Statement of Applicability
Clause 6.1.3 Statement of Applicability over the APA control catalog.
Clauses: 6.1.3
decisions (25)
soa-apa-ctl-001soa-apa-ctl-001
Defines the enforceable authority ladder for all sessions.
soa-apa-ctl-002soa-apa-ctl-002
Permits low-consequence observe/analyse within the ceiling.
soa-apa-ctl-003soa-apa-ctl-003
Supports meaningful human oversight of explanations.
soa-apa-ctl-004soa-apa-ctl-004
Gates recommendations that can influence investment decisions.
soa-apa-ctl-005soa-apa-ctl-005
Load-bearing HITL gate for order proposals.
soa-apa-ctl-006soa-apa-ctl-006
Absolute prohibition on autonomous execution.
soa-apa-ctl-007soa-apa-ctl-007
Entitlement-bound portfolio access is mandatory for client confidentiality.
soa-apa-ctl-008soa-apa-ctl-008
Prevents cross-book leakage in multi-portfolio sessions.
soa-apa-ctl-009soa-apa-ctl-009
Keeps numerical risk/exposure outputs in deterministic tools.
soa-apa-ctl-010soa-apa-ctl-010
Restricts FDC3 intents and tools to approved specialist applications.
soa-apa-ctl-011soa-apa-ctl-011
Research content is untrusted input that can attempt authority escalation.
soa-apa-ctl-012soa-apa-ctl-012
Grounds explanations and recommendations in retrieved sources/tool outputs.
soa-apa-ctl-013soa-apa-ctl-013
Provides evidence for audit, incidents and human-approval coverage metrics.
soa-apa-ctl-014soa-apa-ctl-014
Manages hosted-model dependency and contractual processing limits.
soa-apa-ctl-015soa-apa-ctl-015
Required for serious AI incident handling and FCA notification readiness.
soa-apa-ctl-016soa-apa-ctl-016
Demo suite contexts used as evidence must carry FDC3 Security signatures so explain/recommend/propose grounding is provenance-verified.
soa-host-ccc-k8s-cn02soa-host-ccc-k8s-cn02
Host assumption via CCC Managed Kubernetes host controls (shared by Portfolio Assistant and Governance Runtime deployments): least-privilege cluster authorization.
soa-host-ccc-k8s-cn03soa-host-ccc-k8s-cn03
Host assumption via CCC Managed Kubernetes host controls: federated workload identity for assistant and runtime services.
soa-host-ccc-k8s-cn05soa-host-ccc-k8s-cn05
Host assumption via CCC Managed Kubernetes host controls: restricted workload security for assistant and runtime pods.
soa-host-ccc-k8s-cn06soa-host-ccc-k8s-cn06
Host assumption via CCC Managed Kubernetes host controls: default-deny network policies constrain egress to approved model and desktop-integration endpoints.
soa-host-ccc-k8s-cn07soa-host-ccc-k8s-cn07
Host assumption via CCC Managed Kubernetes host controls: Kubernetes secrets protected per CCC for assistant and runtime workloads.
soa-host-ccc-k8s-cn14soa-host-ccc-k8s-cn14
Host assumption via CCC Managed Kubernetes host controls: cluster audit/monitoring retention complements app-layer session evidence (apa-ctl-013) and Governance Runtime evidence recording.
soa-store-ccc-objstor-cn09soa-store-ccc-objstor-cn09
Store assumption via CCC Object Storage: Decisions and Evidence Record bucket blocks public access by default.
soa-store-ccc-objstor-cn04soa-store-ccc-objstor-cn04
Store assumption via CCC Object Storage: default retention policy on evidence objects.
soa-runtime-ctl-003soa-runtime-ctl-003
Governance Runtime records evaluation and enforcement outcomes to the Evidence Record; CCC Object Storage covers store posture only.