One rule identity. Every source retained. A mission-specific baseline.
The Archetypal registry becomes the common-rule layer of CGRCC. Requirements, controls, policy contracts, release packs and evidence connect to it through explicit, versioned relationships.
Merge through mappings
| Existing material | CGRCC destination | Preserved context |
|---|---|---|
| AIR rule intent | Common rule | Stable AIR identity, wording, versions and original card |
| Publisher clause or framework statement | Source requirement | Actor, obligation strength, jurisdiction, exceptions, edition and locator |
| Workbook or policy mechanism | Control and test reference | Implementation notes, test definition and source-reported mapping |
| Local organization policy | Policy contract | Scope, parameters, authority, approval and exceptions |
| Released set of contracts | Policy pack | Pinned versions, integrity, release approval and rollback |
| Observed decision, execution or assessment | Evidence and assessment revision | Boundary, timestamp, source reference, model version and tenant ownership |
Similar wording proposes a review candidate. It does not erase a source clause or establish equivalence. A common rule can support several controls, and a control can support several obligations. Source approval or a product claim does not establish working enforcement.
Six steps to an organization baseline
- Inventory. Record original file hashes, duplicate uploads, publisher editions and source dates. Separate catalog knowledge from private organization configuration.
- Extract. Keep exact worksheet rows or Markdown line ranges. Label drafts, secondary guidance, historical material and unresolved references.
- Normalize and review. Retain stable identities, map source requirements to common rules, and review apparent equivalence before merging.
- Tailor. Define the organization, system, mission boundary, data, users, jurisdictions and consequential actions. Record applicability, mandatory obligations and critical controls.
- Rank and assess. Use the proposed scores below to plan work. Pin rule versions and retain the local impact, exposure, rationale and commonality snapshot with the baseline.
- Validate and release. Test effectiveness and boundary coverage, resolve blocking gaps, independently review evidence, approve exact contract and pack versions, and monitor observed execution.
Three scores with different purposes
| Measure | Initial method | Interpretation |
|---|---|---|
| Observed commonality | min(100, 20 × distinct source families) | A provisional recurrence index. Duplicate files, editions and secondary copies do not add independent support. Missing mappings remain unscored. |
| Mission priority | 60% local impact + 25% exposure + 15% commonality | Ranks applicable controls for planning. Applicable mandatory and critical controls are included regardless of rank. Unknown applicability requires review. |
| Mission safety planning index | Weighted dimensions plus seven blocking gates | A scoped, evidence-backed planning result. Frequency and high averages cannot override an unmet obligation or failed gate. |
The five-family normalization target and priority weights are proposed design choices. Commonality is not a percentage of all frameworks, legal authority, or mission risk. Source mappings still require review. Equivalent AIR and missionSAFE intents remain separate until their equivalence is approved, so their scores are not combined automatically.
Mission safety planning model
Model cgrcc-mission-score-0.1 follows the supplied missionSAFE workbook’s five dimensions and seven gates. All dimensions require a score, evidence reference and fresh evidence review date. Blank means unknown; a measured zero remains zero.
| Dimension | Weight | Evidence to consider |
|---|---|---|
| Governance & accountability | 20% | Accountable owners, authority, documented governance and exception handling |
| Applicable control coverage | 15% | Reviewed applicable-control inventory and its documented denominator |
| Enforcement & prevention | 25% | Representative prevention tests across sanctioned consequential paths |
| Evidence & independent assurance | 20% | Traceable evidence, reviewer independence and reproducible assurance reports |
| Monitoring, response & resilience | 20% | Monitoring, incident routing, kill-switch tests and recovery exercises |
Initial score anchors: 0 absent or failed; 25 initial and ad hoc; 50 partly implemented; 75 implemented and repeatedly tested; 100 complete for the defined scope with current effectiveness evidence. These anchors need calibration against real outcomes.
Seven gates
- G1 · Critical-rule coverage. All applicable critical rules cover every sanctioned consequential path.
- G2 · Effectiveness thresholds. Representative tests meet approved precision, recall, bypass and false-negative limits.
- G3 · High-impact oversight. High-impact use cases have an impact assessment, accountable owner, qualified oversight and fail-safe.
- G4 · Critical gaps & incidents. No unresolved or unaccepted critical control gap or incident remains.
- G5 · Surface coverage. At least 95% of discovered AI use is sanctioned, integrated or blocked with accepted residual risk; the denominator is documented.
- G6 · Response & recovery. Kill switch, evidence preservation, incident routing and recovery were tested within the approved period.
- G7 · Outputs & agent actions. Materially consequential external outputs and agent actions have covered enforcement boundaries.
Any failed gate yields Not ready. Missing scope, baseline review, dimension evidence or gate evidence yields Not assessed. With complete inputs and all gates passed, 85 or above meets the proposed planning threshold; 70–84.99 is conditional; below 70 is not ready. The initial evidence review window is 90 days.
Private assessment revisions preserve owner-reported evidence references and server-computed results. The system does not inspect an evidence URL to verify its claims. A result is neither a certification nor a probability of safety.
Keep TAIMScore distinct
The supplied TAIMScore document uses 0–4 control maturity and four equally weighted functions: GOVERN, MAP, MEASURE and MANAGE, at 25% each. Its maturity result is not interchangeable with the five-dimension mission planning index. The supplied maturity roadmap is a third model; its level formula needs correction at the upper boundary and is not reused.
Workbook source: missionSAFE v2, “10 Scoring Model,” rows 6–10 and 15–21. TAIMScore source: POLICY.md, lines 494–535. Full source manifests and exact record provenance are available in the registry export. The uploaded policy notes are secondary material; publisher editions and current authority need reconciliation before adoption.