Policy Configuration

The Asenion platform uses a hierarchical configuration system to define compliance policies, assessment controls, and scoring rules. This document covers the complete policy configuration schema.

Key Terminology:

  • A Policy is either mapped to a qualitative questionnaire (form) for policy alignment assessment (which contributes to the Policy Alignment Risk status) or it is mapped to a quantitative questionnaire (form) for recording test results (which contributes to the Technology Risk status).
  • A Policy has one or more Control Bundles. A Control Bundle belongs to a Control Objective.
  • A Control Bundle has one or more Controls. A control is mapped to a question. The question is used to assess or measure whether the control exists and if so, how effective the control is.

Table of Contents

Overview

A Policy in Asenion represents a regulatory framework or compliance standard (e.g., EU AI Act, NIST AI RMF, internal governance policies). Policies are composed of Control Bundles (logical groups of requirements) which in turn contain Controls (individual questions or requirements that users must answer).

Policy
├── Control Bundle 1
│   ├── Control A
│   ├── Control B
│   └── Control C
├── Control Bundle 2
│   ├── Control D
│   └── Control E
└── ...

The full policy configuration is a JSON document containing three top-level sections:

Section Description
organization The organization publishing the policy
policies One or more policy definitions with control bundle references and compliance levels
controlBundles The actual control bundle definitions including controls, answer options, and scoring

Top-Level Structure 

{
  "organization": { ... },
  "policies": [ ... ],
  "controlBundles": [ ... ]
}

Organization

Defines the organization that owns or publishes the policy.

Property Type Required Description
name string Yes Display name of the organization
identifier string Yes Unique reverse-domain identifier (e.g., com.example)
pgId string No External identifier used to link the organization to an external system or database

Example:

{
  "organization": {
    "name": "ABC",
    "identifier": "com.example",
    "pgId": "2"
  }
}

Policies

An array of policy definitions. Each policy groups multiple control bundles under a single compliance framework.

Policy Object

Property Type Required Description
name string Yes Display name of the policy
identifier string Yes Unique reverse-domain identifier for the policy (e.g., com.example.euaiact)
version string Yes Semantic version string (e.g., "1.0", "2.1")
description string No Human-readable description of the policy
link string No URL to the original regulation or standard
labels string[] No Tags for categorization, filtering, and report behavior (see Policy Labels)
controlBundles ControlBundleRef[] Yes References to control bundles included in this policy
compliance Compliance[] No Compliance level definitions with score ranges
dimensions PolicyDimension[] No Risk/scoring dimensions for multi-dimensional analysis
assessMethod string No Assessment methodology identifier
applicableProjectTypes ProjectType[] Yes Which project types this policy can be applied to
reportTemplateId string No ID of the report template to use when generating reports
isSystemLevel boolean No If true, the policy is system-wide and available to all organizations. Default: false
orgId string No Organization ID. Required for organization-level policies; omit for system-level policies
isArchived boolean No Archived policies are hidden from selection but not deleted. Managed through the platform rather than set in configuration. Default: false
policyLevel PolicyLevel Read-only Returned by the API as SYSTEM or ORGANIZATION. Derived automatically from isSystemLevel; do not set in config

Control Bundle Reference

Each entry in the controlBundles array is a lightweight reference (not the full bundle definition). The actual bundle is defined in the top-level controlBundles array.

Property Type Required Description
identifier string Yes Identifier of the control bundle to include
version string Yes Version of the control bundle to include

The platform resolves each reference to the matching bundle by identifier and version when the policy is loaded, so you do not supply an internal bundle ID.

Compliance Level

Compliance levels define named tiers based on aggregate assessment scores.

Property Type Required Description
level string Yes Display name of the compliance level (e.g., "Gold", "Certified")
compliant boolean Yes Whether this level qualifies as compliant
score_min number No Minimum score (inclusive) to achieve this level
score_max number No Maximum score (exclusive) for this level. Omit for the highest tier

Policy Dimension

Dimensions allow multi-dimensional scoring beyond a single aggregate score.

Property Type Required Description
identifier string Yes Unique identifier for the dimension
name string Yes Display name
description string No Description of what the dimension measures
thresholds number[] No Threshold values for bucketing scores
ds PolicyDimensionScore[] No Dimension score definitions
labels string[] No Tags for the dimension
aggregationType DimensionAggregationType Yes How scores are aggregated: SUM, AVG, MAX, MIN, or PERCENT

Policy Dimension Score

Property Type Required Description
name string No Display name for the score level
score number Yes The score value
description string No Description of this score level
type DimensionScoreType Yes Severity: NA, INFO, WARNING, or CRITICAL

Applicable Project Types

A policy must declare which project types it applies to. Available values:

Value Description
AI_SYSTEM Top-level AI system
FUNCTIONAL_MODEL Functional component of an AI system
MODEL_CANDIDATE ML model being evaluated
MODEL_CHAMPION Champion ML model (selected winner)
AGENT_CANDIDATE AI agent being evaluated
VENDOR_AGENT Third-party vendor AI agent
VENDOR_MODEL Third-party vendor model
DATASET Dataset used by an AI system
ORGANIZATION Organization-level assessment

Policy Labels

Labels on a policy do two things: they route its assessments to a tab in the project governance table, and they switch on a few specific behaviours. Any other string is free for your own filtering and organization.

Governance tab routing

Every assessment appears in exactly one tab, chosen from the policy’s labels. Matching is case-insensitive, and the first match in this order wins — so a policy labelled both screening and assurance routes to Screening.

Label Tab Reviewed and approved by
screening Screening Governance
assurance Testing Assurance
monitoring Monitoring Governance
mitigation or notification-alerts Mitigation Compliance
(none of the above) Assessments Compliance

The tab also determines which review role handles the assessment, so a label change moves the work to a different group. Check the review assignments before relabelling a live policy.

