@connexum/agent-standards 0.0.0-stage → 0.1.0-beta.2

package/catalogue/fit.json

@@ -0,0 +1,707 @@
+{
+  "version": "2026-10-20",
+  "note": "How the first scan decides, for every My-CC pack, whether an agent needs it, and for every requirement in a pack, whether it is required, recommended or not needed for that agent. The agent's sector comes from what the scan reads (purpose, tools, data classes, connections); a declared industry wins over the inferred one. A pack is fit when its sector matches the agent's (cross-industry and AI-specific packs fit every agent) and its jurisdiction covers where the agent's people are. Within a fit pack, a requirement that needs a capability the agent does not have (physical parts, cardholder data, PHI, ...) is not needed, with the reason. My-CC's own enforcement wins where a rule carries one (block = required, warn = recommended). Patterns are case-insensitive regular expressions shared by both languages. Overlaps: when two packs that fit the same agent both ask for the same thing (minimum necessary, de-identification, audit, access, breach notice, risk assessment, human oversight, consent and rights, vendor contracts, encryption), each requirement names the other packs that also cover it, so one control can satisfy several. Required means a law in force where the agent's people are, in the agent's sector or cross-industry, AND the scan found on the agent what the law regulates (a requirement of the pack touches a capability the agent has: PHI, privileged material, parts, billing, research subjects, a device, cardholder or personal data, ...). A sector match without that evidence is a recommendation, with the reason. Packs, and requirements, are only ever graded for agents that were scanned.",
+  "industries": [
+    {
+      "id": "Pharmaceutical",
+      "signals": [
+        "formulary",
+        "\\bdrug",
+        "\\bndc\\b",
+        "\\bgpi",
+        "medi-span",
+        "pharmac",
+        "rebate",
+        "p&t",
+        "biosimilar",
+        "\\bfda\\b",
+        "prescri",
+        "quantity limit"
+      ]
+    },
+    {
+      "id": "Healthcare",
+      "signals": [
+        "\\bphi\\b",
+        "patient",
+        "clinical",
+        "\\behr\\b",
+        "hospital",
+        "prior auth",
+        "medical",
+        "health plan",
+        "\\bmember",
+        "claims?\\b",
+        "denial",
+        "appeal"
+      ]
+    },
+    {
+      "id": "Legal",
+      "signals": [
+        "legal",
+        "case law",
+        "litigation",
+        "court",
+        "attorney",
+        "privileged",
+        "matter\\b",
+        "docket",
+        "brief\\b",
+        "discovery"
+      ]
+    },
+    {
+      "id": "Fintech",
+      "signals": [
+        "payment",
+        "cardholder",
+        "\\bcard\\b",
+        "transaction",
+        "\\bkyc\\b",
+        "\\baml\\b",
+        "wallet",
+        "\\bloan",
+        "credit"
+      ]
+    },
+    {
+      "id": "Financial",
+      "signals": [
+        "bank",
+        "securities",
+        "trading",
+        "portfolio",
+        "broker",
+        "ledger"
+      ]
+    },
+    {
+      "id": "Education",
+      "signals": [
+        "student",
+        "school",
+        "course",
+        "\\bgrade",
+        "ferpa",
+        "learner",
+        "curriculum"
+      ]
+    },
+    {
+      "id": "Government",
+      "signals": [
+        "agency",
+        "public sector",
+        "citizen",
+        "federal",
+        "municipal"
+      ]
+    },
+    {
+      "id": "Aerospace",
+      "signals": [
+        "aircraft",
+        "aviation",
+        "airworthiness",
+        "\\bfaa\\b",
+        "\\beasa\\b",
+        "avionics"
+      ]
+    },
+    {
+      "id": "Defense",
+      "signals": [
+        "defen[cs]e",
+        "\\bitar\\b",
+        "classified",
+        "\\bdod\\b",
+        "military"
+      ]
+    },
+    {
+      "id": "Industrial / OT",
+      "signals": [
+        "\\bplc\\b",
+        "scada",
+        "\\bics\\b",
+        "plant floor",
+        "sensor",
+        "operational technology"
+      ]
+    },
+    {
+      "id": "Automotive",
+      "signals": [
+        "vehicle",
+        "automotive",
+        "\\becu\\b",
+        "26262"
+      ]
+    },
+    {
+      "id": "Retail / Consumer",
+      "signals": [
