Skip to content

Commit 7664dbe

Browse files
committed
docs: adds comments to layer 3 about inheritance behavior
Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
1 parent 2c8f34f commit 7664dbe

File tree

2 files changed

+66
-2
lines changed

2 files changed

+66
-2
lines changed

generated_types.go

Lines changed: 34 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

schemas/layer-3.cue

Lines changed: 32 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,20 @@ package schemas
1111
contacts: #Contacts
1212

1313
scope: #Scope
14+
// ImportedPolicies: References to other Layer 3 Policy documents for policy composition.
15+
// When a policy imports another policy via ImportedPolicies:
16+
// * ImplementationPlan: Inherited, evaluators are ADDITIVE (union) if child also defines evaluators
17+
// - Merged reference sets (can be modified):
18+
// * ControlReferences: Merged from imported policy, can be modified via ControlModifications
19+
// * GuidanceReferences: Merged from imported policy, can be modified via GuidelineModifications
20+
// - Modifications chain sequentially (e.g., Base → Parent → Child), preserving all modifications
1421
"imported-policies"?: [...#PolicyMapping] @go(ImportedPolicies) @yaml("imported-policies,omitempty")
1522
"implementation-plan"?: #ImplementationPlan @go(ImplementationPlan) @yaml("implementation-plan,omitempty")
23+
// GuidanceReferences: References to Layer 1 Guidance documents (abstract, high-level guidance).
24+
// Modifications chain sequentially (e.g., Guidance → Parent → Child), preserving all modifications.
1625
"guidance-references"?: [...#PolicyMapping] @go(GuidanceReferences) @yaml("guidance-references")
26+
// ControlReferences: References to Layer 2 Control catalogs (technology-specific, threat-informed controls).
27+
// Modifications chain sequentially (e.g., Catalog → Parent → Child), preserving all modifications.
1728
"control-references"?: [...#PolicyMapping] @go(ControlReferences) @yaml("control-references")
1829
}
1930

@@ -30,6 +41,9 @@ package schemas
3041
"notified-parties"?: [...#NotificationGroup] @go(NotifiedParties) @yaml("notified-parties,omitempty")
3142

3243
"evaluation-timeline": #ImplementationDetails @go(EvaluationTimeline) @yaml("evaluation-timeline")
44+
// Evaluators: Actors (human or software) that perform assessments.
45+
// When importing policies: Inherited from imported policy, evaluators are ADDITIVE (union) if child also defines evaluators.
46+
// This prevents broken evaluator references in assessment requirements.
3347
evaluators?: [...#Actor] @go(Evaluators) @yaml("evaluators,omitempty")
3448

3549
"enforcement-timeline": #ImplementationDetails @go(EnforcementTimeline) @yaml("enforcement-timeline")
@@ -45,6 +59,8 @@ package schemas
4559
notes?: string
4660
}
4761

62+
// Scope is descriptive metadata for tools.
63+
// When importing policies: Inherited from imported policy, but child's scope OVERRIDES parent's if defined.
4864
#Scope: {
4965
// geopolitical boundaries such as region names or jurisdictions
5066
boundaries?: [...string]
@@ -54,12 +70,26 @@ package schemas
5470
providers?: [...string]
5571
}
5672

57-
// Layer 3 specific mapping that extends common Mapping with modifications
73+
// Layer 3 specific mapping that extends common Mapping with modifications.
74+
// Used by ImportedPolicies, GuidanceReferences, and ControlReferences.
75+
// Modifications chain sequentially when importing policies (e.g., Base → Parent → Child), preserving all modifications.
5876
#PolicyMapping: {
5977
"reference-id": string @go(ReferenceId) @yaml("reference-id")
78+
// ControlModifications: Modify controls from referenced catalog/policy.
79+
// When used in ImportedPolicies: Modifies controls from imported policy's ControlReferences (sequential chain).
80+
// When used in ControlReferences: Modifies controls from referenced catalog (sequential chain).
6081
"control-modifications"?: [...#ControlModifier] @go(ControlModifications) @yaml("control-modifications,omitempty")
82+
// AssessmentRequirementModifications: Modify assessment requirements (which have evaluators).
83+
// When used in ImportedPolicies: Modifies assessment requirements from imported policy's ControlReferences (sequential chain).
84+
// When used in ControlReferences: Modifies assessment requirements from referenced catalog (sequential chain).
6185
"assessment-requirement-modifications"?: [...#AssessmentRequirementModifier] @go(AssessmentRequirementModifications) @yaml("assessment-requirement-modifications,omitempty")
86+
// GuidelineModifications: Modify guidelines from referenced guidance document.
87+
// When used in ImportedPolicies: Modifies guidelines from imported policy's GuidanceReferences (sequential chain).
88+
// When used in GuidanceReferences: Modifies guidelines from referenced guidance document (sequential chain).
6289
"guideline-modifications"?: [...#GuidelineModifier] @go(GuidelineModifications) @yaml("guideline-modifications,omitempty")
90+
// StatementModifications: Modify statements within guidelines.
91+
// When used in ImportedPolicies: Modifies statements from imported policy's GuidanceReferences (sequential chain).
92+
// When used in GuidanceReferences: Modifies statements from referenced guidance document (sequential chain).
6393
"statement-modifications"?: [...#StatementModifier] @go(StatementModifications) @yaml("statement-modifications,omitempty")
6494
}
6595

@@ -145,6 +175,7 @@ package schemas
145175
"Consulted" |
146176
"Informed"
147177

178+
// ModType: Semantic modification types for policy tailoring.
148179
#ModType: "increase-strictness" | "clarify" | "reduce-strictness" | "exclude"
149180

150181
// ResolutionStrategy defines how to resolve conflicts when multiple evaluators produce different results

0 commit comments

Comments
 (0)