Behaviour labels

Label Effect
assurance combined with LLM, redteam, or multiturn Marks the assessment as evidence-linking, which changes how results are attached
documentation Affects how the policy’s content is rendered in generated reports
report.project.assessment_details.hide Hides the assessment details section in generated reports

Custom labels

Anything else — raii, eu-ai-act, internal — is free-form and used for filtering and grouping in the interface. Custom labels never change routing or scoring.

Labels are matched exactly (apart from letter case). A near-miss such as screenings is treated as a custom label, and the policy’s assessments fall through to the Assessments tab.

Policy Example### Policy Example 

{
  "name": "ABC Responsible AI Assessment Checklist - Pre-Screening",
  "identifier": "com.example.projectinfo",
  "reportTemplateId": "com.example.rai.checklist",
  "version": "1.0.1",
  "description": "The purpose of this checklist is to assess projects involving AI-based solutions, ensuring alignment with ethical and responsible AI principles throughout their lifecycle.",
  "link": "https://www.abc.example/",
  "controlBundles": [
    { "identifier": "com.example.org", "version": "1.0.1" },
    { "identifier": "com.example.general", "version": "1.0.1" },
    { "identifier": "com.example.prescreen", "version": "1.0.1" }
  ],
  "labels": [
    "Inherent Risks",
    "Not Started",
    "Started",
    "report.project.assessment_details.hide"
  ],
  "applicableProjectTypes": ["AI_SYSTEM", "FUNCTIONAL_MODEL", "MODEL_CANDIDATE", "AGENT_CANDIDATE"],
  "compliance": [
    { "level": "Non-Compliant", "compliant": false, "score_min": 0, "score_max": 49.9 },
    { "level": "Compliant", "compliant": true, "score_min": 50, "score_max": 79.9 },
    { "level": "Fully Compliant", "compliant": true, "score_min": 80 }
  ]
}

Control Bundles

Control bundles are the building blocks of a policy. Each bundle groups related controls under a common theme (e.g., “Fairness”, “Transparency”, “Accountability”).

Control Bundle Object

Property Type Required Description
name string Yes Display name of the control bundle
identifier string Yes Unique reverse-domain identifier (e.g., com.example.raii.dimension1)
version string Yes Version string
description string No Description of the bundle’s purpose
weight number No Relative weight of this bundle in aggregate scoring (default: 1.0)
labels string[] No Tags for categorization. Special labels include operational_risk, ai_tests
compliance_min_percent number No Minimum completion percentage for compliance
compliance_max_percent number No Maximum completion percentage threshold
score_max number No Maximum alignment score possible for this bundle
risk_max number No Maximum risk score possible for this bundle
controls Control[] Yes Array of control definitions
dimensions ControlBundleDimension[] No Dimensions specific to this bundle (see below)
applicableProjectTypes ProjectType[] No Override policy-level project type restrictions

Control Bundle Dimension

Dimensions on a control bundle allow per-bundle multi-dimensional scoring. Note that the ds field here is an array of raw Float values (not objects), unlike PolicyDimension.ds which contains structured score objects.

Property Type Required Description
identifier string Yes Unique identifier for the dimension
name string Yes Display name
description string No Description of what the dimension measures
thresholds number[] No Threshold values for bucketing scores
ds number[] No Raw score values for the dimension
labels string[] No Tags for the dimension
aggregationType DimensionAggregationType Yes How scores are aggregated: SUM, AVG, MAX, MIN, or PERCENT

Special Labels

Labels on control bundles influence how the platform computes risk and categorizes the bundle:

Label Effect
operational_risk Controls in this bundle contribute to the Operational Risk score
ai_tests Marks the bundle as technology-risk; its controls contribute to the technology-risk dimension
assurance Same effect as ai_tests — either label marks the bundle as technology-risk
project_info Informational only; typically not scored. Used for project metadata collection
use_case_info A naming convention only — the platform does not treat it specially. Used by convention for AI use case metadata bundles

Control-level label. countAsTestScore is set on an individual control, not on the bundle. It promotes a CARD control from informational to scored — see Card controls.

Note: Only the exact label operational_risk (singular) is recognized by the risk computation engine. If you use a variant like operational_risks (plural), it will not automatically contribute to risk scoring — it will be treated as a custom label.

Control Bundle Example 

{
  "name": "General Information",
  "identifier": "com.example.general",
  "version": "1.0.1",
  "description": "General information for this AI use case.",
  "weight": 1.0,
  "labels": ["use_case_info"],
  "controls": [ ... ]
}

Controls

A control is an individual question or requirement within a control bundle. Each control specifies its answer type, answer options, and scoring rules.

Control Object

Property Type Required Description
identifier string Yes Unique identifier within the bundle (e.g., dimension1.biasimpact.1)
name string Yes Display name / title
description string No Detailed description or guidance text
question string No The question prompt shown to users
answerType AnswerType Yes Type of answer input (see Answer Types)
dataType ControlDataType No Input format hint for free-text answers: TEXT, EMAIL, or DATE
answerOptions AnswerOption[] No Available answer choices (for scored/selection types)
optional boolean No If true, the control is not required for completion. Default: false
formula string No Formula for computed controls
defaultValue string No Pre-populated default value
labels string[] No Tags for categorization and filtering
mainCategory string No Primary categorization
subCategories string[] No Secondary categorizations
cardTypes CardType[] No Card templates (required when answerType is CARD)
controlSource ControlSource[] No References to the original regulatory source
controlCitations ControlCitation[] No Detailed citations to regulatory text
framework string[] No Framework identifiers this control maps to
frameworkLevel string[] No Level within the framework hierarchy
technicalArea string[] No Technical domain tags
role string[] No Roles responsible for this control
usecase string[] No Applicable use case tags
prerequisiteState string[] No States that must be met before this control becomes active
controlConclusion string[] No Predefined conclusion options
industry string[] No Industry-specific tags

Conditional logic is not configured here. A control bundle defines what is asked, not when it is shown. Rules that show or hide a control based on an earlier answer are configured separately, per organization, in the User Journey tab — see Conditional Form Logic. Keep policy configuration free of display conditions.

