/data/index.json
(see join_hints), resolve every concept through
/ids.json, and traverse
multi-hop associations via
/ontology/edges.json.
Do not invent a second edges file under /data/; the
knowledge layer already owns that graph.
Canonical ID namespaces
| Prefix | Means | Example |
|---|---|---|
srf.layer.* | Architecture layer | srf.layer.L3 |
srf.opmodel.* | Operating model | srf.opmodel.ai-paas |
srf.role.* | Persona or sector specialization | srf.role.clinical-ai-governance |
srf.control.<vertical>.* | Vertical control (namespaced because short IDs collide) | srf.control.defense.SRF-L1-ACQ-001 |
ext.framework.* | External regulation or standard | ext.framework.eu-ai-act |
srf.jurisdiction.* | Jurisdiction vocabulary entry | srf.jurisdiction.us-federal |
Preferred edge relations
| Relation | From | To | Source field |
|---|---|---|---|
governed_by |
control | regulation | control.mappings.<mapping_key> joined to regulations.mapping_key |
accountable_to |
control | persona / specialization | control.accountable_persona |
specializes |
sector specialization | canonical persona | personas.sector_specializations[].specializes |
issued_in_jurisdiction |
regulation | jurisdiction | regulations[].jurisdiction |
superseded_by |
rescinded regulation | replacing regulation | regulations[].superseded_by |
applies_to_layer |
control | layer | control.layer |
applies_in_operating_model |
control | operating model | control.operating_models[] (canonical four only) |
Control ID collision rule
The short form SRF-L1-ACQ-001 appears in more than one
vertical. Always use the namespaced ID
srf.control.<vertical>.<id> when joining,
citing, or storing a reference. The short form stays on the control
record for human-facing pages.
Regulation mapping_key
Vertical controls cite instruments through a free-form
mappings object whose keys are not themselves regulation
IDs. Each regulations.json item that is citeable from a
control carries a mapping_key that matches those keys
exactly (for example eu_ai_act, hipaa,
m_25_21). The generator emits a
governed_by edge only when the citation is a real string;
placeholders such as TBD or N/A are skipped.
Items with depth: "full" are first-class catalog entries,
read against the primary source and stamped with
last_verified. Items with depth: "reference"
exist so a control citation can resolve; they carry
verification_status instead and their metadata may still
be thin.
lifecycle says whether the instrument can be relied on. It
is absent while the instrument is in force, draft while the
text can still change, and rescinded once the issuer
withdrew it. A rescinded item stays in the catalog with
superseded_by naming its replacement, so a mapping written
against the old text resolves forward instead of dead-ending: the OCC
Model Risk Management handbook booklet points at sr-26-2,
the revised interagency guidance that replaced it in April 2026.
Sector persona specializations
Healthcare controls assign accountability to clinical names such as
clinical-ai-governance. Those names are declared under
personas.sector_specializations, each with a
specializes pointer to one of the eight canonical
personas. They are not additional personas; the canonical count
stays at eight.
Jurisdiction to vertical join
Control schemas are vertical-specific. The regulations catalog is shared: one instrument can appear in several verticals when those schemas cite it. Prefer the ontology edges for agents.
| Path | How | Use when |
|---|---|---|
| Declared |
jurisdiction →
issued_in_jurisdiction →
regulation →
applies_to_vertical →
srf.vertical.*
(from applicable_verticals)
|
Comparative questions. When controls cite the instrument, the list is those citing verticals; otherwise an author sector or cross-cutting scope (UK, China, Singapore, Japan, Australia, Korea, Brazil, India, OECD) |
| Evidence |
jurisdiction → regulation ←
governed_by ←
control →
belongs_to_vertical →
vertical
|
What the published control schemas actually cite today |
Sector instruments (HIPAA, NAIC, CMMC) list one vertical. Cited cross-cutting instruments list only the verticals that map them today (for example ISO 42001 → manufacturing). Uncited horizontal instruments may still list all six so comparative jurisdiction queries resolve.
Moral orientation tags
/data/moral-regulatory-hierarchy.json
tags concrete requirements inside priority instruments with
independent 0-3 salience on three dimensions:
| Dimension | Focus | Typical signals |
|---|---|---|
actor |
Character, duties, competence of people or organizations | Named accountability, due diligence, professional obligations |
action |
Rightness of the act itself | Absolute bans, mandatory process, human-oversight gates |
outcome |
Foreseeable or actual impacts and harms | Risk-tiering, performance thresholds, continuous monitoring |
Salience scores are independent (not a partition that sums to 1).
Each requirement carries a rationale. Instrument-level rollups use
maximum salience per dimension so a strongly action-oriented article
inside a hybrid statute is not averaged away. Ontology edges:
part_of (requirement to instrument),
emphasizes (requirement to srf.moral.*,
with a salience property), and
implements (control to requirement when a mapping
citation matches). This is a descriptive analytical lens, not a claim
that any country is one moral type.
implements refines governed_by: it only fires
for a requirement of the instrument the citation is filed under, so
every implements edge has a governed_by edge
beside it from the same control. Requirements with no implementing
control are listed in unmatched_expected with a reason,
which keeps a genuine absence (the EU AI Act Article 5 bans are not a
control duty) distinct from a citation pattern that stopped matching.
What this page is not
This page documents the join conventions that already ship. A fuller schema viewer (evidence manifests, RACI export templates, JSON-LD packaging) remains planned for v2.0 and is tracked separately.