $.resource | true | string | {"minLength":1,"maxLength":1000} | |
| $.path | true | string | {"pattern":"^/","maxLength":1000} | |
| $.tenantId | false | string | {"minLength":1,"maxLength":128} | |
| $.fitnessDecisionId | false | string | {"pattern":"^fitness-decision-[a-f0-9-]{36}$"} | |
| $.fitnessDecisionDigest | false | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.disclosureContractId | false | string | {"pattern":"^disclosure-[a-f0-9-]{36}$"} | |
| $.disclosureContractDigest | false | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.issuedAt | true | string | {"format":"date-time"} | |
| $.expiresAt | true | string | {"format":"date-time"} | |
| $.singleUse | true | {"const":true} | ||
| $.status | true | {"enum":["issued","consumed","expired","revoked"]} | ||
| $.keyId | true | string | {"pattern":"^key-[a-zA-Z0-9._-]{3,100}$"} | |
| $.algorithm | true | {"const":"HMAC-SHA256"} | ||
| $.signature | true | string | {"pattern":"^hmac-sha256:[a-f0-9]{64}$"} | |
| $.allOf[0] | false | {} | ||
| $.allOf[0].if | false | {"required":["schemaVersion"]} | ||
| $.allOf[0].if.schemaVersion | true | {"const":"1.1.0"} | ||
| $.allOf[0].then | false | {"required":["fitnessDecisionId","fitnessDecisionDigest","disclosureContractId","disclosureContractDigest"]} | ||
| $.allOf[0].then.fitnessDecisionId | true | {} | ||
| $.allOf[0].then.fitnessDecisionDigest | true | {} | ||
| $.allOf[0].then.disclosureContractId | true | {} | ||
| $.allOf[0].then.disclosureContractDigest | true | {} |
PALO Trusted Execution Receipt
Developer-preview signed receipt generated by the trusted executor rather than by the calling agent.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","executionId","capabilityId","claimId","claimDigest","executorId","status","startedAt","completedAt","preStateDigest","requestDigest","resultDigest","keyId","algorithm","signature"],"additionalProperties":false} | Developer-preview signed receipt generated by the trusted executor rather than by the calling agent. |
| $.format | true | {"const":"palo-agentic-execution-receipt"} | ||
| $.schemaVersion | true | {"enum":["1.0.0","1.1.0"]} | ||
| $.executionId | true | string | {"pattern":"^execution-[a-f0-9-]{36}$"} | |
| $.capabilityId | true | string | {"pattern":"^capability-[a-f0-9-]{36}$"} | |
| $.claimId | true | string | {"pattern":"^claim-[a-f0-9-]{36}$"} | |
| $.claimDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.executorId | true | string | {"pattern":"^executor-[a-zA-Z0-9][a-zA-Z0-9._-]{2,100}$"} | |
| $.status | true | {"enum":["succeeded","failed","unknown"]} | ||
| $.startedAt | true | string | {"format":"date-time"} | |
| $.completedAt | true | string | {"format":"date-time"} | |
| $.preStateDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.resourceVersion | false | string | {"maxLength":500} | |
| $.requestDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.resultDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.disclosureReceiptId | false | string | {"pattern":"^disclosure-receipt-[a-f0-9-]{36}$"} | |
| $.disclosureReceiptDigest | false | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.error | false | string | {"maxLength":4000} | |
| $.keyId | true | string | {"pattern":"^key-[a-zA-Z0-9._-]{3,100}$"} | |
| $.algorithm | true | {"const":"HMAC-SHA256"} | ||
| $.signature | true | string | {"pattern":"^hmac-sha256:[a-f0-9]{64}$"} | |
| $.allOf[0] | false | {} | ||
| $.allOf[0].if | false | {"required":["schemaVersion"]} | ||
| $.allOf[0].if.schemaVersion | true | {"const":"1.1.0"} | ||
| $.allOf[0].then | false | {"required":["disclosureReceiptId","disclosureReceiptDigest"]} | ||
| $.allOf[0].then.disclosureReceiptId | true | {} | ||
| $.allOf[0].then.disclosureReceiptDigest | true | {} |
PALO Agent Profile
Versioned authority-profile contract intended for registration by a governance administrator. The reference runtime does not yet authenticate that administrative role or attest the profile publisher. The profile never contains signing secrets.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","profileVersion","agentId","identity","authority","delegation","evidence"],"additionalProperties":false} | Versioned authority-profile contract intended for registration by a governance administrator. The reference runtime does not yet authenticate that administrative role or attest the profile publisher. The profile never contains signing secrets. |
| $.format | true | {"const":"palo-agentic-interface"} | ||
| $.schemaVersion | true | {"const":"1.1.0"} | ||
| $.profileVersion | true | string | {"pattern":"^[1-9][0-9]*\\.[0-9]+\\.[0-9]+$"} | |
| $.agentId | true | string | {"pattern":"^agent-[a-zA-Z0-9][a-zA-Z0-9-]{5,63}$"} | |
| $.status | false | {"enum":["active","suspended","retired"]} | ||
| $.identity | true | object | {"required":["role","lineage","baseModel","systemPromptHash"],"additionalProperties":false} | |
| $.identity.role | true | string | {"minLength":1,"maxLength":100} | |
| $.identity.lineage | true | string | {"minLength":1,"maxLength":500} | |
| $.identity.baseModel | true | string | {"minLength":1,"maxLength":200} | |
| $.identity.systemPromptHash | true | string | {"pattern":"^sha256:[a-fA-F0-9]{64}$"} | |
| $.identity.temperature | false | number | {"minimum":0,"maximum":2} | |
| $.authority | true | object | {"required":["allowedTools","allowedOperations","externalNetwork","readScopes","writeScopes","argumentSchemas","requireVibeGate"],"additionalProperties":false} | |
| $.authority.allowedTools | true | array | {"uniqueItems":true} | |
| $.authority.allowedTools[] | false | string | {"minLength":1} | |
| $.authority.allowedOperations | true | array | {"uniqueItems":true} | |
| $.authority.allowedOperations[] | false | {"enum":["read","create","update","delete","execute","delegate"]} | ||
| $.authority.externalNetwork | true | boolean | {} | |
| $.authority.allowedNetworkHosts | false | array | {"uniqueItems":true} | |
| $.authority.allowedNetworkHosts[] | false | string | {"pattern":"^(\\*|[a-zA-Z0-9.-]+)$"} | |
| $.authority.readScopes | true | array | {"uniqueItems":true} | |
| $.authority.readScopes[] | false | string | {"minLength":1} | |
| $.authority.writeScopes | true | array | {"uniqueItems":true} | |
| $.authority.writeScopes[] | false | string | {"minLength":1} | |
| $.authority.argumentSchemas | true | object | {"minProperties":1,"additionalProperties":{"type":"object"}} | |
| $.authority.argumentSchemas.additionalProperties | false | object | {} | |
| $.authority.requireVibeGate | true | boolean | {} | |
| $.delegation | true | object | {"required":["maxDepth","maxSubagents","allowedSubagentRoles","requireHumanValidation"],"additionalProperties":false} | |
| $.delegation.maxDepth | true | integer | {"minimum":0,"maximum":20} | |
| $.delegation.maxSubagents | true | integer | {"minimum":0,"maximum":1000} | |
| $.delegation.allowedSubagentRoles | true | array | {"uniqueItems":true} | |
| $.delegation.allowedSubagentRoles[] | false | string | {"minLength":1} | |
| $.delegation.requireHumanValidation | true | boolean | {} | |
| $.evidence | true | object | {"required":["keyId","algorithm","auditTrailId","redactFields"],"additionalProperties":false} | |
| $.evidence.keyId | true | string | {"pattern":"^key-[a-zA-Z0-9._-]{3,100}$"} | |
| $.evidence.algorithm | true | {"const":"HMAC-SHA256"} | ||
| $.evidence.auditTrailId | true | string | {"pattern":"^ledger-[a-zA-Z0-9._-]{3,100}$"} | |
| $.evidence.redactFields | true | array | {"uniqueItems":true} | |
| $.evidence.redactFields[] | false | string | {"minLength":1} | |
| $.metadata | false | object | {"additionalProperties":true} |
PALO Outcome Attestation
Developer-preview signed comparison between an Effect Contract and authoritative observed state.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","attestationId","executionId","claimId","verifierId","status","checkedAt","postStateDigest","checks","keyId","algorithm","signature"],"additionalProperties":false} | Developer-preview signed comparison between an Effect Contract and authoritative observed state. |
| $.format | true | {"const":"palo-agentic-outcome-attestation"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.attestationId | true | string | {"pattern":"^attestation-[a-f0-9-]{36}$"} | |
| $.executionId | true | string | {"pattern":"^execution-[a-f0-9-]{36}$"} | |
| $.claimId | true | string | {"pattern":"^claim-[a-f0-9-]{36}$"} | |
| $.verifierId | true | string | {"pattern":"^verifier-[a-zA-Z0-9][a-zA-Z0-9._-]{2,100}$"} | |
| $.status | true | {"enum":["verified","mismatch","inconclusive"]} | ||
| $.checkedAt | true | string | {"format":"date-time"} | |
| $.postStateDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.checks | true | array | {"maxItems":300} | |
| $.checks[] | false | object | {"required":["predicateId","category","status","reason"],"additionalProperties":false} | |
| $.checks[].predicateId | true | string | {"pattern":"^predicate-[a-zA-Z0-9._-]{1,100}$"} | |
| $.checks[].category | true | {"enum":["precondition","expected","forbidden"]} | ||
| $.checks[].status | true | {"enum":["pass","fail","unknown"]} | ||
| $.checks[].reason | true | string | {"minLength":1,"maxLength":1000} | |
| $.incidentId | false | string | {"pattern":"^incident-[a-f0-9-]{36}$"} | |
| $.keyId | true | string | {"pattern":"^key-[a-zA-Z0-9._-]{3,100}$"} | |
| $.algorithm | true | {"const":"HMAC-SHA256"} | ||
| $.signature | true | string | {"pattern":"^hmac-sha256:[a-f0-9]{64}$"} |
PALO Agentic Policy Decision
Developer-preview policy-decision contract. An allowed status is not proof that an action is safe, lawful, currently authorized, exactly once, executed, or durably evidenced.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","decisionId","claimId","agentId","status","reasons","policyVersion","profileVersion","claimDigest","decidedAt","obligations"],"additionalProperties":false} | Developer-preview policy-decision contract. An allowed status is not proof that an action is safe, lawful, currently authorized, exactly once, executed, or durably evidenced. |
| $.format | true | {"const":"palo-agentic-policy-decision"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.decisionId | true | string | {"pattern":"^decision-[a-f0-9-]{36}$"} | |
| $.claimId | true | string | {"pattern":"^claim-[a-f0-9-]{36}$"} | |
| $.agentId | true | string | {"pattern":"^agent-[a-zA-Z0-9][a-zA-Z0-9-]{5,63}$"} | |
| $.status | true | {"enum":["allowed","denied","pending_approval"]} | ||
| $.reasons | true | array | {"minItems":1} | |
| $.reasons[] | false | string | {"minLength":1} | |
| $.policyVersion | true | string | {"minLength":1} | |
| $.profileVersion | true | string | {"minLength":1} | |
| $.claimDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.decidedAt | true | string | {"format":"date-time"} | |
| $.approvalId | false | string | {"pattern":"^approval-[a-f0-9-]{36}$"} | |
| $.obligations | true | array | {} | |
| $.obligations[] | false | string | {"minLength":1} | |
| $.enforcementProvider | false | object | {"required":["providerId","providerVersion","policyReference"],"additionalProperties":false} | Portable reference to the provider that produced the pre-action decision. It is evidence linkage, not vendor endorsement or proof of provider integrity. |
| $.enforcementProvider.providerId | true | string | {"pattern":"^provider-[a-zA-Z0-9][a-zA-Z0-9._-]{2,100}$"} | |
| $.enforcementProvider.providerVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$"} | |
| $.enforcementProvider.policyReference | true | string | {"minLength":1,"maxLength":500} | |
| $.enforcementProvider.decisionReference | false | string | {"minLength":1,"maxLength":500} | |
| $.enforcementProvider.evidenceDigest | false | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.allOf[0] | false | {} | ||
| $.allOf[0].if | false | {"required":["status"]} | ||
| $.allOf[0].if.status | true | {"const":"pending_approval"} | ||
| $.allOf[0].then | false | {"required":["approvalId"]} | ||
| $.allOf[0].then.approvalId | true | {} |
PALO OPA Agentic Policy Input
Developer-preview OPA input contract. A conforming input or policy response is not a production authorization or compliance determination.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["claim","claim_digest","profile","policy","approval","now"],"additionalProperties":false} | Developer-preview OPA input contract. A conforming input or policy response is not a production authorization or compliance determination. |
| $.claim | true | / palo-agentic-action-claim.schema.json | {} | |
| $.claim_digest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.profile | true | / palo-agentic-interface.schema.json | {} | |
| $.policy | true | / palo-agentic-policy.schema.json | {} | |
| $.approval | true | {} | ||
| $.approval.oneOf[0] | false | / palo-agentic-approval.schema.json | {} | |
| $.approval.oneOf[1] | false | null | {} | |
| $.now | true | string | {"format":"date-time"} |
PALO Policy Registration
Developer-preview policy-manifest contract. The reference runtime does not yet authenticate the publisher or attest that the active OPA bundle matches this manifest.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","policyId","policyVersion","status","regoPackage","entrypoint","bundleDigest"],"additionalProperties":false} | Developer-preview policy-manifest contract. The reference runtime does not yet authenticate the publisher or attest that the active OPA bundle matches this manifest. |
| $.format | true | {"const":"palo-agentic-policy"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.policyId | true | string | {"pattern":"^policy-[a-zA-Z0-9._-]{3,100}$"} | |
| $.policyVersion | true | string | {"pattern":"^[1-9][0-9]*\\.[0-9]+\\.[0-9]+$"} | |
| $.status | true | {"enum":["active","suspended","retired"]} | ||
| $.regoPackage | true | string | {"pattern":"^[a-zA-Z0-9_.]+$"} | |
| $.entrypoint | true | string | {"minLength":1,"maxLength":300} | |
| $.bundleDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.metadata | false | object | {"additionalProperties":true} |
PALO AI System and Agent Registry Record
Versioned registry record linking an AI system to models, agents, tools, data, providers, owners, policy and evidence.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","systemId","recordVersion","tenantId","name","useCase","status","riskClass","jurisdictions","owners","relationships","deployedVersion","policyBundleDigest","updatedAt"],"additionalProperties":false} | Versioned registry record linking an AI system to models, agents, tools, data, providers, owners, policy and evidence. |
| $.format | true | {"const":"palo-ai-system-record"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.systemId | true | string | {"pattern":"^ai-system-[a-zA-Z0-9][a-zA-Z0-9._-]{2,100}$"} | |
| $.recordVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+$"} | |
| $.tenantId | true | string | {"minLength":1,"maxLength":128} | |
| $.name | true | string | {"minLength":1,"maxLength":300} | |
| $.useCase | true | string | {"minLength":1,"maxLength":4000} | |
| $.status | true | {"enum":["design","pilot","production","suspended","decommissioned"]} | ||
| $.riskClass | true | {"enum":["minimal","limited","high","prohibited","gpai","systemic-gpai","pending"]} | ||
| $.jurisdictions | true | array | {"minItems":1,"uniqueItems":true} | |
| $.jurisdictions[] | false | string | {"minLength":1,"maxLength":100} | |
| $.owners | true | array | {"minItems":1,"uniqueItems":true} | |
| $.owners[] | false | string | {"minLength":1,"maxLength":500} | |
| $.relationships | true | object | {"required":["models","agents","tools","dataSubjects","providers"],"additionalProperties":false} | |
| $.relationships.models | true | / #/$defs/idList | {} | |
| $.relationships.agents | true | / #/$defs/idList | {} | |
| $.relationships.tools | true | / #/$defs/idList | {} | |
| $.relationships.dataSubjects | true | / #/$defs/idList | {} | |
| $.relationships.providers | true | / #/$defs/idList | {} | |
| $.deployedVersion | true | string | {"minLength":1,"maxLength":200} | |
| $.policyBundleDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.evidenceRefs | false | array | {"uniqueItems":true} | |
| $.evidenceRefs[] | false | string | {"pattern":"^evidence-ref-[a-f0-9-]{36}$"} | |
| $.updatedAt | true | string | {"format":"date-time"} | |
| $.$defs.idList | false | array | {"uniqueItems":true,"maxItems":1000} | |
| $.$defs.idList[] | false | string | {"minLength":1,"maxLength":1000} |
PALO ISO IEC 42001 AIMS Overlay Record
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","recordId","organization","scope","context","leadership","planning","support","operation","performanceEvaluation","improvement","authorityBoundary"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-aims-overlay-record"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.recordId | true | string | {} | |
| $.organization | true | string | {} | |
| $.scope | true | / #/$defs/section | {} | |
| $.context | true | / #/$defs/section | {} | |
| $.leadership | true | / #/$defs/section | {} | |
| $.planning | true | / #/$defs/section | {} | |
| $.support | true | / #/$defs/section | {} | |
| $.operation | true | / #/$defs/section | {} | |
| $.performanceEvaluation | true | / #/$defs/section | {} | |
| $.improvement | true | / #/$defs/section | {} | |
| $.authorityBoundary | true | string | {"minLength":40} | |
| $.$defs.section | false | object | {"required":["owner","requirements","evidenceRefs","status","reviewedAt","reviewedBy","findings"],"additionalProperties":false} | |
| $.$defs.section.owner | true | string | {} | |
| $.$defs.section.requirements | true | array | {"minItems":1} | |
| $.$defs.section.requirements[] | false | string | {} | |
| $.$defs.section.evidenceRefs | true | array | {"minItems":1} | |
| $.$defs.section.evidenceRefs[] | false | string | {} | |
| $.$defs.section.status | true | {"enum":["implemented","partial","gap","not-applicable"]} | ||
| $.$defs.section.reviewedAt | true | string | {"format":"date-time"} | |
| $.$defs.section.reviewedBy | true | string | {} | |
| $.$defs.section.findings | true | array | {} | |
| $.$defs.section.findings[] | false | string | {} |
PALO Article 50 Transparency Record
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","recordId","caseId","systemVersion","actorRoles","modalities","interactionNotice","marking","deployerLabelling","provenance","exceptions","releaseDecision"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-article50-transparency-record"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.recordId | true | string | {} | |
| $.caseId | true | string | {} | |
| $.systemVersion | true | string | {} | |
| $.actorRoles | true | array | {"minItems":1,"uniqueItems":true} | |
| $.actorRoles[] | false | {"enum":["provider","deployer","importer","distributor","authorized-representative"]} | ||
| $.modalities | true | array | {"minItems":1,"uniqueItems":true} | |
| $.modalities[] | false | {"enum":["interactive","text","image","audio","video","biometric-categorisation","emotion-recognition"]} | ||
| $.interactionNotice | true | / #/$defs/testedMeasure | {} | |
| $.marking | true | object | {"required":["required","method","machineReadable","standardOrProfile","keyOrIssuer","coverageTest"],"additionalProperties":false} | |
| $.marking.required | true | boolean | {} | |
| $.marking.method | true | string | {"minLength":3} | |
| $.marking.machineReadable | true | boolean | {} | |
| $.marking.standardOrProfile | true | string | {"minLength":3} | |
| $.marking.keyOrIssuer | true | string | {"minLength":3} | |
| $.marking.coverageTest | true | / #/$defs/testedMeasure | {} | |
| $.deployerLabelling | true | array | {} | |
| $.deployerLabelling[] | false | object | {"required":["contentType","required","label","placement","testResult"],"additionalProperties":false} | |
| $.deployerLabelling[].contentType | true | string | {} | |
| $.deployerLabelling[].required | true | boolean | {} | |
| $.deployerLabelling[].label | true | string | {} | |
| $.deployerLabelling[].placement | true | string | {} | |
| $.deployerLabelling[].testResult | true | {"enum":["pass","conditional","fail","not-applicable"]} | ||
| $.provenance | true | object | {"required":["assertionFormat","boundToContentDigest","verificationTool","transformationTests"],"additionalProperties":false} | |
| $.provenance.assertionFormat | true | string | {} | |
| $.provenance.boundToContentDigest | true | boolean | {} | |
| $.provenance.verificationTool | true | string | {} | |
| $.provenance.transformationTests | true | array | {"minItems":1} | |
| $.provenance.transformationTests[] | false | / #/$defs/testedMeasure | {} | |
| $.exceptions | true | array | {} | |
| $.exceptions[] | false | object | {"required":["obligation","basis","sourceProvision","approvedBy"],"additionalProperties":false} | |
| $.exceptions[].obligation | true | string | {} | |
| $.exceptions[].basis | true | string | {"minLength":20} | |
| $.exceptions[].sourceProvision | true | string | {} | |
| $.exceptions[].approvedBy | true | string | {} | |
| $.releaseDecision | true | object | {"required":["status","decidedAt","decidedBy","validUntil"],"additionalProperties":false} | |