Control Source

Property Type Required Description
sourceReference string No Reference ID from the regulation (e.g., article/section number)
sourceText string No Relevant excerpt from the source text

Control Citation

Property Type Required Description
reference string No Reference identifier
text string No Citation text
citationSource string No Source document name
citationTitle string No Title of the cited section
citationText string No Full text of the citation

Answer Types

The answerType field determines what UI component is rendered and how the answer is stored and scored.

Answer Type Description Scored Answer Options Required
SCORE_CHECKBOX Multiple-selection checkboxes where each option has a score value Yes Yes
SCORE_MULTIPLE_CHOICE Single-selection radio buttons where each option has a score value Yes Yes
TEXT_TEXT Free-text single-line input No No
TEXT_TEXT_MULTI Free-text multi-line input (textarea) No No
TEXT_TEXT_CHECKLIST Checklist of text items No No
TEST_SCORE Numeric test result input with threshold-based scoring Yes Yes (with thresholds)
CARD Structured data cards for repeatable entries Varies No (uses cardTypes)
DOC_UPLOAD File/document upload No No

Answer Options

Answer options define the possible answers for scored controls and how each answer maps to alignment, risk, and dimension scores.

Answer Option Object

Property Type Required Description
identifier string No Unique identifier for the option
type AnswerOptionType Yes Type of option (see below)
value number No Numeric score value for this option
answer string No Display text for the answer choice
description string No Additional guidance shown with the option
defaultValue number No Default value (for slider/threshold types)
thresholds number[] No Bucket boundaries for threshold-based scoring. Used on both SCORE_THRESHOLD and SCORE option types (see How value and thresholds Work Together)
alignmentScore number[] No Alignment score for each threshold bucket (one value per bucket, i.e., thresholds.length - 1 values)
riskScore number[] No Risk score for each threshold bucket (one value per bucket, i.e., thresholds.length - 1 values)
ds DimensionScore[] No Per-dimension score contributions
risk AnswerOptionRisk[] No Risk metadata associated with this option
alert AnswerOptionAlert[] No Alert metadata associated with this option (see below)
stateConclusion string No Conclusion text recorded when this option is selected
scoreMin number No (Deprecated) Minimum score for slider
scoreMax number No (Deprecated) Maximum score for slider
thresholdLow number No (Deprecated) Low threshold
thresholdHigh number No (Deprecated) High threshold

Answer Option Types

Type Description
SCORE Fixed score value. Selecting this option contributes value to the total score.
SCORE_THRESHOLD Threshold-based scoring. Uses thresholds, alignmentScore, and riskScore arrays to compute scores based on the entered numeric value.
TEXT_TEXT Text-only option with no scoring impact.

Dimension Score

Maps an answer option to a specific scoring dimension.

Property Type Required Description
dimension string Yes Identifier of the dimension
score number Yes Score contribution to that dimension

Answer Option Risk

Metadata describing the risk implication of an answer.

Property Type Required Description
riskType string[] No Categories of risk (e.g., ["bias", "fairness"])
riskExplanation string No Human-readable explanation of the risk

Answer Option Alert

Metadata attached to an answer option for downstream reporting.

Property Type Required Description
alertName string No Short name for the alert
alertCategory string No Grouping category
alertText string No Text describing what the alert means
frameworkLevel string No Level within the framework hierarchy
alertID string No Identifier for the alert

How value and thresholds Work Together

Answer options can carry two independent scoring mechanisms that serve different purposes:

Field Purpose Used For
value The compliance/alignment score contributed when this option is selected Completion percentage, aggregate compliance scoring
thresholds + riskScore + alignmentScore Risk and alignment classification based on threshold buckets Risk status computation (HIGH / MEDIUM / LOW), alignment status

These are not mutually exclusive. A single SCORE option commonly has both:

{
  "type": "SCORE",
  "value": 1,
  "answer": "Yes",
  "thresholds": [0, 0.5, 1],
  "riskScore": [0, 1],
  "alignmentScore": [1, 1]
}

In this example:

  • value: 1 — selecting “Yes” adds 1 point to the compliance score.
  • thresholds: [0, 0.5, 1] with riskScore: [0, 1] — defines how the option’s value maps to risk (the value of 1 falls in the second bucket [0.5, 1], yielding a risk score of 1).

When are thresholds used on SCORE options?

For SCORE_MULTIPLE_CHOICE and SCORE_CHECKBOX controls, the platform uses the value field for compliance scoring, but also uses thresholds/riskScore/alignmentScore to compute risk and alignment statuses. This is why the ABC example includes threshold arrays on every scored answer option.

When is only thresholds used (no value)?

For TEST_SCORE controls with SCORE_THRESHOLD options, only the threshold arrays matter. The user enters a raw numeric value, and the platform looks up which bucket it falls into to determine the risk and alignment scores. See Threshold-Based Scoring.

Threshold-Based Scoring

The thresholds, alignmentScore, and riskScore arrays work together to create a bucket-based scoring system. This mechanism is used in two contexts:

  1. TEST_SCORE controls — the user enters a raw number, which is placed into a threshold bucket.
  2. SCORE_MULTIPLE_CHOICE / SCORE_CHECKBOX controls — each answer option’s value is placed into the threshold bucket to derive risk and alignment scores.