+        "retail",
+        "shopper",
+        "e-?commerce",
+        "loyalty",
+        "storefront"
+      ]
+    },
+    {
+      "id": "Cybersecurity",
+      "signals": [
+        "vulnerabilit",
+        "\\bsiem\\b",
+        "threat",
+        "incident response",
+        "\\bcve\\b"
+      ]
+    },
+    {
+      "id": "Medical Device / SaMD",
+      "signals": [
+        "\\bsamd\\b",
+        "medical device",
+        "510\\(k\\)"
+      ]
+    },
+    {
+      "id": "Medical Laboratory / Clinical Diagnostics",
+      "signals": [
+        "lab result",
+        "specimen",
+        "\\bclia\\b",
+        "diagnostic"
+      ]
+    },
+    {
+      "id": "Hospital IT / Medical Device Networks",
+      "signals": [
+        "hospital network",
+        "biomed",
+        "\\bpacs\\b"
+      ]
+    }
+  ],
+  "related": {
+    "Pharmaceutical": [
+      "Healthcare"
+    ],
+    "Medical Device / SaMD": [
+      "Healthcare"
+    ],
+    "Medical Laboratory / Clinical Diagnostics": [
+      "Healthcare"
+    ],
+    "Hospital IT / Medical Device Networks": [
+      "Healthcare"
+    ],
+    "Fintech": [
+      "Financial"
+    ],
+    "Financial": [
+      "Fintech"
+    ]
+  },
+  "everySector": [
+    "Cross-Industry",
+    "AI-Specific"
+  ],
+  "regionSectors": {
+    "US": "us",
+    "EU": "eu",
+    "UK": "uk",
+    "APAC": "apac"
+  },
+  "regions": [
+    [
+      "^(global|international)",
+      "global"
+    ],
+    [
+      "colorado|us-co",
+      "us-co"
+    ],
+    [
+      "california|us-ca",
+      "us-ca"
+    ],
+    [
+      "illinois|us-il",
+      "us-il"
+    ],
+    [
+      "texas|us-tx",
+      "us-tx"
+    ],
+    [
+      "new york",
+      "us-ny"
+    ],
+    [
+      "florida",
+      "us-fl"
+    ],
+    [
+      "utah|us-ut",
+      "us-ut"
+    ],
+    [
+      "maryland|us-md",
+      "us-md"
+    ],
+    [
+      "tennessee|us-tn",
+      "us-tn"
+    ],
+    [
+      "^us|united states",
+      "us"
+    ],
+    [
+      "^(eu|european|de\\b|fr\\b)",
+      "eu"
+    ],
+    [
+      "^(uk|gb|united kingdom)",
+      "uk"
+    ],
+    [
+      "^(au|nz|cn|china|jp|japan|kr|sg|th|vn|in\\b|hk|apac)",
+      "apac"
+    ],
+    [
+      "^(ca\\b|canada)",
+      "ca"
+    ],
+    [
+      "^(br\\b|brazil)",
+      "br"
+    ]
+  ],
+  "capabilities": [
+    {
+      "id": "physical_goods",
+      "label": "physical parts or goods",
+      "requirement": [
+        "\\bparts\\b",
+        "manufactur",
+        "weld",
+        "heat treat",
+        "\\bndt\\b",
+        "plating",
+        "composites",
+        "\\bfod\\b",
+        "traveller",
+        "\\bspc\\b",
+        "serialized",
+        "lot-controlled",
+        "counterfeit",
+        "special processes",
+        "incoming inspection",
+        "airworthiness",
+        "warranty",
+        "on-time delivery",
+        "\\bppm\\b",
+        "first-pass yield",
+        "nadcap",
+        "product realisation",
+        "product safety",
+        "purchasing controls"
+      ],
+      "agent": [
+        "\\bparts (list|inventory|traceab|lookup)",
+        "parts\\.",
+        "inventory",
+        "shipment",
+        "manufacturing (line|process|plant|floor)",
+        "production line",
+        "warehouse",
+        "bill of materials"
+      ]
+    },
+    {
+      "id": "cardholder",
+      "label": "cardholder data",
+      "requirement": [
+        "cardholder",
+        "\\bpan\\b",
+        "payment card"
+      ],
+      "agent": [
+        "cardholder",
+        "payment card",
+        "\\bpan\\b"
+      ],
+      "dataClass": "cardholder"
+    },
+    {
+      "id": "phi",
+      "label": "protected health information",
+      "requirement": [
+        "\\bphi\\b",
+        "protected health",
+        "medical record",
+        "\\behr\\b",
+        "business associate",
+        "\\bbaa\\b"
+      ],
+      "agent": [
+        "\\bphi\\b",
+        "patient record",
+        "\\behr\\b"
+      ],
+      "dataClass": "phi"
+    },
+    {
+      "id": "personal",
+      "label": "personal data",
+      "requirement": [
+        "personal data",
+        "data subject",
+        "\\bpii\\b",
+        "right to erasure",
+        "\\bdpia\\b"
+      ],
+      "agent": [
+        "personal data",
+        "\\bpii\\b",
+        "customer record"
+      ],