| $.releaseDecision.status | true | {"enum":["accepted","conditional","rejected"]} | ||
| $.releaseDecision.decidedAt | true | string | {"format":"date-time"} | |
| $.releaseDecision.decidedBy | true | string | {} | |
| $.releaseDecision.validUntil | true | string | {"format":"date-time"} | |
| $.$defs.testedMeasure | false | object | {"required":["required","implementation","testedAt","result","evidenceRef"],"additionalProperties":false} | |
| $.$defs.testedMeasure.required | true | boolean | {} | |
| $.$defs.testedMeasure.implementation | true | string | {} | |
| $.$defs.testedMeasure.testedAt | true | string | {"format":"date-time"} | |
| $.$defs.testedMeasure.result | true | {"enum":["pass","conditional","fail","not-applicable"]} | ||
| $.$defs.testedMeasure.evidenceRef | true | string | {} |
PALO Continuous Assurance Signal
Immutable external change signal that invalidates prior data-fitness assumptions and may revoke unconsumed capabilities.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","signalId","tenantId","subject","sourceSystem","signalType","severity","observedAt","changeDigest","reason"],"additionalProperties":false} | Immutable external change signal that invalidates prior data-fitness assumptions and may revoke unconsumed capabilities. |
| $.format | true | {"const":"palo-assurance-signal"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.signalId | true | string | {"pattern":"^assurance-signal-[a-f0-9-]{36}$"} | |
| $.tenantId | true | string | {"minLength":1,"maxLength":128} | |
| $.subject | true | object | {"required":["type","id"],"additionalProperties":false} | |
| $.subject.type | true | {"enum":["dataset","data-product","model","ai-system","agent","tool","access-entitlement","other"]} | ||
| $.subject.id | true | string | {"minLength":1,"maxLength":1000} | |
| $.sourceSystem | true | string | {"minLength":1,"maxLength":100} | |
| $.signalType | true | {"enum":["quality-changed","classification-changed","lineage-changed","access-changed","contract-changed","incident-opened","incident-resolved","system-release","policy-release"]} | ||
| $.severity | true | {"enum":["info","low","medium","high","critical"]} | ||
| $.observedAt | true | string | {"format":"date-time"} | |
| $.evidenceRefId | false | string | {"pattern":"^evidence-ref-[a-f0-9-]{36}$"} | |
| $.changeDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.reason | true | string | {"minLength":1,"maxLength":2000} |
PALO Case File
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","caseId","title","status","createdAt","updatedAt","context","assessments","evidence","sources","incidents","handoffs"],"additionalProperties":true} | |
| $.format | true | {"const":"palo-case-file"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.caseId | true | string | {"pattern":"^case-[a-z0-9][a-z0-9-]{5,63}$"} | |
| $.title | true | string | {"minLength":1,"maxLength":200} | |
| $.status | true | {"enum":["draft","active","review","closed","reopened"]} | ||
| $.createdAt | true | string | {"format":"date-time"} | |
| $.updatedAt | true | string | {"format":"date-time"} | |
| $.owner | false | string | {"maxLength":200} | |
| $.context | true | object | {} | |
| $.assessments | true | array | {} | |
| $.assessments[] | false | object | {"required":["assessmentId","module","recordedAt","data"],"additionalProperties":true} | |
| $.assessments[].assessmentId | true | string | {"minLength":1} | |
| $.assessments[].module | true | string | {"minLength":1} | |
| $.assessments[].recordedAt | true | string | {"format":"date-time"} | |
| $.assessments[].data | true | object | {} | |
| $.evidence | true | array | {} | |
| $.evidence[] | false | object | {"required":["evidenceId","title","kind","status","recordedAt"],"additionalProperties":true} | |
| $.evidence[].evidenceId | true | string | {"minLength":1} | |
| $.evidence[].title | true | string | {"minLength":1} | |
| $.evidence[].kind | true | string | {"minLength":1} | |
| $.evidence[].status | true | {"enum":["open","draft","ready","verified","superseded"]} | ||
| $.evidence[].recordedAt | true | string | {"format":"date-time"} | |
| $.evidence[].content | false | {} | ||
| $.sources | true | array | {} | |
| $.sources[] | false | / #/$defs/source | {} | |
| $.incidents | true | array | {} | |
| $.incidents[] | false | object | {"required":["incidentId","triggerId","occurredAt","summary","reopenGates"],"additionalProperties":true} | |
| $.incidents[].incidentId | true | string | {"minLength":1} | |
| $.incidents[].triggerId | true | string | {"minLength":1} | |
| $.incidents[].occurredAt | true | string | {"format":"date-time"} | |
| $.incidents[].summary | true | string | {"minLength":1} | |
| $.incidents[].reopenGates | true | array | {"minItems":1,"uniqueItems":true} | |
| $.incidents[].reopenGates[] | false | string | {} | |
| $.handoffs | true | array | {} | |
| $.handoffs[] | false | object | {"required":["handoffId","from","to","createdAt"],"additionalProperties":true} | |
| $.handoffs[].handoffId | true | string | {"minLength":1} | |
| $.handoffs[].from | true | string | {"minLength":1} | |
| $.handoffs[].to | true | string | {"minLength":1} | |
| $.handoffs[].createdAt | true | string | {"format":"date-time"} | |
| $.$defs.source | false | object | {"required":["sourceId","title","url","sourceType","publisher","checkedAt","freshness"],"additionalProperties":true} | |
| $.$defs.source.sourceId | true | string | {"minLength":1} | |
| $.$defs.source.title | true | string | {"minLength":1} | |
| $.$defs.source.url | true | string | {"format":"uri"} | |
| $.$defs.source.sourceType | true | {"enum":["official","standard","organizational","research","monitoring-signal"]} | ||
| $.$defs.source.publisher | true | string | {"minLength":1} | |
| $.$defs.source.checkedAt | true | string | {"format":"date-time"} | |
| $.$defs.source.freshness | true | object | {"required":["status","reviewIntervalDays","nextReviewAt"],"additionalProperties":true} | |
| $.$defs.source.freshness.status | true | {"enum":["current","review-due","stale","superseded","unknown"]} | ||
| $.$defs.source.freshness.reviewIntervalDays | true | integer | {"minimum":1,"maximum":3650} | |
| $.$defs.source.freshness.nextReviewAt | true | string | {"format":"date-time"} | |
| $.$defs.source.freshness.supersededBy | false | string | {"format":"uri"} |
PALO Control Library
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","status","updatedAt","disclaimer","controls"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-control-library"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.status | true | {"const":"educational-non-production"} | ||
| $.updatedAt | true | string | {"format":"date"} | |
| $.disclaimer | true | string | {"minLength":20} | |
| $.controls | true | array | {"minItems":1} | |
| $.controls[] | false | object | {"required":["controlId","title","objective","controlType","lifecycleGates","evidenceKinds","indicatorIds","sourceIds","templateIds"],"additionalProperties":false} | |
| $.controls[].controlId | true | string | {"pattern":"^ctrl-[a-z0-9-]+$"} | |
| $.controls[].title | true | string | {"minLength":1} | |
| $.controls[].objective | true | string | {"minLength":1} | |
| $.controls[].controlType | true | {"enum":["preventive","detective","corrective","directive"]} | ||
| $.controls[].lifecycleGates | true | array | {"minItems":1,"uniqueItems":true} | |
| $.controls[].lifecycleGates[] | false | string | {} | |
| $.controls[].evidenceKinds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.controls[].evidenceKinds[] | false | string | {} | |
| $.controls[].indicatorIds | true | array | {"uniqueItems":true} | |
| $.controls[].indicatorIds[] | false | string | {} | |
| $.controls[].sourceIds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.controls[].sourceIds[] | false | string | {} | |
| $.controls[].templateIds | true | array | {"uniqueItems":true} | |
| $.controls[].templateIds[] | false | string | {} |
PALO Data Disclosure Contract
Signed, purpose-bound contract governing data read scope, information egress, provider and region, redaction, tracing and retention.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","disclosureContractId","tenantId","subject","purpose","lawfulBasis","dataScope","egressPolicy","destinationPolicy","tracePolicy","outputPolicy","boundFitnessDecision","issuedAt","expiresAt","status","keyId","algorithm","signature"],"additionalProperties":false} | Signed, purpose-bound contract governing data read scope, information egress, provider and region, redaction, tracing and retention. |
| $.format | true | {"const":"palo-data-disclosure-contract"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.disclosureContractId | true | string | {"pattern":"^disclosure-[a-f0-9-]{36}$"} | |
| $.tenantId | true | string | {"minLength":1,"maxLength":128} | |
| $.subject | true | / #/$defs/subject | {} | |
| $.purpose | true | string | {"minLength":1,"maxLength":300} | |
| $.lawfulBasis | true | {"enum":["consent","contract","legal-obligation","vital-interests","public-task","legitimate-interests","not-applicable","pending-review"]} | ||
| $.dataScope | true | object | {"required":["sourceRefs","allowedFields","deniedFields","maxRowsRead"],"additionalProperties":false} | |
| $.dataScope.sourceRefs | true | array | {"minItems":1,"uniqueItems":true} | |
| $.dataScope.sourceRefs[] | false | string | {"minLength":1,"maxLength":1000} | |
| $.dataScope.allowedFields | true | array | {"uniqueItems":true,"maxItems":1000} | |
| $.dataScope.allowedFields[] | false | string | {"minLength":1,"maxLength":500} | |
| $.dataScope.deniedFields | true | array | {"uniqueItems":true,"maxItems":1000} | |
| $.dataScope.deniedFields[] | false | string | {"minLength":1,"maxLength":500} | |
| $.dataScope.maxRowsRead | true | integer | {"minimum":0,"maximum":10000000} | |
| $.egressPolicy | true | object | {"required":["mode","maxRows","allowedFields","prohibitedCategories","requiredRedactions"],"additionalProperties":false} | |
| $.egressPolicy.mode | true | {"enum":["zero-row","aggregated","row-level"]} | ||
| $.egressPolicy.maxRows | true | integer | {"minimum":0,"maximum":1000000} | |
| $.egressPolicy.allowedFields | true | array | {"uniqueItems":true,"maxItems":1000} | |
| $.egressPolicy.allowedFields[] | false | string | {"minLength":1,"maxLength":500} | |
| $.egressPolicy.prohibitedCategories | true | array | {"uniqueItems":true,"maxItems":100} | |
| $.egressPolicy.prohibitedCategories[] | false | string | {"minLength":1,"maxLength":200} | |
| $.egressPolicy.requiredRedactions | true | array | {"uniqueItems":true,"maxItems":100} | |
| $.egressPolicy.requiredRedactions[] | false | string | {"minLength":1,"maxLength":200} | |
| $.egressPolicy.minimumAggregationGroupSize | false | integer | {"minimum":2,"maximum":1000000} | |
| $.egressPolicy.allOf[0] | false | {} | ||
| $.egressPolicy.allOf[0].if | false | {"required":["mode"]} | ||
| $.egressPolicy.allOf[0].if.mode | true | {"const":"zero-row"} | ||
| $.egressPolicy.allOf[0].then | false | {} | ||
| $.egressPolicy.allOf[0].then.maxRows | false | integer | {"const":0} | |
| $.egressPolicy.allOf[0].then.allowedFields | false | array | {"maxItems":0} | |
| $.egressPolicy.allOf[1] | false | {} | ||
| $.egressPolicy.allOf[1].if | false | {"required":["mode"]} | ||
| $.egressPolicy.allOf[1].if.mode | true | {"const":"aggregated"} | ||
| $.egressPolicy.allOf[1].then | false | {"required":["minimumAggregationGroupSize"]} | ||
| $.egressPolicy.allOf[1].then.minimumAggregationGroupSize | true | integer | {} | |
| $.destinationPolicy | true | object | {"required":["allowedRecipients","allowedProviders","allowedModels","allowedRegions","allowedEndpointHosts"],"additionalProperties":false} | |
| $.destinationPolicy.allowedRecipients | true | array | {"minItems":1,"uniqueItems":true} | |
| $.destinationPolicy.allowedRecipients[] | false | string | {"minLength":1,"maxLength":500} | |
| $.destinationPolicy.allowedProviders | true | array | {"minItems":1,"uniqueItems":true} | |
| $.destinationPolicy.allowedProviders[] | false | string | {"minLength":1,"maxLength":200} | |
| $.destinationPolicy.allowedModels | true | array | {"minItems":1,"uniqueItems":true} | |
| $.destinationPolicy.allowedModels[] | false | string | {"minLength":1,"maxLength":300} | |
| $.destinationPolicy.allowedRegions | true | array | {"minItems":1,"uniqueItems":true} | |
| $.destinationPolicy.allowedRegions[] | false | string | {"minLength":1,"maxLength":100} | |
| $.destinationPolicy.allowedEndpointHosts | true | array | {"minItems":1,"uniqueItems":true} | |
| $.destinationPolicy.allowedEndpointHosts[] | false | string | {"pattern":"^[a-z0-9.-]+$","maxLength":253} | |
| $.tracePolicy | true | object | {"required":["allowedModes","maxRetentionSeconds"],"additionalProperties":false} | |
| $.tracePolicy.allowedModes | true | array | {"minItems":1,"uniqueItems":true} | |
| $.tracePolicy.allowedModes[] | false | {"enum":["disabled","metadata-only","redacted-payload"]} | ||
| $.tracePolicy.maxRetentionSeconds | true | integer | {"minimum":0,"maximum":31536000} | |
| $.outputPolicy | true | object | {"required":["exportAllowed"],"additionalProperties":false} | |
| $.outputPolicy.exportAllowed | true | boolean | {} | |
| $.outputPolicy.schemaDigest | false | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.boundFitnessDecision | true | object | {"required":["decisionId","decisionDigest"],"additionalProperties":false} | |
| $.boundFitnessDecision.decisionId | true | string | {"pattern":"^fitness-decision-[a-f0-9-]{36}$"} | |
| $.boundFitnessDecision.decisionDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.approvedBy | false | string | {"minLength":1,"maxLength":500} | |
| $.issuedAt | true | string | {"format":"date-time"} | |
| $.expiresAt | true | string | {"format":"date-time"} | |
| $.status | true | {"enum":["active","revoked"]} | ||
| $.keyId | true | string | {"pattern":"^key-[a-zA-Z0-9._-]{3,100}$"} | |
| $.algorithm | true | {"const":"HMAC-SHA256"} | ||
| $.signature | true | string | {"pattern":"^hmac-sha256:[a-f0-9]{64}$"} | |
| $.$defs.subject | false | object | {"required":["type","id"],"additionalProperties":false} | |
| $.$defs.subject.type | true | {"enum":["dataset","data-product","model","ai-system","agent","tool","access-entitlement","other"]} | ||
| $.$defs.subject.id | true | string | {"minLength":1,"maxLength":1000} |
PALO Data Disclosure Observation
Payload-minimized metadata observed by a trusted executor about rows read and information actually disclosed.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","sourceRefs","fieldsRead","rowsRead","egressFields","egressRows","sensitiveCategories","redactionsApplied","destination","trace","exported","queryDigest","payloadDigest","observedAt"],"additionalProperties":false} | Payload-minimized metadata observed by a trusted executor about rows read and information actually disclosed. |
| $.format | true | {"const":"palo-data-disclosure-observation"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.sourceRefs | true | array | {"minItems":1,"uniqueItems":true} | |
| $.sourceRefs[] | false | string | {"minLength":1,"maxLength":1000} | |
| $.fieldsRead | true | array | {"uniqueItems":true,"maxItems":1000} | |
| $.fieldsRead[] | false | string | {"minLength":1,"maxLength":500} | |
| $.rowsRead | true | integer | {"minimum":0,"maximum":10000000} | |
| $.egressFields | true | array | {"uniqueItems":true,"maxItems":1000} | |
| $.egressFields[] | false | string | {"minLength":1,"maxLength":500} | |
| $.egressRows | true | integer | {"minimum":0,"maximum":1000000} | |
| $.aggregationGroupSize | false | integer | {"minimum":1,"maximum":10000000} | |
| $.sensitiveCategories | true | array | {"uniqueItems":true,"maxItems":100} | |
| $.sensitiveCategories[] | false | string | {"minLength":1,"maxLength":200} | |
| $.redactionsApplied | true | array | {"uniqueItems":true,"maxItems":100} | |
| $.redactionsApplied[] | false | string | {"minLength":1,"maxLength":200} | |
| $.destination | true | object | {"required":["recipient","provider","model","region","endpointHost"],"additionalProperties":false} | |
| $.destination.recipient | true | string | {"minLength":1,"maxLength":500} | |
| $.destination.provider | true | string | {"minLength":1,"maxLength":200} | |
| $.destination.model | true | string | {"minLength":1,"maxLength":300} | |
| $.destination.region | true | string | {"minLength":1,"maxLength":100} | |
| $.destination.endpointHost | true | string | {"pattern":"^[a-z0-9.-]+$","maxLength":253} | |
| $.trace | true | object | {"required":["mode","retentionSeconds"],"additionalProperties":false} | |
| $.trace.mode | true | {"enum":["disabled","metadata-only","redacted-payload"]} | ||
| $.trace.retentionSeconds | true | integer | {"minimum":0,"maximum":31536000} | |
| $.exported | true | boolean | {} | |
| $.outputSchemaDigest | false | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.queryDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.payloadDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.observedAt | true | string | {"format":"date-time"} |
PALO Data Disclosure Receipt
Signed comparison between a Data Disclosure Contract and payload-minimized executor observations.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","receiptId","disclosureContractId","executionId","claimId","executorId","status","observationDigest","checks","checkedAt","keyId","algorithm","signature"],"additionalProperties":false} | Signed comparison between a Data Disclosure Contract and payload-minimized executor observations. |
| $.format | true | {"const":"palo-data-disclosure-receipt"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.receiptId | true | string | {"pattern":"^disclosure-receipt-[a-f0-9-]{36}$"} | |
| $.disclosureContractId | true | string | {"pattern":"^disclosure-[a-f0-9-]{36}$"} | |
| $.executionId | true | string | {"pattern":"^execution-[a-f0-9-]{36}$"} | |
| $.claimId | true | string | {"pattern":"^claim-[a-f0-9-]{36}$"} | |
| $.executorId | true | string | {"pattern":"^executor-[a-zA-Z0-9][a-zA-Z0-9._-]{2,100}$"} | |
| $.status | true | {"enum":["verified","mismatch","inconclusive"]} | ||
| $.observationDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.observedSummary | false | / palo-data-disclosure-observation.schema.json | {} | |
| $.checks | true | array | {"minItems":1,"maxItems":200} | |
| $.checks[] | false | object | {"required":["predicateId","category","status","reason"],"additionalProperties":false} | |
| $.checks[].predicateId | true | string | {"pattern":"^predicate-[a-zA-Z0-9._-]{1,100}$"} | |
| $.checks[].category | true | {"const":"forbidden"} | ||
| $.checks[].status | true | {"enum":["pass","fail","unknown"]} | ||
| $.checks[].reason | true | string | {"minLength":1,"maxLength":1000} | |
| $.checkedAt | true | string | {"format":"date-time"} | |
| $.keyId | true | string | {"pattern":"^key-[a-zA-Z0-9._-]{3,100}$"} | |
| $.algorithm | true | {"const":"HMAC-SHA256"} | ||
| $.signature | true | string | {"pattern":"^hmac-sha256:[a-f0-9]{64}$"} | |
| $.allOf[0] | false | {} | ||
| $.allOf[0].if | false | {"required":["status"]} | ||
| $.allOf[0].if.status | true | {"enum":["verified","mismatch"]} | ||
| $.allOf[0].then | false | {"required":["observedSummary"]} | ||
| $.allOf[0].then.observedSummary | true | {} |
PALO Data Fitness Decision
Immutable decision binding one subject, purpose, policy version and exact external evidence references.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","decisionId","tenantId","subject","purpose","policyId","policyVersion","status","checks","evidenceRefs","evidenceDigest","decidedAt","expiresAt"],"additionalProperties":false} | Immutable decision binding one subject, purpose, policy version and exact external evidence references. |
| $.format | true | {"const":"palo-data-fitness-decision"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.decisionId | true | string | {"pattern":"^fitness-decision-[a-f0-9-]{36}$"} | |
| $.tenantId | true | string | {"minLength":1,"maxLength":128} | |
| $.subject | true | object | {"required":["type","id"],"additionalProperties":false} | |
| $.subject.type | true | {"enum":["dataset","data-product","model","ai-system","agent","tool","access-entitlement","other"]} | ||
| $.subject.id | true | string | {"minLength":1,"maxLength":1000} | |
| $.purpose | true | string | {"minLength":1,"maxLength":300} | |
| $.policyId | true | string | {"pattern":"^fitness-policy-[a-zA-Z0-9][a-zA-Z0-9._-]{2,100}$"} | |
| $.policyVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+$"} | |
| $.status | true | {"enum":["allowed","denied","review_required"]} | ||
| $.checks | true | array | {"minItems":1,"maxItems":200} | |
| $.checks[] | false | object | {"required":["checkId","status","reason","evidenceRefIds"],"additionalProperties":false} | |
| $.checks[].checkId | true | string | {"pattern":"^fitness-check-[a-zA-Z0-9._-]{1,100}$"} | |
| $.checks[].status | true | {"enum":["pass","fail","unknown"]} | ||
| $.checks[].reason | true | string | {"minLength":1,"maxLength":1000} | |