These arrays feed the numeric aggregate, not the compliance label. On a SCORE_MULTIPLE_CHOICE or SCORE_CHECKBOX control, the label that drives status comes from the option’s compliance identifier — see Compliance Identifiers. TEST_SCORE is the exception: there the bucket does produce the label.

How It Works

The thresholds array defines bucket boundaries. For n thresholds, there are n - 1 buckets. The alignmentScore and riskScore arrays each have n - 1 values, one per bucket.

thresholds:      [0,    0.5,   0.8,   1.0]
                  |------|------|------|
                  bucket0 bucket1 bucket2
alignmentScore:  [0,     0.5,   1.0]
riskScore:       [1.0,   0.5,   0]

Scoring example:

Input Value Bucket Alignment Score Risk Score
0.3 [0, 0.5) — bucket 0 0 1.0
0.6 [0.5, 0.8) — bucket 1 0.5 0.5
0.9 [0.8, 1.0] — bucket 2 1.0 0

Card Types

Card types define structured, repeatable data entry templates. They are used when a control has answerType: "CARD".

Card Type Object

Property Type Required Description
cardTitle string Yes Title of the card template
cardDescription string No Description of the card purpose
cardFields CardField[] Yes Array of field definitions within the card

Card Field

Property Type Required Description
type AnswerType Yes Input type for this field (uses the same AnswerType enum)
dataType ControlDataType No Input format hint for free-text fields: TEXT, EMAIL, or DATE
label string Yes Display label for the field
required boolean No Whether the field is required
defaultValue string No Default value
answerOptions AnswerOption[] No Answer options (if the field is a selection type)

Compliance Identifiers

Every scored control produces one compliance label, and those labels are what roll up into assessment and project status. The label comes from your policy — not from any platform setting.

This is the most common authoring mistake. A control meant to assess a requirement, whose answer options carry no compliance identifier, is treated as informational: it is quietly excluded from scoring and contributes nothing. The assessment still renders, so nothing looks broken. (Being informational is the correct outcome for screening questions — see Compliance identifiers vs descriptive identifiers.)

The four identifiers

Identifier Meaning
fully-compliant The answer meets the requirement
partially-compliant The answer partly meets the requirement
not-compliant The answer does not meet the requirement
not-applicable The requirement does not apply; the control is excluded from the roll-up

Only the suffix matters. The platform reads the part after the last . and treats _ as -, so all of these are equivalent and you can keep your own namespacing:

fully-compliant
fully_compliant
com.example.safety.si.fully_compliant

An option with a missing or unrecognized identifier is skipped, and a warning is logged.

Putting it together, a scored control looks like this:

{
  "identifier": "com.example.privacy.dsr",
  "name": "Data subject request handling",
  "question": "Is there a documented process for handling data subject requests?",
  "answerType": "SCORE_MULTIPLE_CHOICE",
  "answerOptions": [
    { "type": "SCORE", "answer": "Yes, documented and tested",
      "identifier": "com.example.privacy.dsr.fully_compliant" },
    { "type": "SCORE", "answer": "Documented but not tested",
      "identifier": "com.example.privacy.dsr.partially_compliant" },
    { "type": "SCORE", "answer": "No documented process",
      "identifier": "com.example.privacy.dsr.not_compliant" },
    { "type": "SCORE", "answer": "Not applicable to this system",
      "identifier": "com.example.privacy.dsr.not_applicable" }
  ]
}

How each control type is scored

Answer type How the label is derived
SCORE_MULTIPLE_CHOICE The identifier on the single selected option.
SCORE_CHECKBOX The worst of the selected options.
TEST_SCORE The numeric answer is placed in a bucket; the bucket’s alignmentScore gives the label.
CARD with the countAsTestScore label How many cards are fully completed.
TEXT_TEXT, TEXT_TEXT_MULTI, DOC_UPLOAD, CARD without the label Informational — never scored.

A scored control with no answer is unanswered, which is not the same as a failure but still keeps the assessment below a thresholdFullyCompliant of 100%.

Single-select and multi-select

For SCORE_MULTIPLE_CHOICE, put one of the four identifiers on every answer option. The selected option’s identifier becomes the label directly. not-applicable excludes the control from the roll-up rather than passing it.

For SCORE_CHECKBOX, the same identifiers apply and the strictest selected option wins:

not-compliant  >  partially-compliant  >  fully-compliant

not-applicable options are skipped and cannot change the outcome. Two consequences worth knowing:

  • If every selected option is not-applicable or unrecognized, the control becomes informational rather than fully compliant — so a pure not-applicable answer never inflates the count.
  • For a “none of the above” option, give it the not-compliant identifier. No special option name is recognized; the identifier is what carries the meaning.

Test score controls

A TEST_SCORE control carries its scoring rules on its single answer option, using thresholds and alignmentScore:

  • thresholds lists the bucket boundaries, lowest to highest.
  • alignmentScore holds one value per bucket — so it always has one entry fewer than thresholds.
  • Each bucket covers its lower bound up to but excluding the next, and the topmost bucket includes its upper bound.

Each bucket’s alignmentScore maps to a label:

alignmentScore Label
1.0 Fully compliant
0.5 Partially compliant
0.0 Not compliant

Anything else is treated as not compliant and logged, so keep bucket scores to these three values.

Misconfiguration is handled predictably rather than by failing the assessment:

Situation Result
No thresholds or no alignmentScore Informational — the score is collected but not scored
alignmentScore length does not match the bucket count Informational, with a warning
Answer is not a number, or falls outside the outermost bounds Not compliant

Card controls

A CARD control is informational unless it carries the countAsTestScore label. With that label, its status depends on how many card entries are fully completed:

Completed entries Label
All of them Fully compliant
Some of them Partially compliant
None Not compliant

A card entry counts as completed when every required field on its card type has a value. Optional fields can be left blank without affecting this.