+      "dataClass": "pii",
+      "impliedBy": [
+        "phi",
+        "cardholder"
+      ]
+    },
+    {
+      "id": "minors",
+      "label": "data about children or students",
+      "requirement": [
+        "\\bchild",
+        "minors?\\b",
+        "coppa",
+        "student record"
+      ],
+      "agent": [
+        "student",
+        "\\bchild",
+        "minor"
+      ]
+    },
+    {
+      "id": "ot_hardware",
+      "label": "operational technology or hardware",
+      "requirement": [
+        "\\bplc\\b",
+        "scada",
+        "firmware",
+        "safety instrumented",
+        "\\bot network"
+      ],
+      "agent": [
+        "\\bplc\\b",
+        "scada",
+        "firmware"
+      ]
+    },
+    {
+      "id": "model_training",
+      "label": "training or fine-tuning a model",
+      "requirement": [
+        "training data",
+        "fine-tun",
+        "dataset curation",
+        "model training"
+      ],
+      "agent": [
+        "fine-tun",
+        "training data",
+        "train(s|ing)? (a |the )?model"
+      ]
+    },
+    {
+      "id": "privileged",
+      "label": "privileged or attorney-client material",
+      "requirement": [
+        "privileged",
+        "attorney-client",
+        "client confiden"
+      ],
+      "agent": [
+        "privileged",
+        "attorney-client"
+      ],
+      "dataClass": "privileged"
+    },
+    {
+      "id": "clinical_research",
+      "label": "clinical research or human subjects",
+      "requirement": [
+        "\\birb\\b",
+        "clinical (trial|investigation|study)",
+        "human subjects?",
+        "informed consent",
+        "research subject"
+      ],
+      "agent": [
+        "clinical trial",
+        "research subject",
+        "\\birb\\b",
+        "study protocol"
+      ]
+    },
+    {
+      "id": "medical_device",
+      "label": "a regulated medical device or SaMD",
+      "requirement": [
+        "medical device",
+        "\\bsamd\\b",
+        "510\\(k\\)",
+        "62304",
+        "device master record",
+        "design history file",
+        "\\bqsr\\b",
+        "\\bqmsr\\b",
+        "premarket"
+      ],
+      "agent": [
+        "medical device",
+        "\\bsamd\\b",
+        "device firmware"
+      ]
+    },
+    {
+      "id": "billing",
+      "label": "billing, claims or payments to providers",
+      "requirement": [
+        "billing",
+        "claims? submission",
+        "reimbursement",
+        "kickback",
+        "\\bstark\\b",
+        "referral",
+        "surprise bill",
+        "good faith estimate",
+        "coding (accuracy|compliance)",
+        "\\bcpt\\b",
+        "\\bicd-10"
+      ],
+      "agent": [
+        "billing",
+        "claims? submission",
+        "reimbursement",
+        "\\bcpt\\b"
+      ]
+    },
+    {
+      "id": "drug_supply",
+      "label": "drug dispensing, distribution or the supply chain",
+      "requirement": [
+        "\\bdscsa\\b",
+        "\\b340b\\b",
+        "dispens",
+        "wholesale",
+        "distribution",
+        "serialization",
+        "transaction (history|information|statement)",
+        "covered entity purchas"
+      ],
+      "agent": [
+        "dispens",
+        "\\bdscsa\\b",
+        "wholesale",
+        "340b"
+      ]
+    },
+    {
+      "id": "manufacturing",
+      "label": "manufacturing, laboratory or trial operations (GxP)",
+      "requirement": [
+        "\\bgmp\\b",
+        "\\bglp\\b",
+        "\\bgcp\\b",
+        "batch record",
+        "laboratory practice",
+        "manufacturing practice",
+        "validation of (computeri[sz]ed )?systems used in"
+      ],
+      "agent": [
+        "\\bgmp\\b",
+        "batch record",
+        "laboratory"
+      ]
+    },
+    {
+      "id": "financial_reporting",
+      "label": "financial reporting controls",
+      "requirement": [
+        "financial reporting",
+        "\\bicfr\\b",
+        "ssae",
+        "\\bsoc 1\\b",
+        "general ledger"
+      ],
+      "agent": [
+        "financial reporting",
+        "general ledger",
+        "\\bicfr\\b"
+      ]
+    },
+    {
+      "id": "consumer",
+      "label": "consumer-facing claims or marketing",
+      "requirement": [
+        "deceptive",
+        "unfair",
+        "advertis",
+        "consumer (protection|claims)",