| $.checks[].evidenceRefIds | true | array | {"uniqueItems":true} | |
| $.checks[].evidenceRefIds[] | false | string | {"pattern":"^evidence-ref-[a-f0-9-]{36}$"} | |
| $.evidenceRefs | true | array | {"uniqueItems":true} | |
| $.evidenceRefs[] | false | string | {"pattern":"^evidence-ref-[a-f0-9-]{36}$"} | |
| $.evidenceDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.decidedAt | true | string | {"format":"date-time"} | |
| $.expiresAt | true | string | {"format":"date-time"} |
PALO Data Fitness Policy
Deterministic policy for deciding whether externally referenced data context is fit for a declared purpose.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","policyId","policyVersion","tenantId","targetTypes","requiredEvidenceTypes","requirements","onMissing","effectiveAt","status"],"additionalProperties":false} | Deterministic policy for deciding whether externally referenced data context is fit for a declared purpose. |
| $.format | true | {"const":"palo-data-fitness-policy"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.policyId | true | string | {"pattern":"^fitness-policy-[a-zA-Z0-9][a-zA-Z0-9._-]{2,100}$"} | |
| $.policyVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+$"} | |
| $.tenantId | true | string | {"minLength":1,"maxLength":128} | |
| $.targetTypes | true | array | {"minItems":1,"uniqueItems":true} | |
| $.targetTypes[] | false | {"enum":["dataset","data-product","model","ai-system","agent","tool","access-entitlement","other"]} | ||
| $.requiredEvidenceTypes | true | array | {"minItems":1,"uniqueItems":true} | |
| $.requiredEvidenceTypes[] | false | {"enum":["metadata","lineage","quality","classification","ownership","access","data-contract","audit","incident","other"]} | ||
| $.requirements | true | object | {"minProperties":1,"additionalProperties":false} | |
| $.requirements.minQualityScore | false | number | {"minimum":0,"maximum":100} | |
| $.requirements.maxEvidenceAgeSeconds | false | integer | {"minimum":1,"maximum":31536000} | |
| $.requirements.requireVerifiedAuthority | false | boolean | {} | |
| $.requirements.requireOwner | false | boolean | {} | |
| $.requirements.requireApproved | false | boolean | {} | |
| $.requirements.requireLineage | false | boolean | {} | |
| $.requirements.requireAccessGranted | false | boolean | {} | |
| $.requirements.denyOpenIncident | false | boolean | {} | |
| $.requirements.prohibitedClassifications | false | array | {"uniqueItems":true,"maxItems":100} | |
| $.requirements.prohibitedClassifications[] | false | string | {"minLength":1,"maxLength":200} | |
| $.requirements.allowedPurposes | false | array | {"minItems":1,"uniqueItems":true,"maxItems":100} | |
| $.requirements.allowedPurposes[] | false | string | {"minLength":1,"maxLength":300} | |
| $.onMissing | true | {"enum":["deny","review"]} | ||
| $.effectiveAt | true | string | {"format":"date-time"} | |
| $.status | true | {"enum":["active","inactive"]} |
PALO Data Lineage and Lifecycle Record
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","recordId","caseId","asset","origins","transformations","permissions","privacy","annotation","quality","uses","retention","deletion","owner","review"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-data-lineage-record"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.recordId | true | string | {} | |
| $.caseId | true | string | {} | |
| $.asset | true | object | {"required":["assetId","name","version","role","digest","materiality"],"additionalProperties":false} | |
| $.asset.assetId | true | string | {} | |
| $.asset.name | true | string | {} | |
| $.asset.version | true | string | {} | |
| $.asset.role | true | {"enum":["training","fine-tuning","evaluation","prompt","retrieval","embedding","operational-input","generated-output","derived","other"]} | ||
| $.asset.digest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.asset.materiality | true | {"enum":["low","moderate","high","critical"]} | ||
| $.origins | true | array | {"minItems":1} | |
| $.origins[] | false | object | {"required":["sourceId","sourceType","collectedAt","collector","geography"],"additionalProperties":false} | |
| $.origins[].sourceId | true | string | {} | |
| $.origins[].sourceType | true | {"enum":["first-party","licensed","open","public","synthetic","user-provided","vendor","unknown"]} | ||
| $.origins[].collectedAt | true | string | {"format":"date-time"} | |
| $.origins[].collector | true | string | {} | |
| $.origins[].geography | true | string | {} | |
| $.transformations | true | array | {} | |
| $.transformations[] | false | object | {"required":["stepId","operation","performedAt","toolVersion","outputDigest"],"additionalProperties":false} | |
| $.transformations[].stepId | true | string | {} | |
| $.transformations[].operation | true | string | {} | |
| $.transformations[].performedAt | true | string | {"format":"date-time"} | |
| $.transformations[].toolVersion | true | string | {} | |
| $.transformations[].outputDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.permissions | true | object | {"required":["basis","licenseOrTerms","permittedUses","prohibitedUses","reviewedBy"],"additionalProperties":false} | |
| $.permissions.basis | true | {"enum":["ownership","contract","license","consent","law","public-domain","undetermined"]} | ||
| $.permissions.licenseOrTerms | true | string | {} | |
| $.permissions.permittedUses | true | / #/$defs/strings | {} | |
| $.permissions.prohibitedUses | true | array | {} | |
| $.permissions.prohibitedUses[] | false | string | {} | |
| $.permissions.reviewedBy | true | string | {} | |
| $.privacy | true | object | {"required":["personalData","specialCategoryData","controllerOrProcessorRole","lawfulBasis","necessityAssessment","rightsRoute"],"additionalProperties":false} | |
| $.privacy.personalData | true | boolean | {} | |
| $.privacy.specialCategoryData | true | boolean | {} | |
| $.privacy.controllerOrProcessorRole | true | {"enum":["controller","joint-controller","processor","sub-processor","not-applicable","undetermined"]} | ||
| $.privacy.lawfulBasis | true | string | {} | |
| $.privacy.necessityAssessment | true | string | {} | |
| $.privacy.rightsRoute | true | string | {} | |
| $.annotation | true | object | {"required":["applicable","protocolRef","annotatorCompetenceRef","agreementMeasure","disputeRoute"],"additionalProperties":false} | |
| $.annotation.applicable | true | boolean | {} | |
| $.annotation.protocolRef | true | string | {} | |
| $.annotation.annotatorCompetenceRef | true | string | {} | |
| $.annotation.agreementMeasure | true | string | {} | |
| $.annotation.disputeRoute | true | string | {} | |
| $.quality | true | object | {"required":["dimensions","knownLimits","acceptedAt","acceptedBy"],"additionalProperties":false} | |
| $.quality.dimensions | true | array | {"minItems":1} | |
| $.quality.dimensions[] | false | object | {"required":["name","result","thresholdDecision"],"additionalProperties":false} | |
| $.quality.dimensions[].name | true | string | {} | |
| $.quality.dimensions[].result | true | string | {} | |
| $.quality.dimensions[].thresholdDecision | true | {"enum":["pass","conditional","fail"]} | ||
| $.quality.knownLimits | true | / #/$defs/strings | {} | |
| $.quality.acceptedAt | true | string | {"format":"date-time"} | |
| $.quality.acceptedBy | true | string | {} | |
| $.uses | true | array | {"minItems":1} | |
| $.uses[] | false | object | {"required":["systemVersion","purpose","approved"],"additionalProperties":false} | |
| $.uses[].systemVersion | true | string | {} | |
| $.uses[].purpose | true | string | {} | |
| $.uses[].approved | true | boolean | {} | |
| $.retention | true | object | {"required":["period","trigger","legalHoldRoute","nextReviewAt"],"additionalProperties":false} | |
| $.retention.period | true | string | {} | |
| $.retention.trigger | true | string | {} | |
| $.retention.legalHoldRoute | true | string | {} | |
| $.retention.nextReviewAt | true | string | {"format":"date-time"} | |
| $.deletion | true | object | {"required":["method","covers","verification","dueAt"],"additionalProperties":false} | |
| $.deletion.method | true | string | {} | |
| $.deletion.covers | true | / #/$defs/strings | {} | |
| $.deletion.verification | true | string | {} | |
| $.deletion.dueAt | true | string | {"format":"date-time"} | |
| $.owner | true | string | {} | |
| $.review | true | object | {"required":["status","reviewedAt","reviewedBy","validUntil"],"additionalProperties":false} | |
| $.review.status | true | {"enum":["accepted","conditional","rejected"]} | ||
| $.review.reviewedAt | true | string | {"format":"date-time"} | |
| $.review.reviewedBy | true | string | {} | |
| $.review.validUntil | true | string | {"format":"date-time"} | |
| $.$defs.strings | false | array | {"minItems":1,"uniqueItems":true} | |
| $.$defs.strings[] | false | string | {"minLength":1} |
PALO Decision Gates
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","status","updatedAt","disclaimer","gates"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-decision-gates"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.status | true | {"const":"educational-non-production"} | ||
| $.updatedAt | true | string | {"format":"date"} | |
| $.disclaimer | true | string | {"minLength":20} | |
| $.gates | true | array | {"minItems":1} | |
| $.gates[] | false | object | {"required":["gateId","label","purpose","entryCriteria","decisionOptions","requiredControlIds","conditionalControlIds","indicatorIds","sourceIds","templateIds"],"additionalProperties":false} | |
| $.gates[].gateId | true | {"enum":["frame","classify","assess","control","measure","prove"]} | ||
| $.gates[].label | true | string | {"minLength":1} | |
| $.gates[].purpose | true | string | {"minLength":1} | |
| $.gates[].entryCriteria | true | array | {"minItems":1} | |
| $.gates[].entryCriteria[] | false | string | {} | |
| $.gates[].decisionOptions | true | array | {"minItems":2,"uniqueItems":true} | |
| $.gates[].decisionOptions[] | false | {"enum":["proceed","proceed-with-conditions","hold","redesign","stop"]} | ||
| $.gates[].requiredControlIds | true | array | {"uniqueItems":true} | |
| $.gates[].requiredControlIds[] | false | string | {} | |
| $.gates[].conditionalControlIds | true | array | {"uniqueItems":true} | |
| $.gates[].conditionalControlIds[] | false | string | {} | |
| $.gates[].indicatorIds | true | array | {"uniqueItems":true} | |
| $.gates[].indicatorIds[] | false | string | {} | |
| $.gates[].sourceIds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.gates[].sourceIds[] | false | string | {} | |
| $.gates[].templateIds | true | array | {"uniqueItems":true} | |
| $.gates[].templateIds[] | false | string | {} |
PALO AI System Decommission Record
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","recordId","caseId","systemVersion","reason","plan","stakeholders","capabilityRevocation","dataDisposition","supplierExit","residualMonitoring","closureDecision"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-decommission-record"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.recordId | true | string | {} | |
| $.caseId | true | string | {} | |
| $.systemVersion | true | string | {} | |
| $.reason | true | string | {"minLength":20} | |
| $.plan | true | object | {"required":["owner","approvedAt","targetEndAt","rollbackWindow","dependencies"],"additionalProperties":false} | |
| $.plan.owner | true | string | {} | |
| $.plan.approvedAt | true | string | {"format":"date-time"} | |
| $.plan.targetEndAt | true | string | {"format":"date-time"} | |
| $.plan.rollbackWindow | true | string | {} | |
| $.plan.dependencies | true | array | {} | |
| $.plan.dependencies[] | false | string | {} | |
| $.stakeholders | true | array | {"minItems":1} | |
| $.stakeholders[] | false | object | {"required":["group","noticeAt","transitionRoute","supportOwner"],"additionalProperties":false} | |
| $.stakeholders[].group | true | string | {} | |
| $.stakeholders[].noticeAt | true | string | {"format":"date-time"} | |
| $.stakeholders[].transitionRoute | true | string | {} | |
| $.stakeholders[].supportOwner | true | string | {} | |
| $.capabilityRevocation | true | / #/$defs/closureCheck | {} | |
| $.dataDisposition | true | array | {"minItems":1} | |
| $.dataDisposition[] | false | object | {"required":["assetId","action","dueAt","verificationRef","status"],"additionalProperties":false} | |
| $.dataDisposition[].assetId | true | string | {} | |
| $.dataDisposition[].action | true | {"enum":["delete","archive","return","transfer","legal-hold","anonymize"]} | ||
| $.dataDisposition[].dueAt | true | string | {"format":"date-time"} | |
| $.dataDisposition[].verificationRef | true | string | {} | |
| $.dataDisposition[].status | true | {"enum":["planned","in-progress","verified-complete"]} | ||
| $.supplierExit | true | / #/$defs/closureCheck | {} | |
| $.residualMonitoring | true | object | {"required":["period","owner","indicators","reopenTriggers"],"additionalProperties":false} | |
| $.residualMonitoring.period | true | string | {} | |
| $.residualMonitoring.owner | true | string | {} | |
| $.residualMonitoring.indicators | true | array | {"minItems":1} | |
| $.residualMonitoring.indicators[] | false | string | {} | |
| $.residualMonitoring.reopenTriggers | true | array | {"minItems":1} | |
| $.residualMonitoring.reopenTriggers[] | false | string | {} | |
| $.closureDecision | true | object | {"required":["status","decidedAt","decidedBy","evidenceRefs"],"additionalProperties":false} | |
| $.closureDecision.status | true | {"enum":["conditional","closed","rejected"]} | ||
| $.closureDecision.decidedAt | true | string | {"format":"date-time"} | |
| $.closureDecision.decidedBy | true | string | {} | |
| $.closureDecision.evidenceRefs | true | array | {"minItems":1} | |
| $.closureDecision.evidenceRefs[] | false | string | {} | |
| $.$defs.closureCheck | false | object | {"required":["status","verifiedAt","verifiedBy","evidenceRef"],"additionalProperties":false} | |
| $.$defs.closureCheck.status | true | {"enum":["planned","in-progress","verified-complete","not-applicable"]} | ||
| $.$defs.closureCheck.verifiedAt | true | string | {"format":"date-time"} | |
| $.$defs.closureCheck.verifiedBy | true | string | {} | |
| $.$defs.closureCheck.evidenceRef | true | string | {} |
PALO scoped dependency and governance graph
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","extensionVersion","tenantId","snapshotAt","evidenceClass","authorityBoundary","nodes","edges"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-dependency-graph"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.extensionVersion | true | {"const":"0.1.0"} | ||
| $.tenantId | true | string | {"minLength":1} | |
| $.snapshotAt | true | string | {"format":"date-time"} | |
| $.evidenceClass | true | {"enum":["illustrative-local-preview","human-review-required"]} | ||
| $.authorityBoundary | true | string | {"minLength":1} | |
| $.nodes | true | array | {"minItems":1} | |
| $.nodes[] | false | object | {"required":["id","label","type","recordedAt","validFrom","sourceRefs","properties"],"additionalProperties":false} | |
| $.nodes[].id | true | string | {"pattern":"^[a-zA-Z0-9][a-zA-Z0-9:._-]{0,159}$"} | |
| $.nodes[].recordedAt | true | string | {"format":"date-time"} | |
| $.nodes[].validFrom | true | string | {"format":"date-time"} | |
| $.nodes[].validTo | false | string | {"format":"date-time"} | |
| $.nodes[].sourceRefs | true | array | {"uniqueItems":true} | |
| $.nodes[].sourceRefs[] | false | string | {"minLength":1} | |
| $.nodes[].label | true | string | {"minLength":1} | |
| $.nodes[].type | true | {"enum":["Layer","Capability","GovernancePlane","ComponentVersion","AISystemVersion","Agent","ModelVersion","Tool","DataAsset","Provider","Service","PublicPolicy","PolicyVersion","ChangeSignal","GovernanceCase","ApplicabilityAssessment","RequirementVersion","ControlDefinition","ControlImplementation","EvidenceArtifact","EvidenceClaim","EvidenceEvaluation","GateInstance","GateDecisionRecord","Actor"]} | ||
| $.nodes[].version | false | string | {"minLength":1} | |
| $.nodes[].canonicalRef | false | string | {"format":"uri"} | |
| $.nodes[].properties | true | object | {} | |
| $.edges | true | array | {} | |
| $.edges[] | false | object | {"required":["id","source","target","relation","recordedAt","validFrom","sourceRefs","reviewState","mappingBasis","evidenceRefs"],"additionalProperties":false} | |
| $.edges[].id | true | string | {"pattern":"^[a-zA-Z0-9][a-zA-Z0-9:._-]{0,159}$"} | |
| $.edges[].recordedAt | true | string | {"format":"date-time"} | |
| $.edges[].validFrom | true | string | {"format":"date-time"} | |
| $.edges[].validTo | false | string | {"format":"date-time"} | |
| $.edges[].sourceRefs | true | array | {"uniqueItems":true} | |
| $.edges[].sourceRefs[] | false | string | {"minLength":1} | |
| $.edges[].source | true | string | {"minLength":1} | |
| $.edges[].target | true | string | {"minLength":1} | |
| $.edges[].relation | true | {"enum":["PROVIDES_CAPABILITY","BELONGS_TO_LAYER","GOVERNS_LAYER","INFORMS","OFFERS","USES_SERVICE","DEPENDS_ON","USES_MODEL","CALLS_TOOL","READS","HAS_VERSION","FROM_VERSION","TO_VERSION","AFFECTS_SERVICE","GOVERNS_VERSION","ASSESSES_SIGNAL","ASSESSES_SYSTEM","IN_CASE","CONSIDERS_REQUIREMENT","REVIEWED_BY","IMPLEMENTS","ADDRESSES_REQUIREMENT","APPLIES_TO_SYSTEM","USES_ARTIFACT","SUPPORTS_TARGET","EVALUATES_CLAIM","REVIEWS_SYSTEM","DECISION_FOR_GATE","DECIDED_BY","BASED_ON_ASSESSMENT","SUPERSEDES"]} | ||
| $.edges[].reviewState | true | {"enum":["proposed","accepted","rejected"]} | ||
| $.edges[].mappingBasis | true | string | {"minLength":1} | |
| $.edges[].evidenceRefs | true | array | {"uniqueItems":true} | |
| $.edges[].evidenceRefs[] | false | string | {"minLength":1} |
PALO EU agentic review inventory; not an attestation
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"additionalProperties":false,"required":["format","profileVersion","sourceReviewDate","createdAt","status","system","controls","limitations"]} | |
| $.format | true | {"const":"palo-eu-agentic-review"} | ||
| $.profileVersion | true | {"const":"0.2.0"} | ||
| $.sourceReviewDate | true | {"const":"2026-09-22"} | ||
| $.createdAt | true | string | {"format":"date-time","pattern":"^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$"} | |
| $.status | true | {"const":"self-declared-review-not-certification"} | ||
| $.system | true | object | {"additionalProperties":false,"required":["name","owner","context","reviewer"]} | |
| $.system.name | true | string | {"minLength":1,"maxLength":4000,"pattern":"\\S"} | |
| $.system.owner | true | string | {"minLength":1,"maxLength":4000,"pattern":"\\S"} | |
| $.system.context | true | string | {"minLength":1,"maxLength":4000,"pattern":"\\S"} | |
| $.system.reviewer | true | string | {"minLength":1,"maxLength":4000,"pattern":"\\S"} | |
| $.controls | true | array | {"minItems":12,"maxItems":12} | |
| $.controls[] | false | object | {"additionalProperties":false,"required":["id","state","evidence","note","reviewer"]} | |
| $.controls[].id | true | {"enum":["DAG-01","DAG-02","DAG-03","DAG-04","DAG-05","DAG-06","DAG-07","DAG-08","DAG-09","DAG-10","DAG-11","DAG-12"]} | ||
| $.controls[].state | true | {"enum":["missing","claimed","reviewed","not-applicable"]} | ||
| $.controls[].evidence | true | string | {"maxLength":4000} | |
| $.controls[].note | true | string | {"maxLength":4000} | |
| $.controls[].reviewer | true | string | {"maxLength":4000} | |
| $.controls[].allOf[0] | false | {} | ||
| $.controls[].allOf[0].if | false | {} | ||
| $.controls[].allOf[0].if.state | false | {"const":"reviewed"} | ||
| $.controls[].allOf[0].then | false | {} | ||
| $.controls[].allOf[0].then.evidence | false | string | {"minLength":1,"maxLength":4000,"pattern":"\\S"} | |
| $.controls[].allOf[0].then.reviewer | false | string | {"minLength":1,"maxLength":4000,"pattern":"\\S"} | |
| $.controls[].allOf[1] | false | {} | ||
| $.controls[].allOf[1].if | false | {} | ||
| $.controls[].allOf[1].if.state | false | {"const":"not-applicable"} | ||
| $.controls[].allOf[1].then | false | {} | ||
| $.controls[].allOf[1].then.note | false | string | {"minLength":1,"maxLength":4000,"pattern":"\\S"} | |
| $.controls[].allOf[1].then.reviewer | false | string | {"minLength":1,"maxLength":4000,"pattern":"\\S"} | |
| $.controls.allOf[0] | false | {"minContains":1,"maxContains":1} | ||
| $.controls.allOf[0].contains | false | object | {"required":["id"]} | |
| $.controls.allOf[0].contains.id | true | {"const":"DAG-01"} | ||
| $.controls.allOf[1] | false | {"minContains":1,"maxContains":1} | ||
| $.controls.allOf[1].contains | false | object | {"required":["id"]} | |
| $.controls.allOf[1].contains.id | true | {"const":"DAG-02"} | ||
| $.controls.allOf[2] | false | {"minContains":1,"maxContains":1} | ||
| $.controls.allOf[2].contains | false | object | {"required":["id"]} | |
| $.controls.allOf[2].contains.id | true | {"const":"DAG-03"} | ||
| $.controls.allOf[3] | false | {"minContains":1,"maxContains":1} | ||
| $.controls.allOf[3].contains | false | object | {"required":["id"]} | |
| $.controls.allOf[3].contains.id | true | {"const":"DAG-04"} | ||