Compliance identifiers vs descriptive identifiers

Not every answer option identifier is a compliance identifier, and the difference decides whether a control contributes to status.

  Compliance identifier Descriptive identifier
Looks like ends in fully_compliant, partially_compliant, not_compliant, not_applicable anything else, e.g. ...sysdata.yes
Use it for controls that assess whether a requirement is met screening and intake questions that capture what a system is
Effect on status produces the control’s compliance label none — the control is informational
Targeted by rules yes yes

Screening questions describe a system rather than judging it: “the system is hosted on-premises” or “the system uses personal data” is neither compliant nor non-compliant. Give those options descriptive identifiers so screening rules can target them, and leave the compliance identifiers for controls that genuinely assess a requirement. See Rules Configuration for how screening rules match answer options.

Both kinds need an identifier. An option with no identifier at all cannot be targeted by a rule and cannot produce a compliance label.

Informational controls

TEXT_TEXT, TEXT_TEXT_MULTI and DOC_UPLOAD controls, and CARD controls without the countAsTestScore label, collect information and are never scored. Leaving them blank does not stop an assessment reaching a fully compliant status — they are not counted at all. Use them for context and evidence gathering, and use a scored type wherever the answer needs to affect status.

Policy Level

Level Description
SYSTEM Available to all organizations on the platform. Managed by platform admins.
ORGANIZATION Scoped to a single organization. Managed by org admins.

Complete Configuration Example

This example is a screening policy. Its scored controls capture what a system is — where it runs, how it was built, whether it uses personal data — so their options carry descriptive identifiers that screening rules can target, not compliance identifiers. Those controls are therefore informational and do not contribute to compliance status, which is correct for intake questions. For a control that assesses a requirement, follow the pattern in Compliance Identifiers.

Below is a real-world example of a complete policy configuration — ABC’s Responsible AI Pre-Screening Checklist. It demonstrates three control bundles with different purposes: project information (text inputs), general AI use case details (mix of text and scored choices), and a pre-screening checklist (scored multiple choice questions).

