Repository navigation
data_validation: key mapping rows on AIBOM Generator field ids - #108
Open
astrogilda wants to merge 15 commits into
Open
astrogilda wants to merge 15 commits into
astrogilda wants to merge 15 commits into
Conversation
Signed-off-by: Sankalp Gilda <23521054+astrogilda@users.noreply.github.com>
Add evidence_mapping_check, a shared check that replays the corpus a framework_alignments row cites with its reference verifier, checks the cited requirement exists and tests the row's control, and runs from run_all_checks. Allow test_records and OWASP MCP Top 10 in the risk assessment schema. Signed-off-by: Sankalp Gilda <23521054+astrogilda@users.noreply.github.com>
Signed-off-by: Sankalp Gilda <23521054+astrogilda@users.noreply.github.com>
…ange The schema checksum recorded in croissant.json no longer matched schema.json. Regenerated with data_validation/croissant/build_croissant.py. Signed-off-by: Sankalp Gilda <23521054+astrogilda@users.noreply.github.com>
Add aibom_fields.csv, one row per field in the OWASP AIBOM Generator's field_registry.json with the CycloneDX path it writes the field to. update_reference_data.py regenerates it from the registry at the generator's current main commit and records that commit in SOURCES.md. Signed-off-by: Sankalp Gilda <23521054+astrogilda@users.noreply.github.com>
A mapping row may carry aibom_field, an id from the AIBOM Generator's field_registry.json. The check fails when the id is not in the registry, or when the registry gives the field no CycloneDX location so the generator never writes it. Registered in run_all_checks.py. Signed-off-by: Sankalp Gilda <23521054+astrogilda@users.noreply.github.com>
Add the optional aibom_field property to framework_alignments and set it on the 43 rows whose control is evidenced by a field the generator writes, such as datasets, metric and safetyRiskAssessment. Regenerate croissant.json for the schema change. Signed-off-by: Sankalp Gilda <23521054+astrogilda@users.noreply.github.com>
The monthly refresh now includes aibom_fields.csv, passes the workflow token to the GitHub API call that finds the generator's current commit, and names the table in the issue it opens. Signed-off-by: Sankalp Gilda <23521054+astrogilda@users.noreply.github.com>
A framework_alignments row may carry aibom_field_none instead of aibom_field, giving one of three reasons: deployment-control (the deploying organisation meets the control with its own systems, processes or legal obligations), runtime-behaviour (the control is about what the running application does with live inputs and outputs) or no-registry-field (the control is about the model, but field_registry.json has no field for it). The check fails an unknown reason and a row that carries both keys. Regenerate croissant.json for the schema change. Signed-off-by: Sankalp Gilda <23521054+astrogilda@users.noreply.github.com>
Key the EU AI Act Annex III and Article 5 rows on intendedUse, since both turn on the intended purpose the model card's use cases declare; GDPR Article 22 and OWASP LLM06 Excessive Agency on autonomyType, which records the human involvement the system requires; and NIST AI RMF MAP 4.1 on licenses, since that control maps the legal and intellectual property risk of third-party components. Signed-off-by: Sankalp Gilda <23521054+astrogilda@users.noreply.github.com>
… field Mark 61 rows deployment-control: NIST CSF 2.0 protect, detect and respond rows, SOC 2, ISO/IEC 27001 Annex A operational controls, HIPAA, PCI DSS, MITRE ATT&CK, OWASP Agentic AGT-01 and AGT-02, and OWASP LLM08. The deploying organisation meets each with its own identity, encryption, network, monitoring and incident response, which an AIBOM of the model does not record. Signed-off-by: Sankalp Gilda <23521054+astrogilda@users.noreply.github.com>
…no AIBOM field Mark the AI governance and legal obligation rows deployment-control: NIST AI RMF GOVERN 1.5, GOVERN 5.1 and MANAGE 3.2, ISO/IEC 42001 A.6.1.2 and A.6.1.4, ISO/IEC 27001 A.5.31, GDPR Articles 5(1)(c), 6, 25, 28 and 35, FERPA, and EU AI Act Articles 26 and 49. Each is an obligation of the deploying organisation (a policy, a role, a lawful basis, a processor contract, a DPIA, a registration), which an AIBOM of the model does not record. Signed-off-by: Sankalp Gilda <23521054+astrogilda@users.noreply.github.com>
…field Mark the OWASP LLM Top 10 rows LLM01, LLM02, LLM05, LLM07 and LLM10, EU AI Act Article 50 and GDPR Article 5(1)(d) runtime-behaviour. Each is met by what the running application does with live inputs and outputs (injection detection, disclosure filtering, output handling, labelling generated content, rate limits), which a static AIBOM does not record. Signed-off-by: Sankalp Gilda <23521054+astrogilda@users.noreply.github.com>
…e yet Mark NIST AI RMF MEASURE 2.6 and MEASURE 2.7 (security evaluation of the AI system) and NIST CSF PR.DS-06 (integrity checking) no-registry-field. Each concerns the model itself, but field_registry.json has no field for security evaluation results or for a hash of the model weights, although CycloneDX can carry both. Signed-off-by: Sankalp Gilda <23521054+astrogilda@users.noreply.github.com>
Every row in a framework_alignments list now carries aibom_field or aibom_field_none, so a new row cannot land without saying which generated AIBOM field evidences its control, or why none does. All 178 rows in the risk assessment entries and example.json pass. Signed-off-by: Sankalp Gilda <23521054+astrogilda@users.noreply.github.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A mapping row can now carry
aibom_field, an id from the AIBOM Generator'sfield_registry.json, such as datasets or metric. This builds on PR 106, whose four commits come first. The new check fails an id the registry lacks and names the nearest one. It also fails paper, vcs and website, because the registry gives them no CycloneDX location.The 50 ids come from the generator at commit 45851cb96dbe, and the reference-data refresh workflow regenerates them each month. The commit that keys rows covers 43 of the 165 risk assessment rows, the ones where the generator writes evidence for the control. The check compares ids against the registry's list and does not build a BOM.