| $.controls.allOf[4] | false | {"minContains":1,"maxContains":1} | ||
| $.controls.allOf[4].contains | false | object | {"required":["id"]} | |
| $.controls.allOf[4].contains.id | true | {"const":"DAG-05"} | ||
| $.controls.allOf[5] | false | {"minContains":1,"maxContains":1} | ||
| $.controls.allOf[5].contains | false | object | {"required":["id"]} | |
| $.controls.allOf[5].contains.id | true | {"const":"DAG-06"} | ||
| $.controls.allOf[6] | false | {"minContains":1,"maxContains":1} | ||
| $.controls.allOf[6].contains | false | object | {"required":["id"]} | |
| $.controls.allOf[6].contains.id | true | {"const":"DAG-07"} | ||
| $.controls.allOf[7] | false | {"minContains":1,"maxContains":1} | ||
| $.controls.allOf[7].contains | false | object | {"required":["id"]} | |
| $.controls.allOf[7].contains.id | true | {"const":"DAG-08"} | ||
| $.controls.allOf[8] | false | {"minContains":1,"maxContains":1} | ||
| $.controls.allOf[8].contains | false | object | {"required":["id"]} | |
| $.controls.allOf[8].contains.id | true | {"const":"DAG-09"} | ||
| $.controls.allOf[9] | false | {"minContains":1,"maxContains":1} | ||
| $.controls.allOf[9].contains | false | object | {"required":["id"]} | |
| $.controls.allOf[9].contains.id | true | {"const":"DAG-10"} | ||
| $.controls.allOf[10] | false | {"minContains":1,"maxContains":1} | ||
| $.controls.allOf[10].contains | false | object | {"required":["id"]} | |
| $.controls.allOf[10].contains.id | true | {"const":"DAG-11"} | ||
| $.controls.allOf[11] | false | {"minContains":1,"maxContains":1} | ||
| $.controls.allOf[11].contains | false | object | {"required":["id"]} | |
| $.controls.allOf[11].contains.id | true | {"const":"DAG-12"} | ||
| $.limitations | true | {"const":"Inventory of reviewer declarations only. Evidence authenticity, adequacy, legal compliance and production readiness are not verified."} |
PALO Evidence Artifact
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","artifactId","caseId","artifactType","title","mediaType","recordedAt","contentDigest","storageReference","provenance","sensitivity","status"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-evidence-artifact"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.artifactId | true | string | {"pattern":"^evidence-artifact-[a-z0-9][a-z0-9-]{5,80}$"} | |
| $.caseId | true | string | {"pattern":"^case-[a-z0-9][a-z0-9-]{5,63}$"} | |
| $.artifactType | true | string | {"minLength":1} | |
| $.title | true | string | {"minLength":1} | |
| $.mediaType | true | string | {"pattern":"^[a-z0-9.+-]+/[a-z0-9.+-]+$"} | |
| $.recordedAt | true | string | {"format":"date-time"} | |
| $.contentDigest | true | / #/$defs/digest | {} | |
| $.storageReference | true | string | {"format":"uri"} | |
| $.provenance | true | object | {"required":["producerId","captureMethod","sourceSystem"],"additionalProperties":false} | |
| $.provenance.producerId | true | string | {"minLength":1} | |
| $.provenance.captureMethod | true | {"enum":["generated","exported","observed","uploaded","signed-receipt"]} | ||
| $.provenance.sourceSystem | true | string | {"minLength":1} | |
| $.sensitivity | true | {"enum":["public","internal","confidential","restricted"]} | ||
| $.status | true | {"enum":["draft","ready","verified","superseded","revoked"]} | ||
| $.$defs.digest | false | string | {"pattern":"^sha256:[a-f0-9]{64}$"} |
PALO Evidence Bundle Manifest
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","bundleId","caseId","assessmentRunId","generatedAt","lifecycleDefinitionRef","semanticReleaseManifestRef","semanticReleaseDigest","items","bundleDigest","authorityBoundary"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-evidence-bundle-manifest"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.bundleId | true | string | {"pattern":"^bundle-[a-z0-9][a-z0-9-]{5,63}$"} | |
| $.caseId | true | string | {"pattern":"^case-[a-z0-9][a-z0-9-]{5,63}$"} | |
| $.assessmentRunId | true | string | {"pattern":"^assessment-run-[a-z0-9][a-z0-9-]{5,80}$"} | |
| $.generatedAt | true | string | {"format":"date-time"} | |
| $.lifecycleDefinitionRef | true | string | {"format":"uri"} | |
| $.semanticReleaseManifestRef | true | string | {"minLength":1} | |
| $.semanticReleaseDigest | true | / #/$defs/digest | {} | |
| $.items | true | array | {"minItems":1} | |
| $.items[] | false | object | {"required":["itemType","recordId","recordDigest"],"additionalProperties":false} | |
| $.items[].itemType | true | {"enum":["evidence-artifact","evidence-claim","evidence-evaluation","gate-decision","metric-observation","source-record"]} | ||
| $.items[].recordId | true | string | {"minLength":1} | |
| $.items[].recordDigest | true | / #/$defs/digest | {} | |
| $.bundleDigest | true | / #/$defs/digest | {} | |
| $.authorityBoundary | true | string | {"minLength":1} | |
| $.$defs.digest | false | string | {"pattern":"^sha256:[a-f0-9]{64}$"} |
PALO Evidence Bundle
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","bundleId","generatedAt","artifacts","sourceRegistry","freshness"],"additionalProperties":true} | |
| $.format | true | {"const":"palo-evidence-bundle"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.bundleId | true | string | {"pattern":"^bundle-[a-z0-9][a-z0-9-]{5,63}$"} | |
| $.caseId | false | string | {"pattern":"^case-[a-z0-9][a-z0-9-]{5,63}$"} | |
| $.generatedAt | true | string | {"format":"date-time"} | |
| $.assessment | false | object | {} | |
| $.route | false | array | {} | |
| $.route[] | false | object | {} | |
| $.evidenceReadiness | false | object | {"additionalProperties":{"type":"boolean"}} | |
| $.evidenceReadiness.additionalProperties | false | boolean | {} | |
| $.artifacts | true | array | {} | |
| $.artifacts[] | false | object | {"required":["artifactId","title","kind","status"],"additionalProperties":true} | |
| $.artifacts[].artifactId | true | string | {"minLength":1} | |
| $.artifacts[].title | true | string | {"minLength":1} | |
| $.artifacts[].kind | true | string | {"minLength":1} | |
| $.artifacts[].status | true | {"enum":["open","draft","ready","verified","superseded"]} | ||
| $.artifacts[].content | false | {} | ||
| $.sourceRegistry | true | array | {} | |
| $.sourceRegistry[] | false | / palo-case-file.schema.json#/$defs/source | {} | |
| $.freshness | true | object | {"required":["evaluatedAt","status"],"additionalProperties":true} | |
| $.freshness.evaluatedAt | true | string | {"format":"date-time"} | |
| $.freshness.status | true | {"enum":["current","review-due","stale","unknown"]} | ||
| $.disclaimer | false | string | {} |
PALO Atomic Evidence Claim
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","claimId","artifactId","target","scope","statement","integrityReference","createdAt","status","appendOnly"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-evidence-claim"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.claimId | true | string | {"pattern":"^evidence-claim-[a-z0-9][a-z0-9-]{5,80}$"} | |
| $.artifactId | true | string | {"pattern":"^evidence-artifact-[a-z0-9][a-z0-9-]{5,80}$"} | |
| $.target | true | object | {"required":["targetType","targetId"],"additionalProperties":false} | |
| $.target.targetType | true | {"enum":["gate-instance","control-implementation","metric-observation","decision-record","assessment-run","agentic-execution"]} | ||
| $.target.targetId | true | string | {"minLength":1} | |
| $.scope | true | object | {"required":["caseId","validFrom"],"additionalProperties":false} | |
| $.scope.caseId | true | string | {"pattern":"^case-[a-z0-9][a-z0-9-]{5,63}$"} | |
| $.scope.validFrom | true | string | {"format":"date-time"} | |
| $.scope.validTo | false | string | {"format":"date-time"} | |
| $.statement | true | string | {"minLength":1} | |
| $.integrityReference | true | / #/$defs/digest | {} | |
| $.createdAt | true | string | {"format":"date-time"} | |
| $.status | true | {"enum":["asserted","under-review","accepted","rejected","superseded"]} | ||
| $.supersedesClaimId | false | string | {"pattern":"^evidence-claim-[a-z0-9][a-z0-9-]{5,80}$"} | |
| $.appendOnly | true | {"const":true} | ||
| $.$defs.digest | false | string | {"pattern":"^sha256:[a-f0-9]{64}$"} |
PALO Evidence Evaluation
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","evaluationId","claimId","assessmentRunId","evaluator","evaluatedAt","outcome","quality","rationale","inputClaimDigest","recordDigest","appendOnly"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-evidence-evaluation"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.evaluationId | true | string | {"pattern":"^evidence-evaluation-[a-z0-9][a-z0-9-]{5,80}$"} | |
| $.claimId | true | string | {"pattern":"^evidence-claim-[a-z0-9][a-z0-9-]{5,80}$"} | |
| $.assessmentRunId | true | string | {"pattern":"^assessment-run-[a-z0-9][a-z0-9-]{5,80}$"} | |
| $.evaluator | true | object | {"required":["actorId","role"],"additionalProperties":false} | |
| $.evaluator.actorId | true | string | {"minLength":1} | |
| $.evaluator.role | true | string | {"minLength":1} | |
| $.evaluatedAt | true | string | {"format":"date-time"} | |
| $.outcome | true | {"enum":["sufficient","partial","insufficient","unverified"]} | ||
| $.quality | true | object | {"required":["relevance","integrity","recency","independence"],"additionalProperties":false} | |
| $.quality.relevance | true | / #/$defs/score | {} | |
| $.quality.integrity | true | / #/$defs/score | {} | |
| $.quality.recency | true | / #/$defs/score | {} | |
| $.quality.independence | true | / #/$defs/score | {} | |
| $.rationale | true | string | {"minLength":1} | |
| $.inputClaimDigest | true | / #/$defs/digest | {} | |
| $.recordDigest | true | / #/$defs/digest | {} | |
| $.appendOnly | true | {"const":true} | ||
| $.$defs.score | false | number | {"minimum":0,"maximum":1} | |
| $.$defs.digest | false | string | {"pattern":"^sha256:[a-f0-9]{64}$"} |
PALO External Agentic Evidence Collection
Metadata-minimized external observations that can inform, but never replace, a PALO use-case assessment.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","providerId","retrievedAt","sourcePayloadDigest","signals","ingestion","boundary","collectionDigest"],"additionalProperties":false} | Metadata-minimized external observations that can inform, but never replace, a PALO use-case assessment. |
| $.format | true | {"const":"palo-external-agentic-evidence-collection"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.providerId | true | string | {"pattern":"^[a-z][a-z0-9-]{2,63}$"} | |
| $.retrievedAt | true | string | {"format":"date-time"} | |
| $.sourcePayloadDigest | true | / #/$defs/digest | {} | |
| $.signals | true | array | {"maxItems":1000} | |
| $.signals[] | false | / #/$defs/signal | {} | |
| $.ingestion | true | object | {"required":["received","accepted","deduplicated","skipped"],"additionalProperties":false} | |
| $.ingestion.received | true | integer | {"minimum":0} | |
| $.ingestion.accepted | true | integer | {"minimum":0} | |
| $.ingestion.deduplicated | true | integer | {"minimum":0} | |
| $.ingestion.skipped | true | integer | {"minimum":0} | |
| $.boundary | true | / #/$defs/boundary | {} | |
| $.collectionDigest | true | / #/$defs/digest | {} | |
| $.$defs.digest | false | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.$defs.boundary | false | object | {"required":["externalCapabilityEvidence","notUseCaseRiskScore","requiresLocalAssessment","networkOptional"],"additionalProperties":false} | |
| $.$defs.boundary.externalCapabilityEvidence | true | {"const":true} | ||
| $.$defs.boundary.notUseCaseRiskScore | true | {"const":true} | ||
| $.$defs.boundary.requiresLocalAssessment | true | {"const":true} | ||
| $.$defs.boundary.networkOptional | true | {"const":true} | ||
| $.$defs.signal | false | object | {"required":["signalId","externalId","provider","title","canonicalUrl","observedContext","capabilityObservations","provenance","review","confidence","retrievedAt","signalDigest","boundary"],"additionalProperties":false} | |
| $.$defs.signal.signalId | true | string | {"pattern":"^eas-[a-f0-9]{64}$"} | |
| $.$defs.signal.externalId | true | string | {"minLength":1,"maxLength":500} | |
| $.$defs.signal.provider | true | object | {"required":["providerId","adapterVersion","contractVersion"],"additionalProperties":false} | |
| $.$defs.signal.provider.providerId | true | string | {"pattern":"^[a-z][a-z0-9-]{2,63}$"} | |
| $.$defs.signal.provider.adapterVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+$"} | |
| $.$defs.signal.provider.contractVersion | true | {"const":"1.0.0"} | ||
| $.$defs.signal.title | true | string | {"minLength":1,"maxLength":300} | |
| $.$defs.signal.canonicalUrl | true | string | {"format":"uri","pattern":"^https://"} | |
| $.$defs.signal.observedContext | true | object | {"required":["setting","agency"],"additionalProperties":false} | |
| $.$defs.signal.observedContext.eventAt | false | string | {"format":"date-time"} | |
| $.$defs.signal.observedContext.publishedAt | false | string | {"format":"date-time"} | |
| $.$defs.signal.observedContext.setting | true | {"enum":["laboratory","field","mixed","unknown"]} | ||
| $.$defs.signal.observedContext.agency | true | {"enum":["human-directed","agent-initiated","mixed","unknown"]} | ||
| $.$defs.signal.capabilityObservations | true | array | {"minItems":1,"maxItems":32} | |
| $.$defs.signal.capabilityObservations[] | false | / #/$defs/capabilityObservation | {} | |
| $.$defs.signal.provenance | true | object | {"required":["retrievalDigest","sources"],"additionalProperties":false} | |
| $.$defs.signal.provenance.retrievalDigest | true | / #/$defs/digest | {} | |
| $.$defs.signal.provenance.sources | true | array | {"minItems":1,"maxItems":20} | |
| $.$defs.signal.provenance.sources[] | false | object | {"required":["name","url","role"],"additionalProperties":false} | |
| $.$defs.signal.provenance.sources[].name | true | string | {"minLength":1,"maxLength":200} | |
| $.$defs.signal.provenance.sources[].url | true | string | {"format":"uri","pattern":"^https://"} | |
| $.$defs.signal.provenance.sources[].role | true | {"enum":["primary","supporting"]} | ||
| $.$defs.signal.provenance.sources[].publishedAt | false | string | {"format":"date-time"} | |
| $.$defs.signal.review | true | object | {"required":["reviewState","providerReviewState"],"additionalProperties":false} | |
| $.$defs.signal.review.reviewState | true | {"enum":["unreviewed","in-review","reviewed","rejected","superseded"]} | ||
| $.$defs.signal.review.providerReviewState | true | string | {"minLength":1,"maxLength":80} | |
| $.$defs.signal.confidence | true | object | {"required":["state","basis"],"additionalProperties":false} | |
| $.$defs.signal.confidence.state | true | {"enum":["not-assessed","low","moderate","high"]} | ||
| $.$defs.signal.confidence.basis | true | string | {"minLength":20,"maxLength":500} | |
| $.$defs.signal.retrievedAt | true | string | {"format":"date-time"} | |
| $.$defs.signal.signalDigest | true | / #/$defs/digest | {} | |
| $.$defs.signal.boundary | true | / #/$defs/boundary | {} | |
| $.$defs.capabilityObservation | false | object | {"required":["observationId","paloCapabilityId","providerCapabilityId","providerLabel","providerScore","providerScale","providerRubricVersion","mappingVersion","mappingReviewState","contextOnly","notUseCaseRiskScore"],"additionalProperties":false} | |
| $.$defs.capabilityObservation.observationId | true | string | {"pattern":"^eao-[a-f0-9]{64}$"} | |
| $.$defs.capabilityObservation.paloCapabilityId | true | string | {"pattern":"^palo-cap-[a-z0-9-]+$"} | |
| $.$defs.capabilityObservation.providerCapabilityId | true | string | {"minLength":1,"maxLength":120} | |
| $.$defs.capabilityObservation.providerLabel | true | string | {"minLength":1,"maxLength":160} | |
| $.$defs.capabilityObservation.providerScore | true | number | {} | |
| $.$defs.capabilityObservation.providerScale | true | object | {"required":["minimum","maximum"],"additionalProperties":false} | |
| $.$defs.capabilityObservation.providerScale.minimum | true | number | {} | |
| $.$defs.capabilityObservation.providerScale.maximum | true | number | {} | |
| $.$defs.capabilityObservation.providerRubricVersion | true | string | {"minLength":1,"maxLength":100} | |
| $.$defs.capabilityObservation.mappingVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+$"} | |
| $.$defs.capabilityObservation.mappingReviewState | true | {"enum":["draft","in-review","approved","rejected","superseded"]} | ||
| $.$defs.capabilityObservation.contextOnly | true | {"const":true} | ||
| $.$defs.capabilityObservation.notUseCaseRiskScore | true | {"const":true} |
PALO External Agentic Evidence Provider Registry
Provider-neutral registry for optional, read-only external agentic evidence adapters.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","updatedAt","authorityBoundary","providers"],"additionalProperties":false} | Provider-neutral registry for optional, read-only external agentic evidence adapters. |
| $.format | true | {"const":"palo-external-evidence-provider-registry"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.updatedAt | true | string | {"format":"date"} | |
| $.authorityBoundary | true | string | {"minLength":40} | |
| $.providers | true | array | {"minItems":1} | |
| $.providers[] | false | / #/$defs/provider | {} | |
| $.$defs.provider | false | object | {"required":["providerId","displayName","sourceId","adapter","mode","defaultState","networkOptional","dataPolicy","reviewBoundary"],"additionalProperties":false} | |
| $.$defs.provider.providerId | true | string | {"pattern":"^[a-z][a-z0-9-]{2,63}$"} | |
| $.$defs.provider.displayName | true | string | {"minLength":1,"maxLength":120} | |
| $.$defs.provider.sourceId | true | string | {"pattern":"^src-[a-z0-9-]+$"} | |
| $.$defs.provider.adapter | true | object | {"required":["adapterId","adapterVersion","contractVersion"],"additionalProperties":false} | |
| $.$defs.provider.adapter.adapterId | true | string | {"pattern":"^adapter-[a-z0-9-]+$"} | |
| $.$defs.provider.adapter.adapterVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+$"} | |
| $.$defs.provider.adapter.contractVersion | true | {"const":"1.0.0"} | ||
| $.$defs.provider.mode | true | {"enum":["local-import","http-pull"]} | ||
| $.$defs.provider.defaultState | true | {"enum":["enabled","disabled"]} | ||
| $.$defs.provider.networkOptional | true | {"const":true} | ||
| $.$defs.provider.endpoint | false | string | {"format":"uri","pattern":"^https://"} | |
| $.$defs.provider.fetchPolicy | false | object | {"required":["timeoutMs","maxResponseBytes","maxRecords","redirects"],"additionalProperties":false} | |
| $.$defs.provider.fetchPolicy.timeoutMs | true | integer | {"minimum":500,"maximum":30000} | |
| $.$defs.provider.fetchPolicy.maxResponseBytes | true | integer | {"minimum":1024,"maximum":5242880} | |
| $.$defs.provider.fetchPolicy.maxRecords | true | integer | {"minimum":1,"maximum":1000} | |
| $.$defs.provider.fetchPolicy.redirects | true | {"const":"reject"} | ||
| $.$defs.provider.cachePolicy | false | object | {"required":["content","ttlSeconds","maxStaleSeconds","staleIfError","rawPayloadStored"],"additionalProperties":false} | |
| $.$defs.provider.cachePolicy.content | true | {"const":"normalized-metadata-only"} | ||
| $.$defs.provider.cachePolicy.ttlSeconds | true | integer | {"minimum":60,"maximum":2592000} | |
| $.$defs.provider.cachePolicy.maxStaleSeconds | true | integer | {"minimum":60,"maximum":7776000} | |
| $.$defs.provider.cachePolicy.staleIfError | true | boolean | {} | |
| $.$defs.provider.cachePolicy.rawPayloadStored | true | {"const":false} | ||
| $.$defs.provider.dataPolicy | true | object | {"required":["metadataOnly","prohibitedFields"],"additionalProperties":false} | |
| $.$defs.provider.dataPolicy.metadataOnly | true | {"const":true} | ||
| $.$defs.provider.dataPolicy.prohibitedFields | true | array | {"minItems":5,"uniqueItems":true} | |
| $.$defs.provider.dataPolicy.prohibitedFields[] | false | {"enum":["fullText","sourceBody","details","summary","whyItMatters","justificationText"]} | ||
| $.$defs.provider.reviewBoundary | true | string | {"minLength":30} | |
| $.$defs.provider.allOf[0] | false | {} | ||
| $.$defs.provider.allOf[0].if | false | {} | ||
| $.$defs.provider.allOf[0].if.mode | false | {"const":"http-pull"} | ||
| $.$defs.provider.allOf[0].then | false | {"required":["endpoint","fetchPolicy","cachePolicy"]} |
PALO External Evidence Reference
Immutable, payload-minimized reference to context asserted by an external catalog, observability, identity or source system.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","evidenceRefId","tenantId","subject","source","evidenceType","normalizedClaims","observedAt","validUntil","payloadDigest","authority","connector","status"],"additionalProperties":false} | Immutable, payload-minimized reference to context asserted by an external catalog, observability, identity or source system. |
| $.format | true | {"const":"palo-external-evidence-ref"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.evidenceRefId | true | string | {"pattern":"^evidence-ref-[a-f0-9-]{36}$"} | |
| $.tenantId | true | string | {"minLength":1,"maxLength":128} | |
