Relate controls to external requirements
An application may need to explain the same control to different reviewers. Wildo keeps its control objectives stable and places external source mappings in a separate reporting layer.
Mappings carry references, attribution and permitted use. The application’s access checks and data handling keep their own meaning instead of depending on a certification label.
Example — Explain an existing control to a new reviewer
A security control already has an implementation and evidence expectation. A mapping supplies the relevant external reference without changing the code path or suggesting that a mapping itself certifies the application.
For engineers
Resolve the source and its permitted use
deriveAssuranceExternalFrameworkMapping joins source requirements to the source registry. Before emitting the citation, it checks the registered permission at the evaluation time. Comments between these lines are omitted.
if (!metadataCitationAuthorized) {
throw new AssuranceExternalMappingRightsError(
`Cannot cite "${authority.source.sourceRef}": its rights record does not authorize STORE_METADATA as of ${evaluatedAt}. `
+ "Resolve the rights before publishing a mapping that names it.",
);
}
const contentUsePermission = source.rights.useDecisions.find((decision) => decision.use === AssuranceSourceUse.EXTRACT_CONTENT)?.permission
?? AssuranceSourceUsePermission.UNKNOWN;
attributionNotices.add(source.rights.attributionNotice);
const existing = citationsByObjective.get(authority.objective.objectiveRef as string) ?? [];
existing.push({
sourceRef: authority.source.sourceRef as string,
sourceTitle: source.canonicalTitle,
authorityKind: source.authorityKind,
requirementRef: authority.requirementRef as string,
canonicalLocator: authority.canonicalLocator,
reviewedByRef: authority.reviewedByRef as string,
reviewedAt: authority.reviewedAt,
rightsRef: source.rights.rightsRef as string,
attributionNotice: source.rights.attributionNotice,
metadataCitationAuthorized,
contentUsePermission,
});
citationsByObjective.set(authority.objective.objectiveRef as string, existing);
The result keeps the source locator, review attribution and content-use permission. Metadata permission does not automatically authorize copying source text. A source’s status and rights must support the use the report actually makes.
Keep the direction of dependency clear
Runtime code names Wildo objectives. The reporting boundary maps those objectives outward to sources; source names do not select production behavior. The generation lane can emit the mapping beside the basis it was derived from, keeping both tied to the same inputs.
Interpret a mapping as a reference
A mapping helps scope a review. It is not a legal conclusion, a complete assessment of applicability or an external certification. The application programme determines its commitments and supporting evidence; qualified assessment determines what those records establish in the relevant context.