agent-threat-rules 3.1.0 → 3.2.0

package/spec/atr-schema.yaml

@@ -230,6 +230,129 @@ properties:
           type: string
         description: "Research paper references or URLs"
 
+  # === Compliance (audit-grade regulatory mappings) ===
+
+  compliance:
+    type: object
+    description: >
+      Audit-grade mappings to published regulatory / governance frameworks. Distinct
+      from `references:` (academic citations): every item carries auditor-readable
+      `context` prose plus an optional `strength`. An ATR rule is runtime detection
+      EVIDENCE supporting a control, NOT a compliance guarantee. Framework identifiers
+      are validated against data/compliance-frameworks/*.json by
+      scripts/validate-compliance.ts (npm run validate:compliance). Omit the block
+      entirely if no framework genuinely applies — never invent a mapping to hit 100%.
+    properties:
+      eu_ai_act:
+        type: array
+        description: "EU AI Act (Reg 2024/1689) high-risk obligations. Allowlist: eu_ai_act.json."
+        items:
+          type: object
+          required: [article, context]
+          properties:
+            article:
+              type: string
+              description: "Article number as a string, e.g. \"15\"."
+            context:
+              type: string
+              description: "How this rule provides detection evidence for the article. Auditor-readable."
+            strength:
+              type: string
+              enum: [primary, secondary, partial]
+      nist_ai_rmf:
+        type: array
+        description: "NIST AI RMF 1.0 subcategories. Allowlist: nist_ai_rmf.json."
+        items:
+          type: object
+          required: [subcategory, context]
+          properties:
+            subcategory:
+              type: string
+              description: "Subcategory ID, e.g. MS.2.7."
+            function:
+              type: string
+              enum: [Govern, Map, Measure, Manage]
+              description: "Optional parent function."
+            context:
+              type: string
+            strength:
+              type: string
+              enum: [primary, secondary, partial]
+      iso_42001:
+        type: array
+        description: >
+          ISO/IEC 42001:2023 management-system clauses (4-10). Clause 8 (Operation)
+          has ONLY 8.1-8.4 — 8.5/8.6 do not exist. Allowlist: iso_42001.json.
+        items:
+          type: object
+          required: [clause, context]
+          properties:
+            clause:
+              type: string
+              description: "Clause number as a string, e.g. \"8.1\"."
+            context:
+              type: string
+            strength:
+              type: string
+              enum: [primary, secondary, partial]
+      owasp_llm:
+        type: array
+        description: "Audit-context mirror of references.owasp_llm. IDs LLMxx:2025. Allowlist: owasp_llm.json."
+        items:
+          type: object
+          required: [id, context]
+          properties:
+            id:
+              type: string
+            context:
+              type: string
+            strength:
+              type: string
+              enum: [primary, secondary, partial]
+      owasp_agentic:
+        type: array
+        description: "Audit-context mirror of references.owasp_agentic. IDs ASIxx:2026. Allowlist: owasp_agentic.json."
+        items:
+          type: object
+          required: [id, context]
+          properties:
+            id:
+              type: string
+            context:
+              type: string
+            strength:
+              type: string
+              enum: [primary, secondary, partial]
+      colorado_ai_act:
+        type: array
+        description: >
+          Colorado AI Act SB24-205 — applies ONLY to consequential decisions
+          (employment, lending, insurance, housing, etc.). Do NOT map a rule here
+          unless it genuinely concerns a consequential-decision system. Allowlist TBD.
+        items:
+          type: object
+          required: [context]
+          properties:
+            section:
+              type: string
+            clause:
+              type: string
+            context:
+              type: string
+            strength:
+              type: string
+              enum: [primary, secondary, partial]
+      etsi_ts_104223:
+        type: array
+        description: "ETSI TS 104 223 principle / sub-principle identifiers. Allowlist TBD."
+        items:
+          type: object
+      nist_csf:
+        type: array
+        description: "NIST CSF 2.0 subcategory identifiers (e.g., DE.CM-09). Allowlist TBD."
+        items:
+          type: object
+
   # === Tags (ATR classification) ===
 
   tags:

package/spec/compliance-metadata.md

@@ -39,10 +39,11 @@ compliance:
       strength: primary
 
   eu_ai_act:
-    - article: 12               # Required. Article number (integer).
-      clause: "Automatic logging for high-risk AI systems"  # Required. Short name.
-      context: "..."            # Required. How this rule satisfies the clause.
-      strength: primary
+    - article: "12"             # Required. Article number as a STRING, e.g. "12".
+      context: "..."            # Required. How this rule provides detection EVIDENCE
+                                # for the article (not "satisfies" — ATR is evidence,
+                                # not a compliance guarantee).
+      strength: primary         # Optional. primary | secondary | partial.
 