| $.subject | true | / #/$defs/subject | {} | |
| $.source | true | object | {"required":["system","objectId"],"additionalProperties":false} | |
| $.source.system | true | string | {"minLength":1,"maxLength":100} | |
| $.source.objectId | true | string | {"minLength":1,"maxLength":1000} | |
| $.source.objectVersion | false | string | {"minLength":1,"maxLength":500} | |
| $.source.uri | false | string | {"format":"uri","maxLength":2000} | |
| $.evidenceType | true | {"enum":["metadata","lineage","quality","classification","ownership","access","data-contract","audit","incident","other"]} | ||
| $.normalizedClaims | true | object | {"minProperties":1,"additionalProperties":false} | |
| $.normalizedClaims.qualityScore | false | number | {"minimum":0,"maximum":100} | |
| $.normalizedClaims.freshnessAt | false | string | {"format":"date-time"} | |
| $.normalizedClaims.classifications | false | array | {"uniqueItems":true,"maxItems":100} | |
| $.normalizedClaims.classifications[] | false | string | {"minLength":1,"maxLength":200} | |
| $.normalizedClaims.owner | false | string | {"minLength":1,"maxLength":500} | |
| $.normalizedClaims.approved | false | boolean | {} | |
| $.normalizedClaims.accessState | false | {"enum":["granted","requested","denied","revoked","unknown"]} | ||
| $.normalizedClaims.lineageComplete | false | boolean | {} | |
| $.normalizedClaims.permittedPurposes | false | array | {"uniqueItems":true,"maxItems":100} | |
| $.normalizedClaims.permittedPurposes[] | false | string | {"minLength":1,"maxLength":300} | |
| $.normalizedClaims.lifecycleState | false | string | {"minLength":1,"maxLength":100} | |
| $.normalizedClaims.incidentOpen | false | boolean | {} | |
| $.normalizedClaims.contractVersion | false | string | {"minLength":1,"maxLength":100} | |
| $.normalizedClaims.additionalClaimsDigest | false | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.observedAt | true | string | {"format":"date-time"} | |
| $.validUntil | true | string | {"format":"date-time"} | |
| $.payloadDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.authority | true | object | {"required":["type","assertedBy","verified"],"additionalProperties":false} | |
| $.authority.type | true | {"enum":["source-api","catalog-api","observability-api","identity-api","signed-import","manual-attestation"]} | ||
| $.authority.assertedBy | true | string | {"minLength":1,"maxLength":500} | |
| $.authority.verified | true | boolean | {} | |
| $.connector | true | object | {"required":["connectorId","version","mode","importedAt"],"additionalProperties":false} | |
| $.connector.connectorId | true | string | {"pattern":"^connector-[a-zA-Z0-9][a-zA-Z0-9._-]{2,100}$"} | |
| $.connector.version | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$"} | |
| $.connector.mode | true | {"const":"read-only"} | ||
| $.connector.importedAt | true | string | {"format":"date-time"} | |
| $.status | true | {"enum":["active","revoked"]} | ||
| $.$defs.subject | false | object | {"required":["type","id"],"additionalProperties":false} | |
| $.$defs.subject.type | true | {"enum":["dataset","data-product","model","ai-system","agent","tool","access-entitlement","other"]} | ||
| $.$defs.subject.id | true | string | {"minLength":1,"maxLength":1000} |
PALO Append-Only Gate Decision Record
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","decisionId","gateInstanceId","caseId","sequence","outcome","decidedAt","decisionActor","authorityBasis","rationale","conditions","inputSnapshotHash","definitionRefs","evidenceClaimIds","recordDigest","appendOnly"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-gate-decision-record"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.decisionId | true | string | {"pattern":"^gate-decision-[a-z0-9][a-z0-9-]{5,80}$"} | |
| $.gateInstanceId | true | string | {"pattern":"^gate-instance-[a-z0-9][a-z0-9-]{5,80}$"} | |
| $.caseId | true | string | {"pattern":"^case-[a-z0-9][a-z0-9-]{5,63}$"} | |
| $.sequence | true | integer | {"minimum":1} | |
| $.supersedesDecisionId | false | string | {"pattern":"^gate-decision-[a-z0-9][a-z0-9-]{5,80}$"} | |
| $.previousDecisionDigest | false | / #/$defs/digest | {} | |
| $.outcome | true | {"enum":["proceed","proceed-with-conditions","hold","redesign","stop","unresolved"]} | ||
| $.decidedAt | true | string | {"format":"date-time"} | |
| $.expiresAt | false | string | {"format":"date-time"} | |
| $.decisionActor | true | object | {"required":["actorId","role","displayName"],"additionalProperties":false} | |
| $.decisionActor.actorId | true | string | {"minLength":1} | |
| $.decisionActor.role | true | string | {"minLength":1} | |
| $.decisionActor.displayName | true | string | {"minLength":1} | |
| $.authorityBasis | true | string | {"minLength":1} | |
| $.rationale | true | string | {"minLength":1} | |
| $.conditions | true | array | {} | |
| $.conditions[] | false | string | {} | |
| $.inputSnapshotHash | true | / #/$defs/digest | {} | |
| $.definitionRefs | true | array | {"minItems":1,"uniqueItems":true} | |
| $.definitionRefs[] | false | string | {"format":"uri"} | |
| $.evidenceClaimIds | true | array | {"uniqueItems":true} | |
| $.evidenceClaimIds[] | false | string | {} | |
| $.recordDigest | true | / #/$defs/digest | {} | |
| $.appendOnly | true | {"const":true} | ||
| $.$defs.digest | false | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.allOf[0] | false | {} | ||
| $.allOf[0].if | false | {"required":["sequence"]} | ||
| $.allOf[0].if.sequence | true | integer | {"minimum":2} | |
| $.allOf[0].then | false | {"required":["supersedesDecisionId","previousDecisionDigest"]} | ||
| $.allOf[0].then.supersedesDecisionId | true | string | {"pattern":"^gate-decision-[a-z0-9][a-z0-9-]{5,80}$"} | |
| $.allOf[0].then.previousDecisionDigest | true | / #/$defs/digest | {} | |
| $.allOf[1] | false | {} | ||
| $.allOf[1].if | false | {"required":["outcome"]} | ||
| $.allOf[1].if.outcome | true | {"const":"proceed-with-conditions"} | ||
| $.allOf[1].then | false | {} | ||
| $.allOf[1].then.conditions | false | array | {"minItems":1} |
PALO Gate Instance
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","gateInstanceId","caseId","lifecycleDefinitionRef","gateDefinitionRef","phaseDefinitionRef","openedAt","status","currentDecisionSequence"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-gate-instance"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.gateInstanceId | true | string | {"pattern":"^gate-instance-[a-z0-9][a-z0-9-]{5,80}$"} | |
| $.caseId | true | string | {"pattern":"^case-[a-z0-9][a-z0-9-]{5,63}$"} | |
| $.lifecycleDefinitionRef | true | string | {"format":"uri"} | |
| $.gateDefinitionRef | true | string | {"format":"uri"} | |
| $.phaseDefinitionRef | true | string | {"format":"uri"} | |
| $.openedAt | true | string | {"format":"date-time"} | |
| $.closedAt | false | string | {"format":"date-time"} | |
| $.status | true | {"enum":["not-started","open","ready-for-review","decided","reopened","closed"]} | ||
| $.currentDecisionSequence | true | integer | {"minimum":0} | |
| $.reopenedBy | false | array | {"uniqueItems":true} | |
| $.reopenedBy[] | false | string | {} |
PALO Governance Assurance Record
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","recordId","caseId","domainId","systemVersion","applicability","applicabilityRationale","controlIds","owner","status","evidenceItems","measurements","findings","authorityBoundary"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-governance-assurance-record"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.recordId | true | string | {"pattern":"^assurance-[a-zA-Z0-9._-]+$"} | |
| $.caseId | true | string | {"minLength":1} | |
| $.domainId | true | {"enum":["domain-fairness-subgroups","domain-system-card-explanations","domain-notice-appeal-remedy","domain-article50-transparency","domain-data-lifecycle","domain-gpai-systemic-risk","domain-serious-incident-decommissioning","domain-accessibility","domain-environment","domain-ai-literacy","domain-iso42001-aims","domain-palo-ai-production"]} | ||
| $.systemVersion | true | string | {"minLength":1} | |
| $.applicability | true | {"enum":["applicable","not-applicable","undetermined"]} | ||
| $.applicabilityRationale | true | string | {"minLength":20} | |
| $.controlIds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.controlIds[] | false | string | {"pattern":"^ctrl-[a-z0-9-]+$"} | |
| $.owner | true | / #/$defs/actor | {} | |
| $.status | true | {"enum":["draft","in-review","accepted","rejected","expired"]} | ||
| $.evidenceItems | true | array | {} | |
| $.evidenceItems[] | false | / #/$defs/evidenceItem | {} | |
| $.measurements | true | array | {} | |
| $.measurements[] | false | / #/$defs/measurement | {} | |
| $.findings | true | array | {} | |
| $.findings[] | false | / #/$defs/finding | {} | |
| $.gateDecisionRef | false | string | {"minLength":1} | |
| $.reviewedAt | false | string | {"format":"date-time"} | |
| $.reviewedBy | false | / #/$defs/actor | {} | |
| $.validUntil | false | string | {"format":"date-time"} | |
| $.authorityBoundary | true | string | {"minLength":30} | |
| $.$defs.actor | false | object | {"required":["actorId","role"],"additionalProperties":false} | |
| $.$defs.actor.actorId | true | string | {"minLength":1} | |
| $.$defs.actor.role | true | string | {"minLength":1} | |
| $.$defs.actor.independenceStatement | false | string | {"minLength":10} | |
| $.$defs.evidenceItem | false | object | {"required":["evidenceId","kind","artifactRef","sha256","capturedAt","evaluation"],"additionalProperties":false} | |
| $.$defs.evidenceItem.evidenceId | true | string | {"minLength":1} | |
| $.$defs.evidenceItem.kind | true | string | {"pattern":"^[a-z0-9-]+$"} | |
| $.$defs.evidenceItem.artifactRef | true | string | {"minLength":1} | |
| $.$defs.evidenceItem.sha256 | true | string | {"pattern":"^[a-f0-9]{64}$"} | |
| $.$defs.evidenceItem.capturedAt | true | string | {"format":"date-time"} | |
| $.$defs.evidenceItem.evaluation | true | {"enum":["accepted","conditional","rejected","not-evaluated"]} | ||
| $.$defs.measurement | false | object | {"required":["indicatorId","observedValue","thresholdDecision","measuredAt"],"additionalProperties":false} | |
| $.$defs.measurement.indicatorId | true | string | {"pattern":"^(kpi|kri)-[a-z0-9-]+$"} | |
| $.$defs.measurement.observedValue | true | {} | ||
| $.$defs.measurement.observedValue.oneOf[0] | false | number | {} | |
| $.$defs.measurement.observedValue.oneOf[1] | false | string | {"minLength":1} | |
| $.$defs.measurement.thresholdDecision | true | {"enum":["pass","conditional","fail","not-established"]} | ||
| $.$defs.measurement.measuredAt | true | string | {"format":"date-time"} | |
| $.$defs.finding | false | object | {"required":["findingId","severity","description","status","actionOwner","dueAt"],"additionalProperties":false} | |
| $.$defs.finding.findingId | true | string | {"minLength":1} | |
| $.$defs.finding.severity | true | {"enum":["low","moderate","high","critical"]} | ||
| $.$defs.finding.description | true | string | {"minLength":10} | |
| $.$defs.finding.status | true | {"enum":["open","accepted-risk","remediated","verified-closed"]} | ||
| $.$defs.finding.actionOwner | true | string | {"minLength":1} | |
| $.$defs.finding.dueAt | true | string | {"format":"date-time"} | |
| $.allOf[0] | false | {} | ||
| $.allOf[0].if | false | {"required":["applicability"]} | ||
| $.allOf[0].if.applicability | true | {"const":"applicable"} | ||
| $.allOf[0].then | false | {} | ||
| $.allOf[0].then.evidenceItems | false | array | {"minItems":1} | |
| $.allOf[0].then.measurements | false | array | {"minItems":1} | |
| $.allOf[1] | false | {} | ||
| $.allOf[1].if | false | {"required":["status"]} | ||
| $.allOf[1].if.status | true | {"const":"accepted"} | ||
| $.allOf[1].then | false | {"required":["gateDecisionRef","reviewedAt","reviewedBy","validUntil"]} | ||
| $.allOf[1].then.gateDecisionRef | true | string | {"minLength":1} | |
| $.allOf[1].then.reviewedAt | true | string | {"format":"date-time"} | |
| $.allOf[1].then.reviewedBy | true | / #/$defs/actor | {} | |
| $.allOf[1].then.validUntil | true | string | {"format":"date-time"} |
PALO Governance Control Packs
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","releaseVersion","status","updatedAt","authorityBoundary","completionDefinitions","domains"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-governance-control-packs"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.releaseVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+$"} | |
| $.status | true | {"const":"approved-for-release"} | ||
| $.updatedAt | true | string | {"format":"date"} | |
| $.authorityBoundary | true | string | {"minLength":40} | |
| $.completionDefinitions | true | object | {"required":["governanceComplete","operationalComplete","productionComplete","certificationComplete"],"additionalProperties":false} | |
| $.completionDefinitions.governanceComplete | true | string | {"minLength":40} | |
| $.completionDefinitions.operationalComplete | true | string | {"minLength":40} | |
| $.completionDefinitions.productionComplete | true | string | {"minLength":40} | |
| $.completionDefinitions.certificationComplete | true | string | {"minLength":40} | |
| $.domains | true | array | {"minItems":12,"uniqueItems":true} | |
| $.domains[] | false | object | {"required":["domainId","title","objective","completionLevel","applicabilityQuestions","controlIds","indicatorIds","gateIds","evidenceContractRefs","minimumEvidenceKinds","completionCriteria","stopConditions","residualBoundary"],"additionalProperties":false} | |
| $.domains[].domainId | true | string | {"pattern":"^domain-[a-z0-9-]+$"} | |
| $.domains[].title | true | string | {"minLength":1} | |
| $.domains[].objective | true | string | {"minLength":20} | |
| $.domains[].completionLevel | true | {"enum":["governance-control-plane","reference-runtime-only"]} | ||
| $.domains[].applicabilityQuestions | true | array | {"minItems":1,"uniqueItems":true} | |
| $.domains[].applicabilityQuestions[] | false | string | {"minLength":10} | |
| $.domains[].controlIds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.domains[].controlIds[] | false | string | {"pattern":"^ctrl-[a-z0-9-]+$"} | |
| $.domains[].indicatorIds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.domains[].indicatorIds[] | false | string | {"pattern":"^(kpi|kri)-[a-z0-9-]+$"} | |
| $.domains[].gateIds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.domains[].gateIds[] | false | {"enum":["frame","classify","assess","control","measure","prove"]} | ||
| $.domains[].evidenceContractRefs | true | array | {"minItems":1,"uniqueItems":true} | |
| $.domains[].evidenceContractRefs[] | false | string | {"pattern":"^schemas/[a-z0-9-]+\\.schema\\.json$"} | |
| $.domains[].minimumEvidenceKinds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.domains[].minimumEvidenceKinds[] | false | string | {"pattern":"^[a-z0-9-]+$"} | |
| $.domains[].completionCriteria | true | array | {"minItems":2,"uniqueItems":true} | |
| $.domains[].completionCriteria[] | false | string | {"minLength":15} | |
| $.domains[].stopConditions | true | array | {"minItems":1,"uniqueItems":true} | |
| $.domains[].stopConditions[] | false | string | {"minLength":15} | |
| $.domains[].residualBoundary | true | string | {"minLength":30} |
PALO GPAI and Systemic-Risk Record
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","recordId","caseId","model","roleAssessment","providerObligations","deployerControls","systemicRisk","incidents","review"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-gpai-systemic-risk-record"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.recordId | true | string | {} | |
| $.caseId | true | string | {} | |
| $.model | true | object | {"required":["modelId","provider","version","releaseDate","componentInventoryRef"],"additionalProperties":false} | |
| $.model.modelId | true | string | {} | |
| $.model.provider | true | string | {} | |
| $.model.version | true | string | {} | |
| $.model.releaseDate | true | string | {"format":"date"} | |
| $.model.componentInventoryRef | true | string | {} | |
| $.roleAssessment | true | object | {"required":["roles","materialModification","systemicRiskStatus","legalReviewRef"],"additionalProperties":false} | |
| $.roleAssessment.roles | true | array | {"minItems":1,"uniqueItems":true} | |
| $.roleAssessment.roles[] | false | {"enum":["provider","downstream-provider","deployer","importer","distributor"]} | ||
| $.roleAssessment.materialModification | true | boolean | {} | |
| $.roleAssessment.systemicRiskStatus | true | {"enum":["designated","presumed","not-designated","undetermined"]} | ||
| $.roleAssessment.legalReviewRef | true | string | {} | |
| $.providerObligations | true | array | {} | |
| $.providerObligations[] | false | / #/$defs/obligation | {} | |
| $.deployerControls | true | array | {} | |
| $.deployerControls[] | false | / #/$defs/obligation | {} | |
| $.systemicRisk | true | object | {"required":["scenarios","evaluations","mitigations","residualFindings","modelReportingRoute"],"additionalProperties":false} | |
| $.systemicRisk.scenarios | true | / #/$defs/strings | {} | |
| $.systemicRisk.evaluations | true | / #/$defs/strings | {} | |
| $.systemicRisk.mitigations | true | / #/$defs/strings | {} | |
| $.systemicRisk.residualFindings | true | array | {} | |
| $.systemicRisk.residualFindings[] | false | string | {} | |
| $.systemicRisk.modelReportingRoute | true | string | {} | |
| $.incidents | true | object | {"required":["providerRoute","authorityRoute","sharingProtocol"],"additionalProperties":false} | |
| $.incidents.providerRoute | true | string | {} | |
| $.incidents.authorityRoute | true | string | {} | |
| $.incidents.sharingProtocol | true | string | {} | |
| $.review | true | object | {"required":["status","reviewedAt","reviewedBy","validUntil"],"additionalProperties":false} | |
| $.review.status | true | {"enum":["accepted","conditional","rejected"]} | ||
| $.review.reviewedAt | true | string | {"format":"date-time"} | |
| $.review.reviewedBy | true | string | {} | |
| $.review.validUntil | true | string | {"format":"date-time"} | |
| $.$defs.strings | false | array | {"minItems":1,"uniqueItems":true} | |
| $.$defs.strings[] | false | string | {} | |
| $.$defs.obligation | false | object | {"required":["obligationId","applicable","evidenceRef","status"],"additionalProperties":false} | |
| $.$defs.obligation.obligationId | true | string | {} | |
| $.$defs.obligation.applicable | true | boolean | {} | |
| $.$defs.obligation.evidenceRef | true | string | {} | |
| $.$defs.obligation.status | true | {"enum":["accepted","conditional","missing","not-applicable"]} |
PALO KPI KRI Registry
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","status","updatedAt","disclaimer","indicators"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-kpi-kri-registry"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.status | true | {"const":"educational-non-production"} | ||
| $.updatedAt | true | string | {"format":"date"} | |
| $.disclaimer | true | string | {"minLength":20} | |
| $.indicators | true | array | {"minItems":1} | |
| $.indicators[] | false | object | {"required":["indicatorId","type","name","purpose","formula","cadence","direction","thresholds","controlIds","gateIds","sourceIds","caveat"],"additionalProperties":false} | |
| $.indicators[].indicatorId | true | string | {"pattern":"^(kpi|kri)-[a-z0-9-]+$"} | |
| $.indicators[].type | true | {"enum":["KPI","KRI"]} | ||
| $.indicators[].name | true | string | {"minLength":1} | |
| $.indicators[].purpose | true | string | {"minLength":1} | |
| $.indicators[].formula | true | string | {"minLength":1} | |
| $.indicators[].cadence | true | string | {"minLength":1} | |
| $.indicators[].direction | true | {"enum":["higher-is-better","lower-is-better","within-range"]} | ||
| $.indicators[].thresholds | true | object | {"required":["amber","red"],"additionalProperties":false} | |
| $.indicators[].thresholds.amber | true | string | {} | |
| $.indicators[].thresholds.red | true | string | {} | |
| $.indicators[].controlIds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.indicators[].controlIds[] | false | string | {} | |
| $.indicators[].gateIds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.indicators[].gateIds[] | false | string | {} | |
| $.indicators[].sourceIds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.indicators[].sourceIds[] | false | string | {} | |
| $.indicators[].caveat | true | string | {"minLength":10} |
PALO Lifecycle Definition
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","lifecycleId","definitionVersion","label","status","releasedAt","frameworkRef","phases","gateDefinitions","provenance"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-lifecycle-definition"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.lifecycleId | true | string | {"format":"uri"} | |
| $.definitionVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+$"} | |
| $.label | true | string | {"minLength":1} | |
| $.status | true | {"enum":["draft","in-review","approved-for-release","deprecated","superseded"]} | ||