{
  "organization": {
    "name": "ABC",
    "identifier": "com.example",
    "pgId": "2"
  },
  "policies": [
    {
      "name": "ABC Responsible AI Assessment Checklist - Pre-Screening",
      "identifier": "com.example.projectinfo",
      "reportTemplateId": "com.example.rai.checklist",
      "version": "1.0.1",
      "description": "The purpose of this checklist is to assess projects involving AI-based solutions, ensuring alignment with ethical and responsible AI principles throughout their lifecycle.",
      "link": "https://www.abc.example/",
      "controlBundles": [
        { "identifier": "com.example.org", "version": "1.0.1" },
        { "identifier": "com.example.general", "version": "1.0.1" },
        { "identifier": "com.example.prescreen", "version": "1.0.1" }
      ],
      "labels": [
        "Inherent Risks",
        "Not Started",
        "Started",
        "report.project.assessment_details.hide"
      ],
      "applicableProjectTypes": ["AI_SYSTEM", "FUNCTIONAL_MODEL", "MODEL_CANDIDATE", "AGENT_CANDIDATE"],
      "compliance": [
        { "level": "Non-Compliant", "compliant": false, "score_min": 0, "score_max": 49.9 },
        { "level": "Compliant", "compliant": true, "score_min": 50, "score_max": 79.9 },
        { "level": "Fully Compliant", "compliant": true, "score_min": 80 }
      ]
    }
  ],
  "controlBundles": [
    {
      "name": "Project Information",
      "identifier": "com.example.org",
      "version": "1.0.1",
      "description": "Project information for this AI use case.",
      "weight": 1.0,
      "labels": ["project_info"],
      "controls": [
        {
          "identifier": "org.name",
          "name": "Organization Name",
          "question": "Company or Organization Name",
          "labels": ["org.name"],
          "answerType": "TEXT_TEXT"
        },
        {
          "identifier": "org.department",
          "name": "Business Owner",
          "question": "Business Owner (Division/Department/Unit)",
          "labels": ["branch"],
          "answerType": "TEXT_TEXT"
        },
        {
          "identifier": "org.project",
          "name": "Project Name",
          "question": "Project Name",
          "labels": ["project.name"],
          "answerType": "TEXT_TEXT"
        },
        {
          "identifier": "org.project.desc",
          "name": "Project Description",
          "question": "Project Description",
          "labels": ["project.Description"],
          "answerType": "TEXT_TEXT"
        },
        {
          "identifier": "org.project.owner",
          "name": "Project Owner",
          "question": "Project Owner",
          "labels": ["project.owner"],
          "answerType": "TEXT_TEXT"
        }
      ]
    },
    {
      "name": "General Information",
      "identifier": "com.example.general",
      "version": "1.0.1",
      "description": "General information for this AI use case.",
      "weight": 1.0,
      "labels": ["use_case_info"],
      "controls": [
        {
          "identifier": "info.usercase",
          "name": "AI Use Case / Purpose",
          "description": "Describe the specific function, process, or business objective that the AI solution is designed to support or enhance.",
          "question": "AI Use Case / Purpose:",
          "labels": ["info.usercase"],
          "answerType": "TEXT_TEXT"
        },
        {
          "identifier": "info.app",
          "name": "AI Application / System Name:",
          "description": "Provide the name of the AI application or system.",
          "question": "AI Application / System Name:",
          "labels": ["info.app"],
          "answerType": "TEXT_TEXT"
        },
        {
          "identifier": "info.deployenv",
          "name": "System Deployment Environment",
          "description": "Specify the type of environment used to deploy or host this AI system.",
          "question": "System Deployment Environment",
          "labels": ["info.deployenv"],
          "answerType": "SCORE_MULTIPLE_CHOICE",
          "answerOptions": [
            {
              "type": "SCORE",
              "value": 1,
              "answer": "On-cloud (AWS)",
              "identifier": "com.example.prescreen.deployenv.on_cloud_aws",
              "thresholds": [0, 0.5, 1],
              "riskScore": [0, 1],
              "alignmentScore": [1, 1]
            },
            {
              "type": "SCORE",
              "value": 1,
              "answer": "On-cloud (Azure)",
              "identifier": "com.example.prescreen.deployenv.on_cloud_azure",
              "thresholds": [0, 0.5, 1],
              "riskScore": [0, 1],
              "alignmentScore": [1, 1]
            },
            {
              "type": "SCORE",
              "value": 1,
              "answer": "On-cloud (GCP)",
              "identifier": "com.example.prescreen.deployenv.on_cloud_gcp",
              "thresholds": [0, 0.5, 1],
              "riskScore": [0, 1],
              "alignmentScore": [1, 1]
            },
            {
              "type": "SCORE",
              "value": 1,
              "answer": "On-cloud (Other)",
              "identifier": "com.example.prescreen.deployenv.on_cloud_other",
              "thresholds": [0, 0.5, 1],
              "riskScore": [0, 1],
              "alignmentScore": [1, 1]
            },
            {
              "type": "SCORE",
              "value": 1,
              "answer": "On-premises",
              "identifier": "com.example.prescreen.deployenv.on_premises",
              "thresholds": [0, 0.5, 1],
              "riskScore": [0, 1],
              "alignmentScore": [1, 1]
            },
            {
              "type": "SCORE",
              "value": 1,
              "answer": "Hybrid (Cloud + on-premises)",
              "identifier": "com.example.prescreen.deployenv.hybrid",
              "thresholds": [0, 0.5, 1],
              "riskScore": [0, 1],
              "alignmentScore": [1, 1]
            },
            {
              "type": "SCORE",
              "value": 1,
              "answer": "SaaS (Third-party Hosted)",
              "identifier": "com.example.prescreen.deployenv.saas",
              "thresholds": [0, 0.5, 1],
              "riskScore": [0, 1],
              "alignmentScore": [1, 1]
            }
          ]
        },
        {
          "identifier": "info.devapproach",
          "name": "AI Development Approach",
          "description": "Specify the type of AI model used in this system.",
          "question": "AI Development Approach:",
          "labels": ["info.devapproach"],
          "answerType": "SCORE_MULTIPLE_CHOICE",
          "answerOptions": [
            {
              "type": "SCORE",
              "value": 1,
              "answer": "External Prebuilt AI Service",
              "identifier": "com.example.prescreen.devapproach.external_prebuilt_ai_service",
              "thresholds": [0, 0.5, 1],
              "riskScore": [0, 1],
              "alignmentScore": [1, 1]
            },
            {
              "type": "SCORE",
              "value": 1,
              "answer": "In-house Custom Model Development",
              "identifier": "com.example.prescreen.devapproach.in_house_custom_model_development",
              "thresholds": [0, 0.5, 1],
              "riskScore": [0, 1],
              "alignmentScore": [1, 1]
            },
            {
              "type": "SCORE",
              "value": 1,
              "answer": "Fine-tuned Pretrained Model",
              "identifier": "com.example.prescreen.devapproach.fine_tuned_pretrained_model",
              "thresholds": [0, 0.5, 1],
              "riskScore": [0, 1],
              "alignmentScore": [1, 1]
            },
            {
              "type": "SCORE",
              "value": 1,
              "answer": "Open-Source Model Integration",
              "identifier": "com.example.prescreen.devapproach.open_source_model_integration",
              "thresholds": [0, 0.5, 1],
              "riskScore": [0, 1],
              "alignmentScore": [1, 1]
            },
            {
              "type": "SCORE",
              "value": 1,
              "answer": "Hybrid (External + Internal)",
              "identifier": "com.example.prescreen.devapproach.hybrid",
              "thresholds": [0, 0.5, 1],
              "riskScore": [0, 1],
              "alignmentScore": [1, 1]
            },
            {
              "type": "SCORE",
              "value": 1,
              "answer": "Third-party SaaS AI Solution",
