# ABOUT
# ────────────────────────────────────────────
# Artifact: Control Profiler
# Purpose: Classifies controls against a governed security
# control taxonomy for downstream assessment reuse.
# Version: 1.2.0
# Status: Demonstration / Reference Implementation
# Owner: Tristan Jones
# Last Updated: 2026-07-21
# GOVERNANCE CHARACTERISTICS
# ────────────────────────────────────────────
# • Controlled vocabulary enforcement
# • Schema and output validation
# • Per-dimension confidence scoring
# • Versioned classification records
# • Observable execution logging
# • Local processing of client control data
# VERSION HISTORY
# ────────────────────────────────────────────
# Version Date Change
# 1.2.0 2026-07-21 Added capability ontology validation and
# vocabulary coverage telemetry.
# 1.1.0 2026-06-15 Added confidence scoring and profile versioning.
# 1.0.0 2026-05-28 Initial controlled classification pipeline.
# SECURITY / DATA HANDLING
# ────────────────────────────────────────────
# Client controls and derived metadata remain local.
# No client control data is transmitted to external AI services.
# ═══════════════════════════════════════════
/no_think
Classify each control using ONLY the vocabulary below. Do not invent terms.
VOCABULARY
Control Types: Preventive, Detective, Corrective, Governance
Characteristics: Authorization, Authentication, Access_Management,
Credential_Management, Least_Privilege, Account_Lifecycle,
Logging, Monitoring, Alerting, Incident_Response,
Policy, Review_Recertification, Encryption,
Configuration_Management, Change_Management, Physical_Access,
Network_Security, Endpoint_Security, Automation,
Data_Protection, Asset_Management, Vulnerability_Management,
Backup_Recovery, Training_Awareness
Scope: Enterprise, System_Specific, Workflow_Specific,
Methodology detail redacted
Privileged_Access, Device, User
Evidence Roles: Implements, Enforces, Monitors, Reviews,
Documents, Automates, Alerts
Control Functions: Restricts_Access, Verifies_Identity, Enforces_Policy,
Records_Activity, Detects_Anomaly, Generates_Alert,
Reviews_Compliance, Prevents_Change, Provisions_Access,
Revokes_Access, Encrypts_Data, Monitors_Activity,
Validates_Configuration, Manages_Credentials, Escalates_Incident
Security Capabilities (assign 1-8 per control):
CAP-001: Password Policy Enforcement
CAP-002: Password Complexity Requirements
CAP-003: Password History Enforcement
CAP-004: Account Lockout Policy
CAP-005: Multi-Factor Authentication
... [48 more capabilities from ontology]
RULES
For EACH dimension, assign a confidence level: High, Medium, or Low.
- High: The control description clearly and explicitly states this classification
- Medium: The classification is a reasonable inference from the description
- Low: The classification is uncertain or based on weak signals
OUTPUT FORMAT — return structured objects with per-dimension confidence:
- control_type: {"value": "...", "confidence": "High|Medium|Low"}
Exactly ONE type. Preventive=blocks bad actions. Detective=finds problems.
Corrective=fixes after incident. Governance=policy/oversight.
- characteristics: Array of {"value": "...", "confidence": "..."}
1-4 terms that DIRECTLY describe what the control IS.
- Password policies → Credential_Management
- Logging user activity → Logging, Monitoring
- Firewall rules → Network_Security
Do NOT assign a characteristic just because the control mentions the topic.
- scope: Array of {"value": "...", "confidence": "..."}
1-3 values describing WHERE the control applies.
- Enterprise = applies org-wide
- System_Specific = a particular system or application
- Privileged_Access = specifically about admin/elevated access
- evidence_role: {"value": "...", "confidence": "..."}
Exactly ONE role — the control's primary function.
Implements=puts capability into practice. Enforces=technically enforces a rule.
Monitors=watches for events. Reviews=periodically reviews.
- control_functions: Array of {"value": "...", "confidence": "..."}
1-4 terms describing what the control DOES (its active behavior).
- An access control list → Restricts_Access
- MFA requirement → Verifies_Identity
- SIEM alerting → Monitors_Activity, Generates_Alert
- capabilities: Array of {"cap_id": "CAP-XXX", "confidence": "High|Medium|Low"}
1-8 SPECIFIC security capabilities this control delivers.
Only assign a capability if the control description contains specific evidence.
CONTROLS TO CLASSIFY (12):
[control data injected here per batch]
Return ONLY a JSON array with exactly 12 objects:
[
{
"scf_id": "XXX-01",