| $.releasedAt | true | string | {"format":"date"} | |
| $.frameworkRef | true | string | {"format":"uri"} | |
| $.phases | true | array | {"minItems":1} | |
| $.phases[] | false | object | {"required":["phaseDefinitionId","semanticId","definitionVersion","ordinal","label","purpose","gateDefinitionRef"],"additionalProperties":false} | |
| $.phases[].phaseDefinitionId | true | string | {"pattern":"^phase-[a-z0-9-]+$"} | |
| $.phases[].semanticId | true | string | {"format":"uri"} | |
| $.phases[].definitionVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+$"} | |
| $.phases[].ordinal | true | integer | {"minimum":1} | |
| $.phases[].label | true | string | {"minLength":1} | |
| $.phases[].purpose | true | string | {"minLength":1} | |
| $.phases[].gateDefinitionRef | true | string | {"format":"uri"} | |
| $.gateDefinitions | true | array | {"minItems":1} | |
| $.gateDefinitions[] | false | object | {"required":["gateDefinitionId","gateId","definitionVersion","label","purpose","entryCriteria","decisionOptions","requiredControlIds","conditionalControlIds","indicatorIds","sourceIds","templateIds"],"additionalProperties":false} | |
| $.gateDefinitions[].gateDefinitionId | true | string | {"format":"uri"} | |
| $.gateDefinitions[].gateId | true | string | {"pattern":"^[a-z0-9-]+$"} | |
| $.gateDefinitions[].definitionVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+$"} | |
| $.gateDefinitions[].label | true | string | {"minLength":1} | |
| $.gateDefinitions[].purpose | true | string | {"minLength":1} | |
| $.gateDefinitions[].entryCriteria | true | array | {"minItems":1} | |
| $.gateDefinitions[].entryCriteria[] | false | string | {} | |
| $.gateDefinitions[].decisionOptions | true | array | {"minItems":2,"uniqueItems":true} | |
| $.gateDefinitions[].decisionOptions[] | false | {"enum":["proceed","proceed-with-conditions","hold","redesign","stop"]} | ||
| $.gateDefinitions[].requiredControlIds | true | array | {"uniqueItems":true} | |
| $.gateDefinitions[].requiredControlIds[] | false | string | {} | |
| $.gateDefinitions[].conditionalControlIds | true | array | {"uniqueItems":true} | |
| $.gateDefinitions[].conditionalControlIds[] | false | string | {} | |
| $.gateDefinitions[].indicatorIds | true | array | {"uniqueItems":true} | |
| $.gateDefinitions[].indicatorIds[] | false | string | {} | |
| $.gateDefinitions[].sourceIds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.gateDefinitions[].sourceIds[] | false | string | {} | |
| $.gateDefinitions[].templateIds | true | array | {"uniqueItems":true} | |
| $.gateDefinitions[].templateIds[] | false | string | {} | |
| $.provenance | true | object | {"required":["generatedFrom","authorityBoundary"],"additionalProperties":false} | |
| $.provenance.generatedFrom | true | array | {"minItems":1,"uniqueItems":true} | |
| $.provenance.generatedFrom[] | false | string | {} | |
| $.provenance.authorityBoundary | true | string | {"minLength":1} |
PALO Local Validation Receipt
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","receiptId","caseId","generatedAt","result","artifactDigest","checks","validator","privacyBoundary"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-local-validation-receipt"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.receiptId | true | string | {"pattern":"^receipt-[a-f0-9]{16}$"} | |
| $.caseId | true | string | {"pattern":"^case-[a-z0-9][a-z0-9-]{5,63}$"} | |
| $.generatedAt | true | string | {"format":"date-time"} | |
| $.result | true | {"enum":["valid","invalid"]} | ||
| $.artifactDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.checks | true | array | {"minItems":1} | |
| $.checks[] | false | object | {"required":["checkId","status","message"],"additionalProperties":false} | |
| $.checks[].checkId | true | string | {"minLength":1} | |
| $.checks[].status | true | {"enum":["passed","failed"]} | ||
| $.checks[].message | true | string | {"minLength":1} | |
| $.validator | true | object | {"required":["name","version","execution"],"additionalProperties":false} | |
| $.validator.name | true | {"const":"PALO Evidence Pack local validator"} | ||
| $.validator.version | true | string | {"minLength":1} | |
| $.validator.execution | true | {"enum":["browser-local","node-local"]} | ||
| $.privacyBoundary | true | string | {"minLength":1} | |
| $.shareMode | false | {"const":"voluntary-export"} |
PALO OWASP GenAI LLM Top 10 2026 Crosswalk
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","analysisVersion","status","reviewedAt","source","licensing","authorityBoundary","ratingScale","routes","summary","risks","governance"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-owasp-genai-2026-crosswalk"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.analysisVersion | true | string | {"pattern":"^[0-9]+\\.[0-9]+\\.[0-9]+$"} | |
| $.status | true | {"const":"source-backed-context"} | ||
| $.reviewedAt | true | string | {"format":"date"} | |
| $.technicalReview | false | object | {"required":["reviewer","publicRole","scope","creditAuthorizedAt","independenceBoundary"],"additionalProperties":false} | |
| $.technicalReview.reviewer | true | string | {"minLength":3} | |
| $.technicalReview.publicRole | true | string | {"minLength":10} | |
| $.technicalReview.scope | true | array | {"minItems":3,"uniqueItems":true} | |
| $.technicalReview.scope[] | false | string | {"minLength":10} | |
| $.technicalReview.creditAuthorizedAt | true | string | {"format":"date"} | |
| $.technicalReview.independenceBoundary | true | string | {"minLength":40} | |
| $.source | true | object | {"required":["sourceId","version","artifact","sha256","officialProjectUrl","editorialStatus"],"additionalProperties":false} | |
| $.source.sourceId | true | string | {"pattern":"^src-[a-z0-9-]+$"} | |
| $.source.version | true | {"const":"2026-v1.0"} | ||
| $.source.artifact | true | {"const":"assets/OWASP-GenAI-LLM-Top-10-2026-v1.0.pdf"} | ||
| $.source.sha256 | true | string | {"pattern":"^[a-f0-9]{64}$"} | |
| $.source.officialProjectUrl | true | string | {"format":"uri"} | |
| $.source.editorialStatus | true | {"enum":["verified","provisional","superseded"]} | ||
| $.licensing | true | object | {"required":["sourceLicense","sourceLicenseUrl","crosswalkLicense","attribution","endorsementBoundary"],"additionalProperties":false} | |
| $.licensing.sourceLicense | true | {"const":"CC BY-SA 4.0"} | ||
| $.licensing.sourceLicenseUrl | true | string | {"format":"uri"} | |
| $.licensing.crosswalkLicense | true | {"const":"CC BY-SA 4.0"} | ||
| $.licensing.attribution | true | string | {"minLength":20} | |
| $.licensing.endorsementBoundary | true | string | {"minLength":20} | |
| $.authorityBoundary | true | string | {"minLength":40} | |
| $.ratingScale | true | object | {"required":["direct","supporting","gap"],"additionalProperties":false} | |
| $.ratingScale.direct | true | string | {"minLength":20} | |
| $.ratingScale.supporting | true | string | {"minLength":20} | |
| $.ratingScale.gap | true | string | {"minLength":20} | |
| $.routes | true | array | {"minItems":3,"maxItems":3} | |
| $.routes[] | false | object | {"required":["routeId","label","role","maturity","counts"],"additionalProperties":false} | |
| $.routes[].routeId | true | {"enum":["palo","palo-am","palo-ai"]} | ||
| $.routes[].label | true | string | {"minLength":1} | |
| $.routes[].role | true | string | {"minLength":10} | |
| $.routes[].maturity | true | string | {"minLength":5} | |
| $.routes[].counts | true | object | {"required":["direct","supporting","gap"],"additionalProperties":false} | |
| $.routes[].counts.direct | true | integer | {"minimum":0,"maximum":10} | |
| $.routes[].counts.supporting | true | integer | {"minimum":0,"maximum":10} | |
| $.routes[].counts.gap | true | integer | {"minimum":0,"maximum":10} | |
| $.summary | true | object | {"required":["overallFit","unionDirect","unionSupporting","targetedExtensions"],"additionalProperties":false} | |
| $.summary.overallFit | true | string | {"minLength":20} | |
| $.summary.unionDirect | true | integer | {"const":8} | |
| $.summary.unionSupporting | true | integer | {"const":2} | |
| $.summary.targetedExtensions | true | array | {"minItems":2,"maxItems":2,"uniqueItems":true} | |
| $.summary.targetedExtensions[] | false | {"enum":["LLM09:2026","LLM10:2026"]} | ||
| $.risks | true | array | {"minItems":10,"maxItems":10} | |
| $.risks[] | false | object | {"required":["riskId","title","routeFit","verdict","paloResponse","controlIds","externalSafeguards","minimumEvidence","accountableOwner","reopenTriggers"],"additionalProperties":false} | |
| $.risks[].riskId | true | string | {"pattern":"^LLM(0[1-9]|10):2026$"} | |
| $.risks[].title | true | string | {"minLength":1} | |
| $.risks[].routeFit | true | object | {"required":["palo","paloAm","paloAi"],"additionalProperties":false} | |
| $.risks[].routeFit.palo | true | {"enum":["direct","supporting","gap"]} | ||
| $.risks[].routeFit.paloAm | true | {"enum":["direct","supporting","gap"]} | ||
| $.risks[].routeFit.paloAi | true | {"enum":["direct","supporting","gap"]} | ||
| $.risks[].verdict | true | string | {"minLength":20} | |
| $.risks[].paloResponse | true | string | {"minLength":30} | |
| $.risks[].controlIds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.risks[].controlIds[] | false | string | {"pattern":"^ctrl-[a-z0-9-]+$"} | |
| $.risks[].externalSafeguards | true | array | {"minItems":1,"uniqueItems":true} | |
| $.risks[].externalSafeguards[] | false | string | {"minLength":5} | |
| $.risks[].minimumEvidence | true | array | {"minItems":1,"uniqueItems":true} | |
| $.risks[].minimumEvidence[] | false | string | {"minLength":5} | |
| $.risks[].accountableOwner | true | string | {"minLength":5} | |
| $.risks[].reopenTriggers | true | array | {"minItems":1,"uniqueItems":true} | |
| $.risks[].reopenTriggers[] | false | string | {"minLength":5} | |
| $.governance | true | object | {"required":["sourceClass","accountableOwner","reviewIntervalDays","nextReviewAt","applicabilityRule","requiredRiskRecord","reopenTriggers"],"additionalProperties":false} | |
| $.governance.sourceClass | true | {"const":"informative-security-source"} | ||
| $.governance.accountableOwner | true | string | {"minLength":5} | |
| $.governance.reviewIntervalDays | true | integer | {"const":90} | |
| $.governance.nextReviewAt | true | string | {"format":"date"} | |
| $.governance.applicabilityRule | true | string | {"minLength":40} | |
| $.governance.requiredRiskRecord | true | array | {"minItems":7,"uniqueItems":true} | |
| $.governance.requiredRiskRecord[] | false | string | {"minLength":3} | |
| $.governance.reopenTriggers | true | array | {"minItems":4,"uniqueItems":true} | |
| $.governance.reopenTriggers[] | false | string | {"minLength":5} |
PALO P2 Adoption Index
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","status","artifacts","workedCases","templates"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-p2-adoption-index"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.status | true | {"const":"educational-non-production"} | ||
| $.artifacts | true | array | {"minItems":1} | |
| $.artifacts[] | false | / #/$defs/artifact | {} | |
| $.workedCases | true | array | {"minItems":6} | |
| $.workedCases[] | false | / #/$defs/case | {} | |
| $.templates | true | array | {"minItems":5} | |
| $.templates[] | false | / #/$defs/template | {} | |
| $.$defs.artifact | false | object | {"required":["artifactId","kind","path","schemaPath"],"additionalProperties":false} | |
| $.$defs.artifact.artifactId | true | string | {} | |
| $.$defs.artifact.kind | true | string | {} | |
| $.$defs.artifact.path | true | string | {} | |
| $.$defs.artifact.schemaPath | true | string | {} | |
| $.$defs.case | false | object | {"required":["caseId","domain","path","controlIds","indicatorIds","gateIds","sourceIds","templateIds"],"additionalProperties":false} | |
| $.$defs.case.caseId | true | string | {} | |
| $.$defs.case.domain | true | string | {} | |
| $.$defs.case.path | true | string | {} | |
| $.$defs.case.controlIds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.$defs.case.controlIds[] | false | string | {} | |
| $.$defs.case.indicatorIds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.$defs.case.indicatorIds[] | false | string | {} | |
| $.$defs.case.gateIds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.$defs.case.gateIds[] | false | string | {} | |
| $.$defs.case.sourceIds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.$defs.case.sourceIds[] | false | string | {} | |
| $.$defs.case.templateIds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.$defs.case.templateIds[] | false | string | {} | |
| $.$defs.template | false | object | {"required":["templateId","title","path","gateIds"],"additionalProperties":false} | |
| $.$defs.template.templateId | true | string | {} | |
| $.$defs.template.title | true | string | {} | |
| $.$defs.template.path | true | string | {} | |
| $.$defs.template.gateIds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.$defs.template.gateIds[] | false | string | {} |
PALO Educational Policy Input
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","exampleStatus","caseId","decisionContext"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-policy-input"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.exampleStatus | true | {"const":"educational-non-production"} | ||
| $.caseId | true | string | {"pattern":"^case-[a-z0-9][a-z0-9-]{5,63}$"} | |
| $.decisionContext | true | object | {"required":["gateId","humanApprovalRequired","humanApprovalRecorded","openCriticalFindings","requiredEvidenceComplete"],"additionalProperties":false} | |
| $.decisionContext.gateId | true | {"enum":["frame","classify","assess","control","measure","prove"]} | ||
| $.decisionContext.humanApprovalRequired | true | boolean | {} | |
| $.decisionContext.humanApprovalRecorded | true | boolean | {} | |
| $.decisionContext.openCriticalFindings | true | integer | {"minimum":0} | |
| $.decisionContext.requiredEvidenceComplete | true | boolean | {} |
PALO PolicyWatcher Browser-local Review Ledger
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","exportedAt","sourceRegistryDigest","reviews","localOnly","authorityBoundary"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-policywatcher-review-ledger"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.exportedAt | true | string | {"format":"date-time"} | |
| $.sourceRegistryDigest | true | string | {"pattern":"^[a-f0-9]{64}$"} | |
| $.reviews | true | array | {"maxItems":500} | |
| $.reviews[] | false | object | {"required":["signalId","signalDigest","transportStatus","reviewState","updatedAt"],"additionalProperties":false} | |
| $.reviews[].signalId | true | string | {"pattern":"^signal-policywatcher-[a-f0-9-]{36}$"} | |
| $.reviews[].signalDigest | true | string | {"pattern":"^[a-f0-9]{64}$"} | |
| $.reviews[].transportStatus | true | {"enum":["active","revoked"]} | ||
| $.reviews[].reviewState | true | {"enum":["pending-human-review","in-review","routed-to-case-file","reviewed-no-action","rejected"]} | ||
| $.reviews[].updatedAt | true | string | {"format":"date-time"} | |
| $.localOnly | true | {"const":true} | ||
| $.authorityBoundary | true | string | {"minLength":80,"maxLength":1000} |
PALO PolicyWatcher Operational Signal Registry
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","updatedAt","source","transport","statistics","entries","alerts","authorityBoundary","collectionDigest"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-policywatcher-signal-registry"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.updatedAt | true | string | {"format":"date-time"} | |
| $.source | true | object | {"required":["providerId","origin","endpoint","mode","networkOptional"],"additionalProperties":false} | |
| $.source.providerId | true | {"const":"policywatcher"} | ||
| $.source.origin | true | {"const":"https://policywatcher.online"} | ||
| $.source.endpoint | true | {"const":"/api/v1/integrations/palo/signals"} | ||
| $.source.mode | true | {"const":"optional-pull"} | ||
| $.source.networkOptional | true | {"const":true} | ||
| $.transport | true | object | {"required":["state","lastAttemptAt","lastSuccessfulSyncAt","completeTraversal","pageCount","stale","errorCode"],"additionalProperties":false} | |
| $.transport.state | true | {"enum":["not-synchronized","healthy","degraded","unavailable"]} | ||
| $.transport.lastAttemptAt | true | {} | ||
| $.transport.lastAttemptAt.oneOf[0] | false | string | {"format":"date-time"} | |
| $.transport.lastAttemptAt.oneOf[1] | false | null | {} | |
| $.transport.lastSuccessfulSyncAt | true | {} | ||
| $.transport.lastSuccessfulSyncAt.oneOf[0] | false | string | {"format":"date-time"} | |
| $.transport.lastSuccessfulSyncAt.oneOf[1] | false | null | {} | |
| $.transport.completeTraversal | true | boolean | {} | |
| $.transport.pageCount | true | integer | {"minimum":0,"maximum":20} | |
| $.transport.stale | true | boolean | {} | |
| $.transport.errorCode | true | {} | ||
| $.transport.errorCode.oneOf[0] | false | {"enum":["network-error","http-error","schema-error","response-too-large","pagination-error","capacity-exceeded"]} | ||
| $.transport.errorCode.oneOf[1] | false | null | {} | |
| $.statistics | true | object | {"required":["active","revoked","received","accepted","rejected","changed"],"additionalProperties":false} | |
| $.statistics.active | true | integer | {"minimum":0,"maximum":500} | |
| $.statistics.revoked | true | integer | {"minimum":0,"maximum":500} | |
| $.statistics.received | true | integer | {"minimum":0,"maximum":500} | |
| $.statistics.accepted | true | integer | {"minimum":0,"maximum":500} | |
| $.statistics.rejected | true | integer | {"minimum":0,"maximum":500} | |
| $.statistics.changed | true | integer | {"minimum":0,"maximum":500} | |
| $.entries | true | array | {"maxItems":500} | |
| $.entries[] | false | / #/$defs/entry | {} | |
| $.alerts | true | array | {"maxItems":100} | |
| $.alerts[] | false | / #/$defs/alert | {} | |
| $.authorityBoundary | true | string | {"minLength":80,"maxLength":1000} | |
| $.collectionDigest | true | string | {"pattern":"^[a-f0-9]{64}$"} | |
| $.$defs.entry | false | object | {"required":["signalId","changeId","signalDigest","transportStatus","reviewState","firstAcceptedAt","lastValidatedAt","revokedAt","signal"],"additionalProperties":false} | |
| $.$defs.entry.signalId | true | string | {"pattern":"^signal-policywatcher-[a-f0-9-]{36}$"} | |
| $.$defs.entry.changeId | true | string | {"format":"uuid"} | |
| $.$defs.entry.signalDigest | true | string | {"pattern":"^[a-f0-9]{64}$"} | |
| $.$defs.entry.transportStatus | true | {"enum":["active","revoked"]} | ||
| $.$defs.entry.reviewState | true | {"enum":["pending-human-review","in-review","routed-to-case-file","reviewed-no-action","rejected"]} | ||
| $.$defs.entry.firstAcceptedAt | true | string | {"format":"date-time"} | |
| $.$defs.entry.lastValidatedAt | true | string | {"format":"date-time"} | |
| $.$defs.entry.revokedAt | true | {} | ||
| $.$defs.entry.revokedAt.oneOf[0] | false | string | {"format":"date-time"} | |
| $.$defs.entry.revokedAt.oneOf[1] | false | null | {} | |
| $.$defs.entry.signal | true | {} | ||
| $.$defs.entry.signal.oneOf[0] | false | / https://paloframework.org/schemas/policywatcher-signal.schema.json | {} | |
| $.$defs.entry.signal.oneOf[1] | false | null | {} | |
| $.$defs.entry.allOf[0] | false | {} | ||
| $.$defs.entry.allOf[0].if | false | {} | ||
| $.$defs.entry.allOf[0].if.transportStatus | false | {"const":"active"} | ||
| $.$defs.entry.allOf[0].then | false | {} | ||
| $.$defs.entry.allOf[0].then.signal | false | / https://paloframework.org/schemas/policywatcher-signal.schema.json | {} | |
| $.$defs.entry.allOf[0].then.revokedAt | false | null | {} | |
| $.$defs.entry.allOf[1] | false | {} | ||
| $.$defs.entry.allOf[1].if | false | {} | ||
| $.$defs.entry.allOf[1].if.transportStatus | false | {"const":"revoked"} | ||
| $.$defs.entry.allOf[1].then | false | {} | ||
| $.$defs.entry.allOf[1].then.signal | false | null | {} | |
| $.$defs.entry.allOf[1].then.revokedAt | false | string | {"format":"date-time"} | |
| $.$defs.alert | false | object | {"required":["code","severity","signalId","observedAt","message"],"additionalProperties":false} | |
| $.$defs.alert.code | true | {"enum":["transport-unavailable","contract-rejected","pagination-incomplete","capacity-exceeded","signal-revoked","signal-republished"]} | ||
| $.$defs.alert.severity | true | {"enum":["info","warning","critical"]} | ||
| $.$defs.alert.signalId | true | {} | ||
| $.$defs.alert.signalId.oneOf[0] | false | string | {"pattern":"^signal-policywatcher-[a-f0-9-]{36}$"} | |
| $.$defs.alert.signalId.oneOf[1] | false | null | {} | |
| $.$defs.alert.observedAt | true | string | {"format":"date-time"} | |
| $.$defs.alert.message | true | string | {"minLength":1,"maxLength":300} |
PALO-AI Production Admission Profile
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","profileId","deploymentId","environment","identity","tenantIsolation","persistence","keyCustody","executionBoundary","observability","independentAssurance","decision"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-production-profile"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.profileId | true | string | {} | |