              "identifier": "com.example.prescreen.devapproach.third_party_saas_ai_solution",
              "thresholds": [0, 0.5, 1],
              "riskScore": [0, 1],
              "alignmentScore": [1, 1]
            },
            {
              "type": "TEXT_TEXT",
              "value": 1,
              "answer": "Other (please specify): ",
              "identifier": "com.example.prescreen.devapproach.other",
              "thresholds": [0, 0.5, 1],
              "riskScore": [0, 1],
              "alignmentScore": [1, 1]
            }
          ]
        },
        {
          "identifier": "info.vendor",
          "name": "AI Model / Vendor Used",
          "description": "Specify the model name, version, and vendor (e.g., GPT-4 by OpenAI).",
          "question": "AI Model / Vendor Used:",
          "labels": ["info.vendor"],
          "answerType": "TEXT_TEXT"
        },
        {
          "identifier": "info.datasources",
          "name": "Primary Data Sources",
          "description": "Identify the key data types used in this AI use case (e.g., financial transactions, customer profiles, audio data).",
          "question": "Primary Data Sources:",
          "labels": ["info.datasources"],
          "answerType": "TEXT_TEXT"
        }
      ]
    },
    {
      "name": "Pre-RAI Screening Checklist",
      "identifier": "com.example.prescreen",
      "version": "1.0.1",
      "description": "The purpose of this pre-screen checklist is to identify applicable checklist items.",
      "weight": 1.0,
      "labels": ["project_info", "operational_risks"],
      "compliance_min_percent": 0,
      "score_max": 0,
      "controls": [
        {
          "identifier": "project.sysinterface",
          "name": "User Interface with AI",
          "description": "End-users interact directly with the AI (e.g., type, speak, or upload data).",
          "question": "Does the system have an interface that allows end-users to input data or interact with the AI directly?",
          "labels": ["project.ai.sysinterface"],
          "answerType": "SCORE_MULTIPLE_CHOICE",
          "answerOptions": [
            {
              "type": "SCORE",
              "value": 1,
              "answer": "Yes: The system has an interface that allows users to input data or interact directly with the AI.",
              "identifier": "com.example.prescreen.sysinterface.yes",
              "thresholds": [0, 0.5, 1],
              "riskScore": [0, 1],
              "alignmentScore": [1, 1]
            },
            {
              "type": "SCORE",
              "value": 0,
              "answer": "No: The system does not have an interface that allows users to input data or interact directly with the AI. It functions only as a backend engine for internal organizational use (e.g., data analytics, decision support).",
              "identifier": "com.example.prescreen.sysinterface.no",
              "thresholds": [0, 0.5, 1],
              "riskScore": [0, 1],
              "alignmentScore": [1, 1]
            }
          ]
        },
        {
          "identifier": "project.sysfreeforminputs",
          "name": "Free-Form Input or Prompt",
          "description": "AI accepts open-ended inputs (not just fixed choices), like voice or typed queries.",
          "question": "Does the system accept free-form inputs from end-users or backend sources?",
          "labels": ["project.ai.sysinterface"],
          "answerType": "SCORE_MULTIPLE_CHOICE",
          "answerOptions": [
            {
              "type": "SCORE",
              "value": 1,
              "answer": "Yes: The system supports free-form inputs (e.g., text prompts, voice commands, or images). These inputs are open-ended and unstructured, allowing flexible interaction.",
              "identifier": "com.example.prescreen.freeforminputs.yes",
              "thresholds": [0, 0.5, 1],
              "riskScore": [0, 1],
              "alignmentScore": [1, 1]
            },
            {
              "type": "SCORE",
              "value": 0,
              "answer": "No: The system does not accept or interpret free-form inputs for generating content or making decisions. It only processes structured or predefined inputs.",
              "identifier": "com.example.prescreen.freeforminputs.no",
              "thresholds": [0, 0.5, 1],
              "riskScore": [0, 1],
              "alignmentScore": [1, 1]
            }
          ]
        },
        {
          "identifier": "project.systrainedmodel",
          "name": "Output from Trained Model",
          "description": "AI generates results based on prior training, not just user-uploaded content.",
          "question": "Does the AI system use a trained model that interprets user prompts to guide its responses or generate outputs?",
          "labels": ["project.ai.systrainedmodel"],
          "answerType": "SCORE_MULTIPLE_CHOICE",
          "answerOptions": [
            {
              "type": "SCORE",
              "value": 1,
              "answer": "Yes: The system uses a trained AI model that interprets user prompts to guide its responses.",
              "identifier": "com.example.prescreen.trainedmodel.yes",
              "thresholds": [0, 0.5, 1],
              "riskScore": [0, 1],
              "alignmentScore": [1, 1]
            },
            {
              "type": "SCORE",
              "value": 0,
              "answer": "No: The system does not generate responses based on a trained model's generalization. It only processes or summarizes the specific content provided by the user.",
              "identifier": "com.example.prescreen.trainedmodel.no",
              "thresholds": [0, 0.5, 1],
              "riskScore": [0, 1],
              "alignmentScore": [1, 1]
            }
          ]
        },
        {
          "identifier": "project.sysmodelresponse",
          "name": "Model Access or Adjustability",
          "description": "The model can be accessed or adjusted by your team (or vendor upon request).",
          "question": "Can you influence or customize how the AI model responds, either by modifying the model itself or by shaping its behavior through prompt design, system instructions, or configuration options?",
          "labels": ["project.ai.sysmodelresponse"],
          "answerType": "SCORE_MULTIPLE_CHOICE",
          "answerOptions": [
            {
              "type": "SCORE",
              "value": 1,
              "answer": "Yes: You can influence the AI's output through direct fine-tuning or retraining of the model, or by shaping its behavior using prompt design, system-level instructions, or configuration settings.",
              "identifier": "com.example.prescreen.modelresponse.yes",
              "thresholds": [0, 0.5, 1],
              "riskScore": [0, 1],
              "alignmentScore": [1, 1]
            },
            {
              "type": "SCORE",
              "value": 0,
              "answer": "No: You cannot influence how the AI responds. The system behaves in a fixed manner and does not support model fine-tuning, prompt engineering, or configuration changes.",
              "identifier": "com.example.prescreen.modelresponse.no",
              "thresholds": [0, 0.5, 1],
              "riskScore": [0, 1],
              "alignmentScore": [1, 1]
            }
          ]
        },
        {
          "identifier": "project.sysdata",
          "name": "Use of Personal or Sensitive Data",
          "description": "The system uses or produces output based on personal or sensitive data.",
          "question": "Does the AI system collect, process, store, or generate outputs based on personal or sensitive data?",
          "labels": ["project.ai.sysmodelresponse"],
          "answerType": "SCORE_MULTIPLE_CHOICE",
          "answerOptions": [
            {
              "type": "SCORE",
              "value": 1,
              "answer": "Yes: The system handles any form of personal or sensitive data, whether directly or indirectly.",
              "identifier": "com.example.prescreen.sysdata.yes",
              "thresholds": [0, 0.5, 1],
              "riskScore": [0, 1],
              "alignmentScore": [1, 1]
            },
            {
              "type": "SCORE",
              "value": 0,
              "answer": "No: The system does not handle any personal or sensitive data in any form.",
              "identifier": "com.example.prescreen.sysdata.no",
              "thresholds": [0, 0.5, 1],
              "riskScore": [0, 1],
              "alignmentScore": [1, 1]
            }
          ]
        }
      ]
    }
  ]
}

