@@ -11,9 +11,20 @@ package schemas
1111 contacts : #Contacts
1212
1313 scope : #Scope
14+ // ImportedPolicies: References to other Layer 3 Policy documents for policy composition.
15+ // When a policy imports another policy via ImportedPolicies:
16+ // * ImplementationPlan: Inherited, evaluators are ADDITIVE (union) if child also defines evaluators
17+ // - Merged reference sets (can be modified):
18+ // * ControlReferences: Merged from imported policy, can be modified via ControlModifications
19+ // * GuidanceReferences: Merged from imported policy, can be modified via GuidelineModifications
20+ // - Modifications chain sequentially (e.g., Base → Parent → Child), preserving all modifications
1421 " imported-policies " ?: [...#PolicyMapping ] @go (ImportedPolicies ) @yaml (" imported-policies,omitempty " )
1522 " implementation-plan " ?: #ImplementationPlan @go (ImplementationPlan ) @yaml (" implementation-plan,omitempty " )
23+ // GuidanceReferences: References to Layer 1 Guidance documents (abstract, high-level guidance).
24+ // Modifications chain sequentially (e.g., Guidance → Parent → Child), preserving all modifications.
1625 " guidance-references " ?: [...#PolicyMapping ] @go (GuidanceReferences ) @yaml (" guidance-references " )
26+ // ControlReferences: References to Layer 2 Control catalogs (technology-specific, threat-informed controls).
27+ // Modifications chain sequentially (e.g., Catalog → Parent → Child), preserving all modifications.
1728 " control-references " ?: [...#PolicyMapping ] @go (ControlReferences ) @yaml (" control-references " )
1829}
1930
@@ -30,6 +41,9 @@ package schemas
3041 " notified-parties " ?: [...#NotificationGroup ] @go (NotifiedParties ) @yaml (" notified-parties,omitempty " )
3142
3243 " evaluation-timeline " : #ImplementationDetails @go (EvaluationTimeline ) @yaml (" evaluation-timeline " )
44+ // Evaluators: Actors (human or software) that perform assessments.
45+ // When importing policies: Inherited from imported policy, evaluators are ADDITIVE (union) if child also defines evaluators.
46+ // This prevents broken evaluator references in assessment requirements.
3347 evaluators ?: [...#Actor ] @go (Evaluators ) @yaml (" evaluators,omitempty " )
3448
3549 " enforcement-timeline " : #ImplementationDetails @go (EnforcementTimeline ) @yaml (" enforcement-timeline " )
@@ -45,6 +59,8 @@ package schemas
4559 notes ?: string
4660}
4761
62+ // Scope is descriptive metadata for tools.
63+ // When importing policies: Inherited from imported policy, but child's scope OVERRIDES parent's if defined.
4864#Scope : {
4965 // geopolitical boundaries such as region names or jurisdictions
5066 boundaries ?: [...string ]
@@ -54,12 +70,26 @@ package schemas
5470 providers ?: [...string ]
5571}
5672
57- // Layer 3 specific mapping that extends common Mapping with modifications
73+ // Layer 3 specific mapping that extends common Mapping with modifications.
74+ // Used by ImportedPolicies, GuidanceReferences, and ControlReferences.
75+ // Modifications chain sequentially when importing policies (e.g., Base → Parent → Child), preserving all modifications.
5876#PolicyMapping : {
5977 " reference-id " : string @go (ReferenceId ) @yaml (" reference-id " )
78+ // ControlModifications: Modify controls from referenced catalog/policy.
79+ // When used in ImportedPolicies: Modifies controls from imported policy's ControlReferences (sequential chain).
80+ // When used in ControlReferences: Modifies controls from referenced catalog (sequential chain).
6081 " control-modifications " ?: [...#ControlModifier ] @go (ControlModifications ) @yaml (" control-modifications,omitempty " )
82+ // AssessmentRequirementModifications: Modify assessment requirements (which have evaluators).
83+ // When used in ImportedPolicies: Modifies assessment requirements from imported policy's ControlReferences (sequential chain).
84+ // When used in ControlReferences: Modifies assessment requirements from referenced catalog (sequential chain).
6185 " assessment-requirement-modifications " ?: [...#AssessmentRequirementModifier ] @go (AssessmentRequirementModifications ) @yaml (" assessment-requirement-modifications,omitempty " )
86+ // GuidelineModifications: Modify guidelines from referenced guidance document.
87+ // When used in ImportedPolicies: Modifies guidelines from imported policy's GuidanceReferences (sequential chain).
88+ // When used in GuidanceReferences: Modifies guidelines from referenced guidance document (sequential chain).
6289 " guideline-modifications " ?: [...#GuidelineModifier ] @go (GuidelineModifications ) @yaml (" guideline-modifications,omitempty " )
90+ // StatementModifications: Modify statements within guidelines.
91+ // When used in ImportedPolicies: Modifies statements from imported policy's GuidanceReferences (sequential chain).
92+ // When used in GuidanceReferences: Modifies statements from referenced guidance document (sequential chain).
6393 " statement-modifications " ?: [...#StatementModifier ] @go (StatementModifications ) @yaml (" statement-modifications,omitempty " )
6494}
6595
@@ -145,6 +175,7 @@ package schemas
145175 " Consulted " |
146176 " Informed "
147177
178+ // ModType: Semantic modification types for policy tailoring.
148179#ModType : " increase-strictness " | " clarify " | " reduce-strictness " | " exclude "
149180
150181// ResolutionStrategy defines how to resolve conflicts when multiple evaluators produce different results
0 commit comments