| $.deploymentId | true | string | {} | |
| $.environment | true | {"enum":["evaluation","staging","production"]} | ||
| $.identity | true | object | {"required":["mode","issuer","audience","workloadIdentity","reviewerIdentity","tokenExpiryEnforced","evidenceRef"],"additionalProperties":false} | |
| $.identity.mode | true | {"enum":["oidc","shared-token"]} | ||
| $.identity.issuer | true | string | {} | |
| $.identity.audience | true | string | {} | |
| $.identity.workloadIdentity | true | boolean | {} | |
| $.identity.reviewerIdentity | true | boolean | {} | |
| $.identity.tokenExpiryEnforced | true | boolean | {} | |
| $.identity.evidenceRef | true | string | {} | |
| $.tenantIsolation | true | object | {"required":["mode","tokenTenantBound","claimTenantBound","storageTenantBound","negativeTestRef"],"additionalProperties":false} | |
| $.tenantIsolation.mode | true | {"enum":["none","database-per-tenant","schema-per-tenant","row-level-security"]} | ||
| $.tenantIsolation.tokenTenantBound | true | boolean | {} | |
| $.tenantIsolation.claimTenantBound | true | boolean | {} | |
| $.tenantIsolation.storageTenantBound | true | boolean | {} | |
| $.tenantIsolation.negativeTestRef | true | string | {} | |
| $.persistence | true | object | {"required":["driver","highAvailability","durableQueue","backupRecoveryTestRef","migrationControlRef"],"additionalProperties":false} | |
| $.persistence.driver | true | {"enum":["sqlite","postgresql","other-production-database"]} | ||
| $.persistence.highAvailability | true | boolean | {} | |
| $.persistence.durableQueue | true | boolean | {} | |
| $.persistence.backupRecoveryTestRef | true | string | {} | |
| $.persistence.migrationControlRef | true | string | {} | |
| $.keyCustody | true | object | {"required":["provider","privateKeyInProcess","rotationRef","revocationRef","attestationRef"],"additionalProperties":false} | |
| $.keyCustody.provider | true | {"enum":["process-environment","file","kms","hsm","managed-signing-service"]} | ||
| $.keyCustody.privateKeyInProcess | true | boolean | {} | |
| $.keyCustody.rotationRef | true | string | {} | |
| $.keyCustody.revocationRef | true | string | {} | |
| $.keyCustody.attestationRef | true | string | {} | |
| $.executionBoundary | true | object | {"required":["connectorMode","inProcessBypassDisabled","oneTimeCapabilities","receiptRequired","outcomeVerificationRequired","bypassResistanceTestRef","connectorAttestationRef"],"additionalProperties":false} | |
| $.executionBoundary.connectorMode | true | {"enum":["in-process","allowlisted-proxy","remote-attested"]} | ||
| $.executionBoundary.inProcessBypassDisabled | true | boolean | {} | |
| $.executionBoundary.oneTimeCapabilities | true | boolean | {} | |
| $.executionBoundary.receiptRequired | true | boolean | {} | |
| $.executionBoundary.outcomeVerificationRequired | true | boolean | {} | |
| $.executionBoundary.bypassResistanceTestRef | true | string | {} | |
| $.executionBoundary.connectorAttestationRef | true | string | {} | |
| $.observability | true | object | {"required":["securityEvents","tenantSafeTelemetry","alerting","incidentRunbookRef","evidenceRef"],"additionalProperties":false} | |
| $.observability.securityEvents | true | boolean | {} | |
| $.observability.tenantSafeTelemetry | true | boolean | {} | |
| $.observability.alerting | true | boolean | {} | |
| $.observability.incidentRunbookRef | true | string | {} | |
| $.observability.evidenceRef | true | string | {} | |
| $.independentAssurance | true | object | {"required":["completed","scope","reportRef","openCriticalFindings"],"additionalProperties":false} | |
| $.independentAssurance.completed | true | boolean | {} | |
| $.independentAssurance.scope | true | string | {} | |
| $.independentAssurance.reportRef | true | string | {} | |
| $.independentAssurance.openCriticalFindings | true | integer | {"minimum":0} | |
| $.decision | true | object | {"required":["status","decidedAt","decidedBy","validUntil","reasons"],"additionalProperties":false} | |
| $.decision.status | true | {"enum":["admitted","denied","conditional"]} | ||
| $.decision.decidedAt | true | string | {"format":"date-time"} | |
| $.decision.decidedBy | true | string | {} | |
| $.decision.validUntil | true | string | {"format":"date-time"} | |
| $.decision.reasons | true | array | {"minItems":1} | |
| $.decision.reasons[] | false | string | {} | |
| $.allOf[0] | false | {} | ||
| $.allOf[0].if | false | {"required":["environment"]} | ||
| $.allOf[0].if.environment | true | {"const":"production"} | ||
| $.allOf[0].then | false | {} | ||
| $.allOf[0].then.identity | false | object | {} | |
| $.allOf[0].then.identity.mode | false | {"const":"oidc"} | ||
| $.allOf[0].then.identity.workloadIdentity | false | {"const":true} | ||
| $.allOf[0].then.identity.reviewerIdentity | false | {"const":true} | ||
| $.allOf[0].then.identity.tokenExpiryEnforced | false | {"const":true} | ||
| $.allOf[0].then.tenantIsolation | false | object | {} | |
| $.allOf[0].then.tenantIsolation.mode | false | {"enum":["database-per-tenant","schema-per-tenant","row-level-security"]} | ||
| $.allOf[0].then.tenantIsolation.tokenTenantBound | false | {"const":true} | ||
| $.allOf[0].then.tenantIsolation.claimTenantBound | false | {"const":true} | ||
| $.allOf[0].then.tenantIsolation.storageTenantBound | false | {"const":true} | ||
| $.allOf[0].then.persistence | false | object | {} | |
| $.allOf[0].then.persistence.driver | false | {"enum":["postgresql","other-production-database"]} | ||
| $.allOf[0].then.persistence.highAvailability | false | {"const":true} | ||
| $.allOf[0].then.persistence.durableQueue | false | {"const":true} | ||
| $.allOf[0].then.keyCustody | false | object | {} | |
| $.allOf[0].then.keyCustody.provider | false | {"enum":["kms","hsm","managed-signing-service"]} | ||
| $.allOf[0].then.keyCustody.privateKeyInProcess | false | {"const":false} | ||
| $.allOf[0].then.executionBoundary | false | object | {} | |
| $.allOf[0].then.executionBoundary.connectorMode | false | {"enum":["allowlisted-proxy","remote-attested"]} | ||
| $.allOf[0].then.executionBoundary.inProcessBypassDisabled | false | {"const":true} | ||
| $.allOf[0].then.executionBoundary.oneTimeCapabilities | false | {"const":true} | ||
| $.allOf[0].then.executionBoundary.receiptRequired | false | {"const":true} | ||
| $.allOf[0].then.executionBoundary.outcomeVerificationRequired | false | {"const":true} | ||
| $.allOf[0].then.observability | false | object | {} | |
| $.allOf[0].then.observability.securityEvents | false | {"const":true} | ||
| $.allOf[0].then.observability.tenantSafeTelemetry | false | {"const":true} | ||
| $.allOf[0].then.observability.alerting | false | {"const":true} | ||
| $.allOf[0].then.independentAssurance | false | object | {} | |
| $.allOf[0].then.independentAssurance.completed | false | {"const":true} | ||
| $.allOf[0].then.independentAssurance.openCriticalFindings | false | {"const":0} | ||
| $.allOf[0].then.decision | false | object | {} | |
| $.allOf[0].then.decision.status | false | {"const":"admitted"} |
PALO Semantic Change Impact
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","changeImpactId","fromVersion","toVersion","assessedAt","status","compatibilityPolicy","changes","migrationGates"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-semantic-change-impact"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.changeImpactId | true | string | {"format":"uri"} | |
| $.fromVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+$"} | |
| $.toVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+$"} | |
| $.assessedAt | true | string | {"format":"date"} | |
| $.status | true | {"enum":["draft","reviewed","approved-for-release"]} | ||
| $.compatibilityPolicy | true | string | {"minLength":1} | |
| $.changes | true | array | {"minItems":1} | |
| $.changes[] | false | object | {"required":["changeId","category","summary","compatibility","affectedArtifacts","requiredAction"],"additionalProperties":false} | |
| $.changes[].changeId | true | string | {"pattern":"^CHANGE-[0-9]{2}$"} | |
| $.changes[].category | true | {"enum":["semantic-model","lifecycle","decision","evidence","mapping","release","user-experience"]} | ||
| $.changes[].summary | true | string | {"minLength":1} | |
| $.changes[].compatibility | true | {"enum":["additive","migration-required","generated-projection"]} | ||
| $.changes[].affectedArtifacts | true | array | {"minItems":1,"uniqueItems":true} | |
| $.changes[].affectedArtifacts[] | false | string | {} | |
| $.changes[].requiredAction | true | string | {"minLength":1} | |
| $.migrationGates | true | array | {"minItems":1,"uniqueItems":true} | |
| $.migrationGates[] | false | string | {} |
PALO Atomic Semantic Mapping Registry
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","semanticVersion","releasedAt","status","authorityBoundary","mappings"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-semantic-mapping-registry"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.semanticVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+$"} | |
| $.releasedAt | true | string | {"format":"date"} | |
| $.status | true | {"enum":["draft","in-review","approved-for-release","deprecated","superseded"]} | ||
| $.authorityBoundary | true | string | {"minLength":1} | |
| $.mappings | true | array | {"minItems":1} | |
| $.mappings[] | false | object | {"required":["mappingId","mappingVersion","mappingType","source","target","coverageType","conditions","rationale","basis","approval","validFrom","provenance"],"additionalProperties":false} | |
| $.mappings[].mappingId | true | string | {"format":"uri"} | |
| $.mappings[].mappingVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+$"} | |
| $.mappings[].mappingType | true | {"enum":["control-to-source","control-to-indicator","control-to-gate","indicator-to-source","indicator-to-gate","gate-to-source"]} | ||
| $.mappings[].source | true | / #/$defs/versionedRef | {} | |
| $.mappings[].target | true | / #/$defs/versionedRef | {} | |
| $.mappings[].coverageType | true | {"enum":["total","partial","conditional","supporting"]} | ||
| $.mappings[].conditions | true | array | {} | |
| $.mappings[].conditions[] | false | string | {} | |
| $.mappings[].rationale | true | string | {"minLength":1} | |
| $.mappings[].basis | true | string | {"minLength":1} | |
| $.mappings[].approval | true | object | {"required":["status","scope","decidedAt","decidedBy"],"additionalProperties":false} | |
| $.mappings[].approval.status | true | {"enum":["draft","in-review","approved","rejected","superseded"]} | ||
| $.mappings[].approval.scope | true | string | {"minLength":1} | |
| $.mappings[].approval.decidedAt | true | string | {"format":"date-time"} | |
| $.mappings[].approval.decidedBy | true | string | {"minLength":1} | |
| $.mappings[].validFrom | true | string | {"format":"date-time"} | |
| $.mappings[].validTo | false | string | {"format":"date-time"} | |
| $.mappings[].supersedesMappingId | false | string | {"format":"uri"} | |
| $.mappings[].provenance | true | object | {"required":["generatedFrom","generationRule"],"additionalProperties":false} | |
| $.mappings[].provenance.generatedFrom | true | string | {} | |
| $.mappings[].provenance.generationRule | true | string | {} | |
| $.$defs.versionedRef | false | object | {"required":["entityType","entityId","semanticId","version"],"additionalProperties":false} | |
| $.$defs.versionedRef.entityType | true | {"enum":["control","indicator","gate","source"]} | ||
| $.$defs.versionedRef.entityId | true | string | {"minLength":1} | |
| $.$defs.versionedRef.semanticId | true | string | {"format":"uri"} | |
| $.$defs.versionedRef.version | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+$"} |
PALO Semantic Release Manifest
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","releaseId","semanticVersion","releasedAt","status","digestAlgorithm","items","manifestDigest","authorityBoundary"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-semantic-release-manifest"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.releaseId | true | string | {"format":"uri"} | |
| $.semanticVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+$"} | |
| $.releasedAt | true | string | {"format":"date"} | |
| $.status | true | {"enum":["draft","in-review","approved-for-release","deprecated","superseded"]} | ||
| $.digestAlgorithm | true | {"const":"sha256"} | ||
| $.items | true | array | {"minItems":1} | |
| $.items[] | false | object | {"required":["itemId","path","role","semanticVersion","status","sha256"],"additionalProperties":false} | |
| $.items[].itemId | true | string | {"format":"uri"} | |
| $.items[].path | true | string | {"pattern":"^(data|formal|schemas)/"} | |
| $.items[].role | true | {"enum":["canonical-catalog","lifecycle-definition","control-registry","indicator-registry","gate-registry","source-registry","provider-registry","crosswalk-registry","control-pack-registry","mapping-registry","invariant-registry","json-ld-context","ontology","constraint-profile","schema","change-impact"]} | ||
| $.items[].schemaPath | false | string | {"pattern":"^schemas/"} | |
| $.items[].semanticVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+$"} | |
| $.items[].status | true | {"enum":["approved-for-release","compatibility-contract"]} | ||
| $.items[].sha256 | true | string | {"pattern":"^[a-f0-9]{64}$"} | |
| $.manifestDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.authorityBoundary | true | string | {"minLength":1} |
PALO Semantic Spine
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","semanticVersion","namespace","releasedAt","status","authorityClasses","workspaces","nodes","links","stageIds","navigationIds","weights"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-semantic-spine"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.semanticVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+$"} | |
| $.namespace | true | string | {"format":"uri","pattern":"^https://paloframework\\.org/semantic/$"} | |
| $.releasedAt | true | string | {"format":"date"} | |
| $.status | true | {"enum":["draft","in-review","approved-for-release","deprecated","superseded"]} | ||
| $.authorityClasses | true | object | {"required":["canonical-definition","source-backed-context","illustrative-local-preview","human-review-required"],"additionalProperties":false} | |
| $.authorityClasses.canonical-definition | true | / #/$defs/authorityClass | {} | |
| $.authorityClasses.source-backed-context | true | / #/$defs/authorityClass | {} | |
| $.authorityClasses.illustrative-local-preview | true | / #/$defs/authorityClass | {} | |
| $.authorityClasses.human-review-required | true | / #/$defs/authorityClass | {} | |
| $.workspaces | true | array | {"minItems":3} | |
| $.workspaces[] | false | object | {"required":["workspaceId","label","purpose","authorityBoundary"],"additionalProperties":false} | |
| $.workspaces[].workspaceId | true | {"enum":["public-catalog","case-workspace","assurance-review"]} | ||
| $.workspaces[].label | true | string | {"minLength":1} | |
| $.workspaces[].purpose | true | string | {"minLength":1} | |
| $.workspaces[].authorityBoundary | true | string | {"minLength":1} | |
| $.nodes | true | array | {"minItems":1} | |
| $.nodes[] | false | / #/$defs/node | {} | |
| $.links | true | array | {"minItems":1} | |
| $.links[] | false | / #/$defs/link | {} | |
| $.stageIds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.stageIds[] | false | string | {} | |
| $.navigationIds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.navigationIds[] | false | string | {} | |
| $.weights | true | object | {"minProperties":1,"additionalProperties":{"type":"string"}} | |
| $.weights.additionalProperties | false | string | {} | |
| $.$defs.authorityClass | false | object | {"required":["label","meaning","authoritative"],"additionalProperties":false} | |
| $.$defs.authorityClass.label | true | string | {"minLength":1} | |
| $.$defs.authorityClass.meaning | true | string | {"minLength":1} | |
| $.$defs.authorityClass.authoritative | true | boolean | {} | |
| $.$defs.node | false | object | {"required":["id","label","type","phaseId","role","status","semanticId","definitionVersion","evidenceClass","authorityBoundary","sourceRefs","lastReviewed"],"additionalProperties":true} | |
| $.$defs.node.id | true | string | {"pattern":"^[a-z0-9][a-z0-9-]*$"} | |
| $.$defs.node.label | true | string | {"minLength":1} | |
| $.$defs.node.type | true | {"enum":["stage","module","artifact","actor","source","control","metric","navigation"]} | ||
| $.$defs.node.phaseId | true | {"enum":["frame","classify","assess","control","measure","prove"]} | ||
| $.$defs.node.role | true | string | {"minLength":1} | |
| $.$defs.node.status | true | string | {"minLength":1} | |
| $.$defs.node.semanticId | true | string | {"format":"uri"} | |
| $.$defs.node.definitionVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+$"} | |
| $.$defs.node.evidenceClass | true | {"enum":["canonical-definition","source-backed-context","illustrative-local-preview","human-review-required"]} | ||
| $.$defs.node.authorityBoundary | true | string | {"minLength":1} | |
| $.$defs.node.sourceRefs | true | array | {"uniqueItems":true} | |
| $.$defs.node.sourceRefs[] | false | string | {} | |
| $.$defs.node.lastReviewed | true | string | {"format":"date"} | |
| $.$defs.node.properties | false | object | {} | |
| $.$defs.node.outputs | false | array | {} | |
| $.$defs.node.outputs[] | false | string | {} | |
| $.$defs.link | false | object | {"required":["source","target","verb","weight","meaning","artifactTransferred","relationType","semanticId","relationshipVersion","mappingBasis"],"additionalProperties":false} | |
| $.$defs.link.source | true | string | {} | |
| $.$defs.link.target | true | string | {} | |
| $.$defs.link.verb | true | string | {"minLength":1} | |
| $.$defs.link.weight | true | string | {"pattern":"^W[2-5]$"} | |
| $.$defs.link.meaning | true | string | {"minLength":1} | |
| $.$defs.link.artifactTransferred | true | string | {} | |
| $.$defs.link.relationType | true | {"enum":["operational","evidence","feedback","context","support","navigation"]} | ||
| $.$defs.link.semanticId | true | string | {"format":"uri"} | |
| $.$defs.link.relationshipVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+$"} | |
| $.$defs.link.mappingBasis | true | string | {"minLength":1} |
PALO Serious Incident and Regulatory Clock Record
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","incidentId","caseId","systemVersion","detectedAt","containedAt","severity","effects","jurisdictions","reportability","notifications","correctiveActions","closure"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-serious-incident-record"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.incidentId | true | string | {} | |
| $.caseId | true | string | {} | |
| $.systemVersion | true | string | {} | |
| $.detectedAt | true | string | {"format":"date-time"} | |
| $.containedAt | true | string | {"format":"date-time"} | |
| $.severity | true | {"enum":["low","moderate","high","critical"]} | ||
| $.effects | true | array | {"minItems":1} | |
| $.effects[] | false | object | {"required":["effectType","description","affectedScope"],"additionalProperties":false} | |
| $.effects[].effectType | true | {"enum":["death","serious-harm","rights-infringement","critical-infrastructure","property-environment","cybersecurity","other"]} | ||
| $.effects[].description | true | string | {"minLength":10} | |
| $.effects[].affectedScope | true | string | {} | |
| $.jurisdictions | true | array | {"minItems":1} | |
| $.jurisdictions[] | false | object | {"required":["jurisdiction","sourceProvision","clockStart","deadline","authorityRoute"],"additionalProperties":false} | |
| $.jurisdictions[].jurisdiction | true | string | {} | |
| $.jurisdictions[].sourceProvision | true | string | {} | |
| $.jurisdictions[].clockStart | true | string | {"format":"date-time"} | |
| $.jurisdictions[].deadline | true | string | {"format":"date-time"} | |
| $.jurisdictions[].authorityRoute | true | string | {} | |
| $.reportability | true | object | {"required":["status","decidedAt","decidedBy","rationale","legalReviewRef"],"additionalProperties":false} | |
| $.reportability.status | true | {"enum":["reportable","not-reportable","undetermined"]} | ||
| $.reportability.decidedAt | true | string | {"format":"date-time"} | |
| $.reportability.decidedBy | true | string | {} | |
| $.reportability.rationale | true | string | {"minLength":20} | |
| $.reportability.legalReviewRef | true | string | {} | |
| $.notifications | true | array | {} | |
| $.notifications[] | false | object | {"required":["recipient","notificationType","submittedAt","receiptRef"],"additionalProperties":false} | |
| $.notifications[].recipient | true | string | {} | |
| $.notifications[].notificationType | true | {"enum":["initial","follow-up","final","affected-person","provider","other"]} | ||
| $.notifications[].submittedAt | true | string | {"format":"date-time"} | |
| $.notifications[].receiptRef | true | string | {} | |