Key Patterns in This Example

This configuration demonstrates several important patterns:

Pattern Where Description
Text-only bundle com.example.org Uses only TEXT_TEXT controls for metadata collection. Labeled project_info so it is not scored.
Mixed bundle com.example.general Combines TEXT_TEXT and SCORE_MULTIPLE_CHOICE controls. Uses use_case_info label.
Screening bundle com.example.prescreen All SCORE_MULTIPLE_CHOICE with Yes/No pattern. Sets score_max: 0 and compliance_min_percent: 0.
Descriptive option identifiers com.example.prescreen Every answer option carries an identifier such as ...sysdata.yes so screening rules can target it. These are deliberately not compliance identifiers — the controls describe the system rather than assessing it.
TEXT_TEXT option type info.devapproach Last answer option uses "type": "TEXT_TEXT" to allow free-text “Other” input alongside scored options.
Threshold scoring on SCORE options All scored controls Even SCORE type options include thresholds, riskScore, and alignmentScore for risk computation.
Report label Policy labels report.project.assessment_details.hide suppresses assessment detail in the generated report.
Compliance tiers Policy Three compliance levels with non-overlapping score ranges; highest tier omits score_max.
Project type scoping Policy applicableProjectTypes restricts which project types can use this policy.

Enum Reference

AnswerType

Value Description
SCORE_CHECKBOX Multi-select with scoring
SCORE_MULTIPLE_CHOICE Single-select with scoring
TEXT_TEXT Single-line text input
TEXT_TEXT_MULTI Multi-line text input
TEXT_TEXT_CHECKLIST Checklist text input
TEST_SCORE Numeric input with threshold scoring
CARD Structured card data entry
DOC_UPLOAD File upload

AnswerOptionType

Value Description
SCORE Fixed numeric score
SCORE_THRESHOLD Threshold-based scoring with buckets
TEXT_TEXT Text-only (no scoring)

DimensionAggregationType

Value Description
SUM Sum all scores in the dimension
AVG Average all scores
MAX Take the maximum score
MIN Take the minimum score
PERCENT Calculate as a percentage

DimensionScoreType

Value Description
NA Not applicable
INFO Informational severity
WARNING Warning severity
CRITICAL Critical severity

PolicyLevel

Value Description
SYSTEM System-wide, available to all orgs
ORGANIZATION Scoped to a single organization

ControlDataType

Input format hint for free-text answers and card fields.

Value Description
TEXT Plain text
EMAIL Email address
DATE Date

ProjectType

Value Description
AI_SYSTEM Top-level AI system
FUNCTIONAL_MODEL Functional component of an AI system
MODEL_CANDIDATE ML model under evaluation
MODEL_CHAMPION Selected champion model
AGENT_CANDIDATE AI agent under evaluation
VENDOR_AGENT Third-party vendor agent
VENDOR_MODEL Third-party vendor model
DATASET Dataset
ORGANIZATION Organization-level

Risk & Alignment Scoring

How status is produced

Status comes from the compliance labels described in Compliance Identifiers, rolled up in two stages:

Control   a compliance label per answered control   from your policy
Assessment  rolls up the control labels             platform thresholds
Project     rolls up the assessment statuses        platform thresholds

The thresholds that govern both roll-ups are configured once for the deployment and are not part of policy configuration — see System Configuration.

The numeric score fields

Answer options can also carry value, thresholds, riskScore and alignmentScore. These are a separate, older numeric aggregate. They do not produce a control’s compliance label, and changing them does not move an assessment’s status.

Where they still apply:

  • thresholds and alignmentScore on a TEST_SCORE control’s option do determine that control’s label, through the bucket mapping described in Test score controls.
  • The numeric aggregate is surfaced on the policy-level project tables under Governance.

If you are authoring a new policy, set the compliance identifiers first: they are what determines status. Carry the numeric fields only where you need the aggregate or a TEST_SCORE bucket.

Versioning

Both policies and control bundles are versioned independently. This allows:

  • Policy version bumps when the compliance structure changes (new bundles added, compliance levels adjusted).
  • Control bundle version bumps when controls are added, removed, or modified.

The combination of identifier + version must be unique across the platform (within the same policy level).

Best Practices

  1. Put a compliance identifier on every scored answer option: SCORE_MULTIPLE_CHOICE and SCORE_CHECKBOX options need one of fully_compliant, partially_compliant, not_compliant or not_applicable as their suffix. Without one the control is silently excluded from scoring. Screening questions are the deliberate exception — see Compliance Identifiers.

  2. Use reverse-domain identifiers: Follow the pattern com.yourorg.policyname.bundlename for globally unique identifiers.

  3. Version carefully: Bump the version when making changes. Existing assessments reference a specific identifier:version pair.

  4. Set compliance levels: Define clear compliance tiers with non-overlapping score ranges.

  5. Choose policy labels deliberately: A policy’s labels decide which governance tab its assessments appear in and which role reviews them, and bundle labels drive risk categories (operational_risk, ai_tests). See Policy Labels and Special Labels.

  6. Mix answer types: Combine scored controls (SCORE_CHECKBOX, SCORE_MULTIPLE_CHOICE) with qualitative controls (TEXT_TEXT, DOC_UPLOAD) for comprehensive assessments.

  7. Define thresholds consistently: Always ensure the thresholds array has one more element than the alignmentScore and riskScore arrays. Include thresholds on SCORE options too if you need risk/alignment computation.

  8. Keep controls atomic: Each control should ask one clear question. Use control bundles to group related questions.

  9. Use operational_risk (singular): Only the exact label operational_risk is recognized by the risk engine. Variants like operational_risks will not trigger risk computation.