+        "endorsement",
+        "dark pattern"
+      ],
+      "agent": [
+        "consumer",
+        "marketing",
+        "advertis",
+        "customer-facing"
+      ]
+    },
+    {
+      "id": "interoperability",
+      "label": "patient access or interoperability APIs",
+      "requirement": [
+        "patient access api",
+        "\\bfhir\\b",
+        "interoperab",
+        "provider directory",
+        "payer-to-payer"
+      ],
+      "agent": [
+        "\\bfhir\\b",
+        "patient access",
+        "interoperab"
+      ]
+    },
+    {
+      "id": "conditions_of_participation",
+      "label": "operating a hospital or provider facility",
+      "requirement": [
+        "conditions of participation",
+        "\\bcop\\b",
+        "medical staff",
+        "nursing services",
+        "discharge planning"
+      ],
+      "agent": [
+        "hospital operations",
+        "discharge",
+        "nursing"
+      ]
+    }
+  ],
+  "lawTypes": [
+    "Law or regulation"
+  ],
+  "overlaps": [
+    {
+      "id": "minimum_necessary",
+      "label": "minimum necessary / data minimisation",
+      "patterns": [
+        "minimum necessary",
+        "minimi[sz]ation",
+        "data minimi",
+        "only the data"
+      ]
+    },
+    {
+      "id": "deidentification",
+      "label": "de-identification / pseudonymisation",
+      "patterns": [
+        "de-?identif",
+        "pseudonymi",
+        "anonymi",
+        "safe harbor"
+      ]
+    },
+    {
+      "id": "audit",
+      "label": "audit trail and logging",
+      "patterns": [
+        "audit",
+        "logging",
+        "record of processing",
+        "records of processing",
+        "traceab"
+      ]
+    },
+    {
+      "id": "access",
+      "label": "access control",
+      "patterns": [
+        "access control",
+        "least privilege",
+        "logical access",
+        "authori[sz]ation",
+        "authentication"
+      ]
+    },
+    {
+      "id": "breach",
+      "label": "breach or incident notification",
+      "patterns": [
+        "breach",
+        "incident (notification|response)",
+        "notify"
+      ]
+    },
+    {
+      "id": "risk",
+      "label": "risk or impact assessment",
+      "patterns": [
+        "risk (assessment|management)",
+        "impact assessment",
+        "\\bdpia\\b",
+        "\\bfmea\\b"
+      ]
+    },
+    {
+      "id": "human_oversight",
+      "label": "human oversight of automated decisions",
+      "patterns": [
+        "human (oversight|review|in the loop)",
+        "automated decision",
+        "right to (contest|appeal)"
+      ]
+    },
+    {
+      "id": "consent_rights",
+      "label": "consent and individual rights",
+      "patterns": [
+        "consent",
+        "opt-?out",
+        "right to (know|delete|erasure|access)",
+        "data subject"
+      ]
+    },
+    {
+      "id": "vendor",
+      "label": "vendor and contract controls",
+      "patterns": [
+        "business associate",
+        "\\bbaa\\b",
+        "processor agreement",
+        "\\bdpa\\b",
+        "vendor"
+      ]
+    },
+    {
+      "id": "encryption",
+      "label": "encryption",
+      "patterns": [
+        "encrypt"
+      ]
+    }
+  ]
+}

package/dist/applicability.d.ts

@@ -0,0 +1,13 @@
+import type { AgentProfile, Framework, FrameworkApplicability } from './types.js';
+/** The pack bound on the agent that carries this framework, if any (ids as My-CC publishes them; version suffixes ignored). */
+export declare function boundPackFor(fw: Framework, profile: AgentProfile): string | null;
+/** Does the framework fit this agent's industry, data, regions or tools? (Only used when its pack is not bound.) */
+export declare function fits(fw: Framework, profile: AgentProfile): boolean;
+/**
+ * Which frameworks apply to this agent, and how: 'always' (OWASP LLM, OWASP Agentic, My-CC runtime), 'installed' (its
+ * My-CC pack is bound to the agent), 'recommended' (it fits the industry, data or regions but no pack is bound; documented,
+ * not scored), 'not_applicable' (does not fit; omitted with the reason). Practice frameworks are My-CC checks with no pack:
+ * applicable when they fit.
+ */
+export declare function applicability(profile: AgentProfile): FrameworkApplicability[];
+//# sourceMappingURL=applicability.d.ts.map