| $.correctiveActions | true | array | {"minItems":1} | |
| $.correctiveActions[] | false | object | {"required":["actionId","owner","dueAt","status","effectivenessEvidenceRef"],"additionalProperties":false} | |
| $.correctiveActions[].actionId | true | string | {} | |
| $.correctiveActions[].owner | true | string | {} | |
| $.correctiveActions[].dueAt | true | string | {"format":"date-time"} | |
| $.correctiveActions[].status | true | {"enum":["open","in-progress","completed","verified-closed"]} | ||
| $.correctiveActions[].effectivenessEvidenceRef | true | string | {} | |
| $.closure | true | object | {"required":["status","closedAt","closedBy","postIncidentReviewRef"],"additionalProperties":false} | |
| $.closure.status | true | {"enum":["open","contained","reporting","correcting","closed"]} | ||
| $.closure.closedAt | true | string | {"format":"date-time"} | |
| $.closure.closedBy | true | string | {} | |
| $.closure.postIncidentReviewRef | true | string | {} |
PALO Source Registry
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","status","updatedAt","disclaimer","sources"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-source-registry"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.status | true | {"const":"educational-non-production"} | ||
| $.updatedAt | true | string | {"format":"date"} | |
| $.disclaimer | true | string | {"minLength":20} | |
| $.sources | true | array | {"minItems":1} | |
| $.sources[] | false | object | {"required":["sourceId","title","url","sourceType","publisher","checkedAt","freshness","authorityStatus","usageNote"],"additionalProperties":false} | |
| $.sources[].sourceId | true | string | {"pattern":"^src-[a-z0-9-]+$"} | |
| $.sources[].title | true | string | {"minLength":1} | |
| $.sources[].url | true | string | {"format":"uri"} | |
| $.sources[].sourceType | true | {"enum":["official","standard","organizational","research","monitoring-signal"]} | ||
| $.sources[].publisher | true | string | {"minLength":1} | |
| $.sources[].checkedAt | true | string | {"format":"date-time"} | |
| $.sources[].freshness | true | object | {"required":["status","reviewIntervalDays","nextReviewAt"],"additionalProperties":false} | |
| $.sources[].freshness.status | true | {"enum":["current","review-due","stale","superseded","unknown"]} | ||
| $.sources[].freshness.reviewIntervalDays | true | integer | {"minimum":1} | |
| $.sources[].freshness.nextReviewAt | true | string | {"format":"date-time"} | |
| $.sources[].authorityStatus | true | {"enum":["authoritative-primary","authoritative-standard","informative","non-authoritative-monitoring-signal"]} | ||
| $.sources[].usageNote | true | string | {"minLength":10} |
PALO stack architecture extension
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","extensionVersion","status","foundationRef","foundationVersion","reviewedAt","authorityBoundary","sources","entityTypes","relationshipTypes","view"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-stack-governance-model"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.extensionVersion | true | {"const":"0.1.0"} | ||
| $.status | true | {"const":"draft"} | ||
| $.foundationRef | true | string | {"minLength":1} | |
| $.foundationVersion | true | {"const":"3.1.0"} | ||
| $.reviewedAt | true | string | {"format":"date"} | |
| $.authorityBoundary | true | string | {"minLength":1} | |
| $.sources | true | array | {} | |
| $.sources[] | false | object | {"required":["id","url"],"additionalProperties":false} | |
| $.sources[].id | true | string | {"minLength":1} | |
| $.sources[].url | true | string | {"format":"uri"} | |
| $.entityTypes | true | array | {} | |
| $.entityTypes[] | false | object | {"required":["id","semanticId","origin"],"additionalProperties":false} | |
| $.entityTypes[].id | true | string | {"minLength":1} | |
| $.entityTypes[].semanticId | true | string | {"format":"uri"} | |
| $.entityTypes[].origin | true | {"enum":["palo-3.1","stack-extension-0.1"]} | ||
| $.relationshipTypes | true | array | {} | |
| $.relationshipTypes[] | false | object | {"required":["id","sourceTypes","targetTypes","meaning"],"additionalProperties":false} | |
| $.relationshipTypes[].id | true | string | {"minLength":1} | |
| $.relationshipTypes[].sourceTypes | true | array | {"uniqueItems":true} | |
| $.relationshipTypes[].sourceTypes[] | false | string | {"minLength":1} | |
| $.relationshipTypes[].targetTypes | true | array | {"uniqueItems":true} | |
| $.relationshipTypes[].targetTypes[] | false | string | {"minLength":1} | |
| $.relationshipTypes[].meaning | true | string | {"minLength":1} | |
| $.relationshipTypes[].maxPerSource | false | integer | {"minimum":1} | |
| $.relationshipTypes[].minPerSource | false | integer | {"minimum":0} | |
| $.view | true | object | {"required":["nodes","links"],"additionalProperties":false} | |
| $.view.nodes | true | array | {"minItems":1} | |
| $.view.nodes[] | false | / #/$defs/node | {} | |
| $.view.links | true | array | {"minItems":1} | |
| $.view.links[] | false | / #/$defs/link | {} | |
| $.$defs.authorityClass | false | object | {"required":["label","meaning","authoritative"],"additionalProperties":false} | |
| $.$defs.authorityClass.label | true | string | {"minLength":1} | |
| $.$defs.authorityClass.meaning | true | string | {"minLength":1} | |
| $.$defs.authorityClass.authoritative | true | boolean | {} | |
| $.$defs.node | false | object | {"required":["id","label","type","phaseId","role","status","semanticId","definitionVersion","evidenceClass","authorityBoundary","sourceRefs","lastReviewed"],"additionalProperties":true} | |
| $.$defs.node.id | true | string | {"pattern":"^[a-z0-9][a-z0-9-]*$"} | |
| $.$defs.node.label | true | string | {"minLength":1} | |
| $.$defs.node.type | true | {"enum":["layer","plane","component"]} | ||
| $.$defs.node.phaseId | true | {"enum":["frame","classify","assess","control","measure","prove"]} | ||
| $.$defs.node.role | true | string | {"minLength":1} | |
| $.$defs.node.status | true | string | {"minLength":1} | |
| $.$defs.node.semanticId | true | string | {"format":"uri"} | |
| $.$defs.node.definitionVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+$"} | |
| $.$defs.node.evidenceClass | true | {"enum":["canonical-definition","source-backed-context","illustrative-local-preview","human-review-required"]} | ||
| $.$defs.node.authorityBoundary | true | string | {"minLength":1} | |
| $.$defs.node.sourceRefs | true | array | {"uniqueItems":true} | |
| $.$defs.node.sourceRefs[] | false | string | {} | |
| $.$defs.node.lastReviewed | true | string | {"format":"date"} | |
| $.$defs.node.properties | false | object | {} | |
| $.$defs.node.outputs | false | array | {} | |
| $.$defs.node.outputs[] | false | string | {} | |
| $.$defs.link | false | object | {"required":["source","target","verb","weight","meaning","artifactTransferred","relationType","semanticId","relationshipVersion","mappingBasis"],"additionalProperties":false} | |
| $.$defs.link.source | true | string | {} | |
| $.$defs.link.target | true | string | {} | |
| $.$defs.link.verb | true | string | {"minLength":1} | |
| $.$defs.link.weight | true | string | {"pattern":"^W[2-5]$"} | |
| $.$defs.link.meaning | true | string | {"minLength":1} | |
| $.$defs.link.artifactTransferred | true | string | {} | |
| $.$defs.link.relationType | true | {"enum":["operational","evidence","feedback","context","support","navigation"]} | ||
| $.$defs.link.semanticId | true | string | {"format":"uri"} | |
| $.$defs.link.relationshipVersion | true | string | {"pattern":"^\\d+\\.\\d+\\.\\d+$"} | |
| $.$defs.link.mappingBasis | true | string | {"minLength":1} |
PALO Swarm Mandate
Unreleased local prototype: immutable initial membership, accountable mandate and conservative shared exposure budget. Not distributed swarm assurance.
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"additionalProperties":false,"required":["format","schemaVersion","mandateVersion","swarmId","caseId","tenantId","owner","objective","coordinatorAgentId","members","validFrom","expiresAt","budget","maxConcurrentExecutions","keyId"]} | Unreleased local prototype: immutable initial membership, accountable mandate and conservative shared exposure budget. Not distributed swarm assurance. |
| $.format | true | {"const":"palo-swarm-mandate"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.mandateVersion | true | string | {"pattern":"^[1-9][0-9]*\\.[0-9]+\\.[0-9]+$"} | |
| $.swarmId | true | string | {"pattern":"^swarm-[a-zA-Z0-9-]{6,100}$"} | |
| $.caseId | true | string | {"minLength":1,"maxLength":128} | |
| $.tenantId | true | string | {"minLength":1,"maxLength":128} | |
| $.objective | true | string | {"minLength":10,"maxLength":2000} | |
| $.owner | true | object | {"additionalProperties":false,"required":["subject","issuer"]} | |
| $.owner.subject | true | string | {"minLength":1,"maxLength":512} | |
| $.owner.issuer | true | string | {"format":"uri","maxLength":1000} | |
| $.coordinatorAgentId | true | / #/$defs/agentId | {} | |
| $.members | true | array | {"minItems":1,"maxItems":1000} | |
| $.members[] | false | object | {"additionalProperties":false,"required":["agentId","parentAgentId","profileDigest"]} | |
| $.members[].agentId | true | / #/$defs/agentId | {} | |
| $.members[].parentAgentId | true | {} | ||
| $.members[].parentAgentId.anyOf[0] | false | / #/$defs/agentId | {} | |
| $.members[].parentAgentId.anyOf[1] | false | null | {} | |
| $.members[].profileDigest | true | string | {"pattern":"^sha256:[a-f0-9]{64}$"} | |
| $.validFrom | true | string | {"format":"date-time"} | |
| $.expiresAt | true | string | {"format":"date-time"} | |
| $.maxConcurrentExecutions | true | integer | {"minimum":1,"maximum":1000} | |
| $.keyId | true | string | {"pattern":"^key-[a-zA-Z0-9._-]{3,100}$"} | |
| $.budget | true | object | {"additionalProperties":false,"required":["unit","limitUnits","rules"]} | |
| $.budget.unit | true | string | {"minLength":1,"maxLength":80} | |
| $.budget.limitUnits | true | integer | {"minimum":0,"maximum":1000000000000} | |
| $.budget.rules | true | array | {"minItems":1,"maxItems":100} | |
| $.budget.rules[] | false | object | {"additionalProperties":false,"required":["tool","operation","resource","pathPrefix","maxUnitsPerAction"]} | |
| $.budget.rules[].tool | true | string | {"minLength":1,"maxLength":200} | |
| $.budget.rules[].operation | true | {"enum":["read","create","update","delete","execute","delegate"]} | ||
| $.budget.rules[].resource | true | string | {"minLength":1,"maxLength":1000} | |
| $.budget.rules[].pathPrefix | true | string | {"pattern":"^/","maxLength":1000} | |
| $.budget.rules[].maxUnitsPerAction | true | integer | {"minimum":0,"maximum":1000000000000} | |
| $.budget.rules[].amountPointer | false | string | {"pattern":"^/","maxLength":500} | |
| $.budget.rules[].fixedUnits | false | integer | {"minimum":0,"maximum":1000000000000} | |
| $.budget.rules[].oneOf[0] | false | {"required":["amountPointer"]} | ||
| $.budget.rules[].oneOf[0].amountPointer | true | {} | ||
| $.budget.rules[].oneOf[1] | false | {"required":["fixedUnits"]} | ||
| $.budget.rules[].oneOf[1].fixedUnits | true | {} | ||
| $.$defs.agentId | false | string | {"pattern":"^agent-[a-zA-Z0-9][a-zA-Z0-9-]{5,63}$"} |
PALO Swarm Membership Change
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"additionalProperties":false,"required":["format","schemaVersion","changeId","swarmId","tenantId","expectedMembershipDigest","members","reason"]} | |
| $.format | true | {"const":"palo-swarm-membership-change"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.changeId | true | string | {"pattern":"^membership-[a-zA-Z0-9-]{6,100}$"} | |
| $.swarmId | true | string | {"pattern":"^swarm-[a-zA-Z0-9-]{6,100}$"} | |
| $.tenantId | true | string | {"minLength":1,"maxLength":128} | |
| $.expectedMembershipDigest | true | / #/$defs/digest | {} | |
| $.reason | true | string | {"minLength":1,"maxLength":2000} | |
| $.members | true | array | {"minItems":1,"maxItems":100} | |
| $.members[] | false | object | {"additionalProperties":false,"required":["agentId","parentAgentId","profileDigest"]} | |
| $.members[].agentId | true | / #/$defs/agentId | {} | |
| $.members[].parentAgentId | true | / #/$defs/agentId | {} | |
| $.members[].profileDigest | true | / #/$defs/digest | {} | |
| $.$defs.agentId | false | string | {"pattern":"^agent-[a-zA-Z0-9][a-zA-Z0-9-]{5,63}$"} | |
| $.$defs.digest | false | string | {"pattern":"^sha256:[a-f0-9]{64}$"} |
PALO System and Model Card
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","cardId","caseId","system","purpose","stakeholders","components","data","performance","limitations","humanOversight","transparency","monitoring","changeHistory","owner","review"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-system-card"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.cardId | true | string | {"minLength":1} | |
| $.caseId | true | string | {"minLength":1} | |
| $.system | true | object | {"required":["name","version","releaseStatus"],"additionalProperties":false} | |
| $.system.name | true | string | {"minLength":1} | |
| $.system.version | true | string | {"minLength":1} | |
| $.system.releaseStatus | true | {"enum":["development","pilot","production","retiring","retired"]} | ||
| $.purpose | true | object | {"required":["intendedUses","prohibitedUses","decisionSignificance"],"additionalProperties":false} | |
| $.purpose.intendedUses | true | / #/$defs/nonEmptyStrings | {} | |
| $.purpose.prohibitedUses | true | / #/$defs/nonEmptyStrings | {} | |
| $.purpose.decisionSignificance | true | string | {"minLength":20} | |
| $.stakeholders | true | array | {"minItems":1} | |
| $.stakeholders[] | false | object | {"required":["group","relationship","explanationNeed"],"additionalProperties":false} | |
| $.stakeholders[].group | true | string | {"minLength":1} | |
| $.stakeholders[].relationship | true | string | {"minLength":1} | |
| $.stakeholders[].explanationNeed | true | string | {"minLength":10} | |
| $.components | true | array | {"minItems":1} | |
| $.components[] | false | object | {"required":["componentId","type","provider","version"],"additionalProperties":false} | |
| $.components[].componentId | true | string | {} | |
| $.components[].type | true | {"enum":["model","rule","retrieval","tool","dataset","human-process","other"]} | ||
| $.components[].provider | true | string | {} | |
| $.components[].version | true | string | {} | |
| $.data | true | object | {"required":["lineageRecordIds","sensitiveData","knownLimits"],"additionalProperties":false} | |
| $.data.lineageRecordIds | true | / #/$defs/nonEmptyStrings | {} | |
| $.data.sensitiveData | true | boolean | {} | |
| $.data.knownLimits | true | / #/$defs/nonEmptyStrings | {} | |
| $.performance | true | array | {"minItems":1} | |
| $.performance[] | false | object | {"required":["metric","scope","value","thresholdDecision"],"additionalProperties":false} | |
| $.performance[].metric | true | string | {} | |
| $.performance[].scope | true | string | {} | |
| $.performance[].value | true | {} | ||
| $.performance[].value.oneOf[0] | false | number | {} | |
| $.performance[].value.oneOf[1] | false | string | {} | |
| $.performance[].thresholdDecision | true | {"enum":["pass","conditional","fail"]} | ||
| $.limitations | true | / #/$defs/nonEmptyStrings | {} | |
| $.humanOversight | true | object | {"required":["roles","interventions","escalation"],"additionalProperties":false} | |
| $.humanOversight.roles | true | / #/$defs/nonEmptyStrings | {} | |
| $.humanOversight.interventions | true | / #/$defs/nonEmptyStrings | {} | |
| $.humanOversight.escalation | true | string | {"minLength":10} | |
| $.transparency | true | object | {"required":["notice","explanationArtifacts","appealRoute"],"additionalProperties":false} | |
| $.transparency.notice | true | string | {"minLength":10} | |
| $.transparency.explanationArtifacts | true | / #/$defs/nonEmptyStrings | {} | |
| $.transparency.appealRoute | true | string | {"minLength":5} | |
| $.monitoring | true | object | {"required":["indicatorIds","reviewCadence","reopenTriggers"],"additionalProperties":false} | |
| $.monitoring.indicatorIds | true | / #/$defs/nonEmptyStrings | {} | |
| $.monitoring.reviewCadence | true | string | {"minLength":1} | |
| $.monitoring.reopenTriggers | true | / #/$defs/nonEmptyStrings | {} | |
| $.changeHistory | true | array | {"minItems":1} | |
| $.changeHistory[] | false | object | {"required":["version","changedAt","summary"],"additionalProperties":false} | |
| $.changeHistory[].version | true | string | {} | |
| $.changeHistory[].changedAt | true | string | {"format":"date-time"} | |
| $.changeHistory[].summary | true | string | {"minLength":10} | |
| $.owner | true | string | {"minLength":1} | |
| $.review | true | object | {"required":["status","reviewedAt","reviewedBy","validUntil"],"additionalProperties":false} | |
| $.review.status | true | {"enum":["accepted","conditional","rejected"]} | ||
| $.review.reviewedAt | true | string | {"format":"date-time"} | |
| $.review.reviewedBy | true | string | {"minLength":1} | |
| $.review.validUntil | true | string | {"format":"date-time"} | |
| $.$defs.nonEmptyStrings | false | array | {"minItems":1,"uniqueItems":true} | |
| $.$defs.nonEmptyStrings[] | false | string | {"minLength":1} |
PALO PolicyWatcher Signal Batch
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","mode","locale","count","limit","hasMore","nextCursor","signals","boundary"],"additionalProperties":false} | |
| $.format | true | {"const":"palo-policywatcher-signal-batch"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.mode | true | {"const":"complete-active-snapshot"} | ||
| $.locale | true | {"enum":["en","it"]} | ||
| $.count | true | integer | {"minimum":0,"maximum":25} | |
| $.limit | true | integer | {"minimum":1,"maximum":25} | |
| $.hasMore | true | boolean | {} | |
| $.nextCursor | true | {} | ||
| $.nextCursor.oneOf[0] | false | string | {"pattern":"^[A-Za-z0-9_-]{1,256}$"} | |
| $.nextCursor.oneOf[1] | false | null | {} | |
| $.signals | true | array | {"maxItems":25} | |
| $.signals[] | false | / https://paloframework.org/schemas/policywatcher-signal.schema.json | {} | |
| $.boundary | true | string | {"minLength":80,"maxLength":1000} |
PALO PolicyWatcher Monitoring Signal
Canonical schema · Inspected schema snapshot
| Schema path | Required in parent | Type or reference | Values and constraints | Description |
|---|---|---|---|---|
| $ | false | object | {"required":["format","schemaVersion","signalId","observedAt","source","summary","changeType","subjects","confidence","authority","suggestedHandoff"],"additionalProperties":true} | |
| $.format | true | {"const":"palo-policywatcher-signal"} | ||
| $.schemaVersion | true | {"const":"1.0.0"} | ||
| $.signalId | true | string | {"pattern":"^signal-[a-z0-9-]+$"} | |
| $.observedAt | true | string | {"format":"date-time"} | |
| $.source | true | object | {"required":["sourceId","title","url","publisher","checkedAt"],"additionalProperties":true} | |
| $.source.sourceId | true | string | {} | |
| $.source.title | true | string | {} | |
| $.source.url | true | string | {"format":"uri"} | |
| $.source.publisher | true | string | {} | |
| $.source.checkedAt | true | string | {"format":"date-time"} | |
| $.summary | true | string | {"minLength":1} | |
| $.changeType | true | {"enum":["new-publication","amendment","guidance","enforcement","consultation","correction","unknown"]} | ||
| $.subjects | true | array | {"minItems":1,"uniqueItems":true} | |
| $.subjects[] | false | string | {} | |
| $.jurisdictions | false | array | {"uniqueItems":true} | |
| $.jurisdictions[] | false | string | {} | |
| $.confidence | true | object | {"required":["level","score","rationale"],"additionalProperties":true} | |
| $.confidence.level | true | {"enum":["low","medium","high"]} | ||
| $.confidence.score | true | number | {"minimum":0,"maximum":1} | |
| $.confidence.rationale | true | string | {"minLength":1} | |
| $.authority | true | object | {"required":["status","disclaimer"],"additionalProperties":true} | |
| $.authority.status | true | {"const":"non-authoritative-monitoring-signal"} | ||
| $.authority.disclaimer | true | string | {"minLength":20} | |
| $.suggestedHandoff | true | object | {"required":["module","eventName","reviewGateIds"],"additionalProperties":true} | |
| $.suggestedHandoff.module | true | {"const":"PALO_RegulatoryWatch"} | ||
| $.suggestedHandoff.eventName | true | {"const":"palo:policywatcher:signal"} | ||
| $.suggestedHandoff.reviewGateIds | true | array | {"minItems":1,"uniqueItems":true} | |
| $.suggestedHandoff.reviewGateIds[] | false | {"enum":["frame","classify","assess","control","measure","prove"]} |
Verification
This catalogue preserves the earlier inspected snapshot. See the subsequent six-source review, current source registry and current control packs for source-maintenance updates.
61 JSON fixture classifications matched expectation. The core RDF valid fixture conformed; the invalid fixture returned 10 violations. All 40 core release item digests matched. These checks are scoped to the acquired snapshot.