   colorado_ai_act:
     - section: "SB24-205.5"     # Required. Section identifier.
@@ -51,14 +52,14 @@ compliance:
       strength: primary
 
   nist_ai_rmf:
-    - function: "Manage"        # Required. Govern | Map | Measure | Manage.
-      subcategory: "MG.2.3"     # Required. Full subcategory ID.
+    - subcategory: "MG.2.3"     # Required. Full subcategory ID.
+      function: "Manage"        # Optional. Govern | Map | Measure | Manage.
       context: "..."
       strength: primary
 
   iso_42001:
-    - clause: "6.2"             # Required. AIMS clause (e.g. 6.2, 9.1).
-      clause_name: "Risk treatment"  # Required. Human-readable name.
+    - clause: "6.2"             # Required. AIMS clause as a STRING (e.g. "6.2", "8.1").
+                                # Clause 8 (Operation) has ONLY 8.1-8.4 — 8.5/8.6 do not exist.
       context: "..."
       strength: primary
 ```
@@ -90,8 +91,9 @@ A rule can have entries in both blocks — e.g., `references.mitre_atlas` AND `c
 
 ## Validation
 
-- `scripts/validate-compliance.mjs` (to be added) validates every `compliance:` block against a per-framework allowlist of valid IDs / articles / subcategories / clauses. Rules with invalid entries fail CI.
-- The allowlists live in `data/compliance-frameworks/*.json` — one file per framework — and are updated via PR when a framework publishes revisions.
+- `scripts/validate-compliance.ts` (shipped 2026-06-05; `npm run validate:compliance`) validates every `compliance:` block against a per-framework allowlist of valid IDs / articles / subcategories / clauses. Rules with invalid entries fail CI (wired into `.github/workflows/validate.yml`). It requires non-empty `context` on every item and a valid `strength` enum.
+- The allowlists live in `data/compliance-frameworks/*.json` — one file per framework — and are updated via PR when a framework publishes revisions. Frameworks used in rules but without an allowlist file are reported as warnings (not failures), so allowlists can be added incrementally.
+- The canonical machine-readable shape is in `spec/atr-schema.yaml` under `properties.compliance`. Where this illustrative document and the schema differ, the schema + validator win.
 
 ## Downstream consumers
 
@@ -120,6 +122,6 @@ All downstream consumers are welcome — the `compliance:` block is MIT-licensed
 1. 2026-04-22: this spec document merged
 2. 2026-04-W4: 10 sample rules carry `compliance:` block for OWASP Agentic + OWASP LLM (bootstrap from existing `references:` data)
 3. 2026-05: 50 rules extended across all 6 frameworks (LLM-assisted authoring + human QA)
-4. 2026-Q2-end: all 311 rules mapped across at least the 3 most-requested frameworks (EU AI Act, NIST AI RMF, OWASP Agentic)
-5. 2026-Q3: remaining frameworks (Colorado, ISO 42001, OWASP LLM) complete
-6. Ongoing: new ATR rules MUST include `compliance:` from day 1 (enforced by contribution checklist)
+4. 2026-06-05 status (462 rules): NIST AI RMF 96.1%, EU AI Act 39.6%, ISO 42001 38.3%. Validator + allowlists + schema shipped; 72 fabricated ISO clauses (8.5/8.6) corrected to 8.1. Run `npm run audit:mappings` for live coverage.
+5. In progress: honest full-coverage backfill — every rule mapped to every framework control that GENUINELY applies, with rule-specific context. Frameworks that cannot honestly reach 100% (Colorado AI Act, ETSI) stay partial by design; see docs/COMPLIANCE-COVERAGE-POLICY.md.
+6. Ongoing: new ATR rules SHOULD include `compliance:` from day 1; CI (`validate:compliance`) blocks any rule that cites a non-existent framework identifier.