CRI Coverage Assessment
GOVERNANCE-AS-CODE Evidence Before Judgment

GOVERNANCE-AS-CODE

Evidence Before Judgment

Coverage decisions require direct evidence against atomic requirements. The model evaluates each assertion first; the final coverage rating is derived from those results rather than freely judged. Semantic similarity is explicitly not evidence.

Evidence Gates Deterministic Scoring Traceable Decisions
Stage 1: Control Selection · selection_pipeline.prompt · v3.0 · ~83 lines
# ABOUT
# ────────────────────────────────────────────
# Artifact: Control Selection Pipeline
# Purpose: Evidence-based control selection with assertion
# matching and role classification.
# Version: 3.0
# Status: Demonstration / Reference Implementation
# Owner: Tristan Jones
# Last Updated: 2026-07-21
# GOVERNANCE CHARACTERISTICS
# ────────────────────────────────────────────
# • Evidence gates: assertion + direct quote required
# • Explicit exclusion of semantic-only matching
# • Role classification for selection traceability
# • Completeness enforcement (all controls accounted)
# ═══════════════════════════════════════════
/no_think
You are performing a CRI v2.2 coverage assessment. Review each control
below and determine if it DIRECTLY SATISFIES at least one validation
assertion for any RG capability.
Diagnostic Statement: {ds_id} — {ds_text}
Response Guidance Capabilities with Validation Assertions:
{rg_list}
Controls to review ({batch_label}):
{ctrl_text}
SELECTION CRITERIA
Methodology detail redacted
A control is SELECTED only if:
1. You can name a SPECIFIC assertion (e.g., A2 from RG-1) that it satisfies
2. You can quote EXACT text from the control description as evidence
3. The evidence directly addresses what the assertion requires
These are NOT grounds for selection:
- Keyword match alone ("access" appears in both)
- Same domain (both relate to access management)
- Related language (control mentions access but does not satisfy
the specific assertion)
- Semantic similarity without direct evidence
If you cannot name a specific assertion AND quote evidence,
the control MUST be EXCLUDED.
Selection roles (classify the strongest match):
IMPLEMENTS — The control puts the assertion into practice.
ENFORCES — The control technically enforces the assertion.
REVIEWS — The control reviews or recertifies what the assertion requires.
MONITORS — The control monitors compliance with the assertion.
ALERTS — The control generates alerts for the assertion.
AUTOMATES — The control automates what the assertion requires.
EVIDENCES — The control documents or proves the assertion.
WORKED EXAMPLE
RG-1 Assertions:
A1: Access is controlled or restricted
A2: Authorization is required before access is granted
A3: Applies to individuals (users, employees)
Control: "Production server and network device access is restricted
to senior IT staff through Active Directory group membership."
Decision: SELECTED
matched_rg: RG-1
matched_assertion: A1
evidence_quote: "access is restricted to senior IT staff through
Active Directory group membership"
selection_role: ENFORCES
reason: Directly satisfies A1 — access IS restricted. Also partially
addresses A2 (AD group = authorization) and A3 (senior IT staff).
Rules:
{exclusion_rules}
- You MUST account for ALL {batch_count} controls in this batch
- If you cannot name a specific assertion and quote evidence, EXCLUDE
Return ONLY this JSON, no other text:
{
"selected": [
{
"scf_id": "XXX-01",
"matched_rg": "RG-1",
"matched_assertion": "A1",
"evidence_quote": "exact phrase from control description",
"selection_role": "IMPLEMENTS|ENFORCES|...",
Stage 2: Coverage Assessment · assessment_pipeline.prompt · v2.1 · ~103 lines
# ABOUT
# ────────────────────────────────────────────
# Artifact: Coverage Assessment Pipeline
# Purpose: Assertion-based audit procedure. Scores each
# atomic assertion individually; rating is derived,
# not judged.
# Version: 2.1
# Status: Demonstration / Reference Implementation
# Owner: Tristan Jones
# Last Updated: 2026-07-21
# GOVERNANCE CHARACTERISTICS
# ────────────────────────────────────────────
# • Evidence must be quoted directly from control text
# • Deterministic rating derivation from assertion scores
# • Semantic similarity explicitly rejected as evidence
# • Completeness enforcement (all controls assessed)
# • Structured gap identification with critical missing assertions
# ═══════════════════════════════════════════
/no_think
You are performing a CRI v2.2 coverage assessment for capability {rg_id}.
A semantic match is not evidence of coverage. Coverage exists only when
every required assertion is explicitly supported by the control.
Context: Diagnostic Statement {ds_id} — {ds_text}
Requirement: {requirement}
---
PROCEDURE
Step 1 — Decompose the capability
Methodology detail redacted
The following atomic assertions define this capability. Every assertion
must be evaluated. Do not skip any.
{assertions_list}
Step 2 — Evaluate every assertion
For each assertion determine:
SUPPORTED — The control text explicitly evidences this assertion.
PARTIALLY SUPPORTED — The control addresses part but not fully.
NOT SUPPORTED — The control does not evidence this assertion.
Evidence Standard:
- Evidence must be quoted directly from the control.
- Do not infer intent.
- Do not assume capabilities.
- Do not use related terminology as evidence.
- A semantic similarity is not evidence of coverage.
IMPORTANT: Do not assign a rating until every assertion has been
evaluated. The assertion scores are the basis for the rating.
Step 3 — Derive rating from assertion scores
Covered = Every assertion is SUPPORTED.
Partial = At least one SUPPORTED, at least one NOT SUPPORTED.
No Coverage = No assertions are SUPPORTED.
---
WORKED EXAMPLE
RG Requirement: Allow access by authorized individuals and devices.
Atomic Assertions:
A1: Access is restricted.
A2: Authorization is required.
A3: Authorized individuals are covered.
A4: Authorized devices are covered.
A5: Scope is organizational access.
Control: "Production server and network device access is restricted
to senior IT staff through Active Directory group membership."
Assessment:
A1 SUPPORTED — Evidence: "access is restricted"
A2 SUPPORTED — Evidence: "Active Directory group membership"
A3 PARTIALLY SUPPORTED — Only senior IT staff, not all individuals.
A4 NOT SUPPORTED — No device authorization described.
A5 NOT SUPPORTED — Limited to production change management.
Final Rating: Partial
Reason: Satisfies authorization for limited workflow but not broader
organizational requirement.
Critical Missing: Authorized devices (A4), org-wide applicability (A5).
---
CONTROLS TO ASSESS ({control_count} controls):
{ctrl_text}
COMPLETENESS REQUIREMENT:
You MUST assess ALL {control_count} controls. Every control must appear
in the output. If irrelevant, score all assertions NOT SUPPORTED.
Return ONLY this JSON:
{
"rg_id": "{rg_id}",
"controls_assessed": [
{
"scf_id": "XXX-01",
"assertion_scores": [
{"assertion": "A1 text", "score": "SUPPORTED", "evidence": "quoted"}