wehub-resource-sync
26382a7ac6
CI / Clippy (push) Failing after 15m13s
CI / Test (ubuntu-latest) (push) Failing after 16m1s
CI / Test (macos-latest) (push) Has been cancelled
CI / Test (windows-latest) (push) Has been cancelled
CI / Build (no embeddings / no ORT) (push) Has been cancelled
CI / Format (push) Has been cancelled
CI / Cookbook (Node) (push) Has been cancelled
CI / Pi Extension (Node) (push) Has been cancelled
CI / Rust SDK (lean-ctx-client) (push) Has been cancelled
CI / Embed SDK (lean-ctx-sdk) (push) Has been cancelled
CI / Python SDK (leanctx) (push) Has been cancelled
CI / Hermes Plugin (Python) (push) Has been cancelled
CI / SDK Conformance Matrix (push) Has been cancelled
CI / Coverage (push) Has been cancelled
CI / cargo-deny (push) Has been cancelled
CI / Adversarial Safety (push) Has been cancelled
CI / Benchmarks (push) Has been cancelled
CI / Output-Quality Gate (eval A/B) (push) Has been cancelled
CI / Documentation (push) Has been cancelled
CI / CI Green (push) Has been cancelled
JetBrains Plugin / Actionlint (push) Has been cancelled
CodeQL / Analyze (actions) (push) Has been cancelled
CodeQL / Analyze (javascript-typescript) (push) Has been cancelled
CodeQL / Analyze (rust) (push) Has been cancelled
JetBrains Plugin / Validation (push) Has been cancelled
JetBrains Plugin / Build (push) Has been cancelled
JetBrains Plugin / Test (push) Has been cancelled
Security Check / Security Scan (push) Has been cancelled
85 lines
3.6 KiB
TOML
85 lines
3.6 KiB
TOML
# ISO/IEC 42001:2023 → LeanCTX mapping matrix (GL #424, H3 Epic A).
|
|
#
|
|
# Scope: Annex A controls that touch the context flow to models. The AIMS
|
|
# (management system) itself is organisational by definition — only the
|
|
# technically enforceable slices are claimed.
|
|
|
|
framework = "iso42001"
|
|
title = "ISO/IEC 42001:2023 — AI management system (Annex A controls)"
|
|
version_pin = "ISO/IEC 42001:2023 (first edition, 2023-12)"
|
|
pinned_on = "2026-06-11"
|
|
review_cycle_months = 6
|
|
disclaimer = "LeanCTX is tooling support for compliance work — not legal advice. 'Aligned' is a technical statement about enforceable controls, not a certification; ISO 42001 certification audits an organisation's management system, not a tool."
|
|
reference_pack = "iso42001-aligned"
|
|
|
|
[[controls]]
|
|
id = "ISO-A.6.2.6"
|
|
clause = "Annex A.6.2.6"
|
|
requirement = "AI system operation and monitoring: event logging during operation"
|
|
mechanism = "audit_event"
|
|
leanctx = "Always-on hash-chained audit trail + typed runtime event stream (governance events per OCP Part 5)"
|
|
evidence = "audit trail JSONL + event export"
|
|
coverage = "full"
|
|
test = "iso_a626_operation_logging_always_on"
|
|
|
|
[[controls]]
|
|
id = "ISO-A.7.4"
|
|
clause = "Annex A.7.4"
|
|
requirement = "Quality of data for AI systems: data is controlled before use"
|
|
mechanism = "pack_rule"
|
|
leanctx = "Policy-pack redaction + classification run sender-side before content enters context; declarative and reviewable"
|
|
evidence = "resolved pack redaction patterns + redaction fixtures in CI"
|
|
coverage = "partial"
|
|
gap = "LeanCTX controls runtime context data, not upstream dataset quality (completeness, representativeness)"
|
|
test = "iso_a74_context_data_is_filtered_before_use"
|
|
|
|
[[controls]]
|
|
id = "ISO-A.8.2"
|
|
clause = "Annex A.8.2"
|
|
requirement = "System documentation and information for users is available"
|
|
mechanism = "evidence_export"
|
|
leanctx = "Capability grant sets, resolved policy view (policy show), Context-IR and coverage reports are exportable artifacts"
|
|
evidence = "policy show/coverage output, IR documents"
|
|
coverage = "full"
|
|
test = "iso_a82_resolved_policy_is_exportable"
|
|
|
|
[[controls]]
|
|
id = "ISO-A.9.2"
|
|
clause = "Annex A.9.2"
|
|
requirement = "Processes for responsible use of AI are defined"
|
|
mechanism = "pack_rule"
|
|
leanctx = "Policy packs ARE the machine-enforced process definition: tool allow/deny, budgets, retention, redaction — versioned, inheritable, git-reviewable"
|
|
evidence = "pack TOML under version control + resolved chain"
|
|
coverage = "full"
|
|
test = "iso_a92_policy_pack_defines_enforced_process"
|
|
|
|
[[controls]]
|
|
id = "ISO-A.9.4"
|
|
clause = "Annex A.9.4"
|
|
requirement = "Intended use: the system is used as intended, misuse is addressed"
|
|
mechanism = "pack_rule"
|
|
leanctx = "Capability gate (default-deny) + deny_tools block out-of-scope operations; violations are recorded as tool_denied"
|
|
evidence = "denied-tool audit entries + capability check results"
|
|
coverage = "full"
|
|
test = "iso_a94_out_of_scope_use_is_blocked_and_recorded"
|
|
|
|
[[controls]]
|
|
id = "ISO-A.10.3"
|
|
clause = "Annex A.10.3"
|
|
requirement = "Suppliers/third parties: responsibilities in the AI lifecycle are addressed"
|
|
mechanism = "none"
|
|
leanctx = "Contractual/organisational; LeanCTX evidence bundles can be handed to suppliers but the duty itself is not enforceable by tooling"
|
|
evidence = "n/a"
|
|
coverage = "none"
|
|
gap = "Organisational measure — supplier contracts and reviews"
|
|
|
|
[[controls]]
|
|
id = "ISO-A.5.2"
|
|
clause = "Annex A.5.2"
|
|
requirement = "AI system impact assessment is performed and documented"
|
|
mechanism = "none"
|
|
leanctx = "Assessment is a human activity; coverage reports and Context-IR feed it with facts but do not replace it"
|
|
evidence = "n/a"
|
|
coverage = "none"
|
|
gap = "Human assessment — LeanCTX artifacts serve as inputs"
|