{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://lossrate.ai/schema/v0.8.0/incident.json","title":"Lossrate Incident Record","description":"One documented AI incident, normalized with per-field citations and confidence grades. Covers both autonomous-agent failures and other AI failure modes. A record publishes only after verification, either by a human reviewer or by the automated gate whose score and checks are recorded here. Version 0.8.0.","type":"object","additionalProperties":false,"required":["schema_version","id","title","verification","system","event","impact","evidence","context"],"properties":{"schema_version":{"type":"string","const":"0.8.0","description":"Schema version this record conforms to."},"id":{"type":"string","pattern":"^LR-[0-9]{4}-[0-9]{4}$","description":"Stable public identifier: LR-<year of disclosure>-<4-digit sequence>. Never reused."},"record_version":{"type":"integer","minimum":1,"default":1,"description":"Increments on every correction. Prior versions remain published in the corrections log."},"title":{"type":"string","minLength":1,"maxLength":140,"description":"Short neutral headline for tables and links."},"verification":{"$ref":"#/$defs/verification"},"system":{"$ref":"#/$defs/system"},"event":{"$ref":"#/$defs/event"},"impact":{"$ref":"#/$defs/impact"},"evidence":{"$ref":"#/$defs/evidence"},"context":{"$ref":"#/$defs/context"},"narrative":{"type":["object","null"],"description":"The story of the case in five steps, synthesised across every stored source the record cites: each step a plain sentence the extractor wrote, kept only with a verbatim supporting sentence from one of those sources. A step no source supports is absent. Additive; a record without it is valid.","additionalProperties":false,"required":["steps","model","prompt_version","extracted_at"],"properties":{"steps":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["step","quote","source_index"],"properties":{"step":{"$ref":"#/$defs/narrative_step"},"quote":{"type":"string","minLength":20,"maxLength":600,"description":"The one sentence in the source at source_index that supports `text`; verbatim, checked."},"source_index":{"type":"integer","minimum":0},"text":{"type":["string","null"],"maxLength":450,"description":"The answer to the step's question in plain words, at most sixty words, written by the aggregate pass from every article's answers, grounded in `quote`."},"grade":{"oneOf":[{"$ref":"#/$defs/confidence_grade"},{"type":"null"}],"description":"Computed by the grade rule from the step's source and corroboration; null on records written before 0.7.0."}}}},"model":{"type":"string"},"prompt_version":{"type":"string"},"extracted_at":{"type":"string","format":"date"},"source_urls":{"type":"array","items":{"type":"string"},"description":"The source URLs the story was synthesised from. When the record's sources differ from this, the story is stale and is re-synthesised on the next scan."}}},"analysis":{"type":["object","null"],"description":"The deep dive: every section the record's full primary sources support, item by item, each a plain sentence grounded in a verbatim quotation. Extracted over the whole text in chunks, so a 200,000-character investigation is read entire. Additive; a record without it is valid.","additionalProperties":false,"required":["sections","model","prompt_version","extracted_at","source_urls"],"properties":{"sections":{"type":"object","additionalProperties":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["text","quote","source_index"],"properties":{"text":{"type":"string","maxLength":400,"description":"The item in plain words, written by the extractor, grounded in `quote`."},"quote":{"type":"string","minLength":20,"maxLength":800,"description":"Verbatim from the source at source_index; checked."},"source_index":{"type":"integer","minimum":0},"when":{"type":["string","null"],"description":"A date or time as the source states it, for timeline items."}}}}},"model":{"type":"string"},"prompt_version":{"type":"string"},"extracted_at":{"type":"string","format":"date"},"source_urls":{"type":"array","items":{"type":"string"}}}}},"$defs":{"adversarial_actor":{"type":"string","enum":["external_attacker","the_system_itself","insider","none","unknown"],"description":"Whether an external attacker was involved, or the system's own behaviour caused the event."},"analysis_method":{"type":"string","enum":["human_review","ai_assisted","ai_delegated","unknown"]},"autonomy_level":{"type":"string","enum":["suggest","approve-each","supervised-auto","full-auto","unknown"],"description":"How much a human was in the loop, from a stated fact about approval or monitoring. suggest: agent proposes, human executes. approve-each: human approves every action. supervised-auto: agent acts, human monitors and can halt. full-auto: no human in the loop during the run. unknown: no source states the arrangement, or no agent was involved. full-auto is never assumed from the absence of a mention.","x-test":{"suggest":"a source states a person carried out what the system proposed","approve-each":"a source states each action needed a person's approval","supervised-auto":"a source states the agent acted while a person watched or could stop it","full-auto":"a source states no person was in the loop while it ran","unknown":"no source states the arrangement"},"x-exclude":{"suggest":"","approve-each":"","supervised-auto":"","full-auto":"silence about a human is not a statement that none was there","unknown":""}},"citation":{"type":"object","additionalProperties":false,"required":["source_index","quote"],"properties":{"source_index":{"type":"integer","minimum":0,"description":"Index into evidence.sources."},"quote":{"type":"string","minLength":1,"description":"Verbatim sentence from the source."}}},"confidence_grade":{"type":"string","enum":["A","B","C","D"],"description":"One meaning everywhere a letter is shown. A: a primary source (the implicated party's own disclosure, a government evaluator, a court filing) states it. B: two independent sources state it. C: one secondary source states it. D: inferred by the pipeline from described behaviour; the reason is stored in the field's detail or in notes_on_gaps and shown beside the letter. Grades are computed from citations by rule (pipeline/verify/grades.py); no model assigns one."},"context":{"type":"object","additionalProperties":false,"required":["industry","org_size_band","country","denominator_available","denominator","related_incident_ids"],"properties":{"industry":{"type":["string","null"],"description":"Operator's industry, NAICS sector name where possible."},"org_size_band":{"oneOf":[{"$ref":"#/$defs/org_size_band"},{"type":"null"}]},"country":{"type":"string","pattern":"^([A-Z]{2}|unknown)$","description":"ISO 3166-1 alpha-2 of the operator, or 'unknown'."},"denominator_available":{"type":"boolean"},"denominator":{"oneOf":[{"$ref":"#/$defs/denominator"},{"type":"null"}]},"related_incident_ids":{"type":"array","items":{"type":"string","pattern":"^LR-[0-9]{4}-[0-9]{4}$"},"uniqueItems":true},"systemic_exposure":{"type":["boolean","null"],"description":"True when one shared model or component correlates the loss across many deployers."},"shared_model_id":{"type":["string","null"],"description":"Identifier of the shared model or version that carries the systemic exposure."},"upstream_incident_id":{"type":["string","null"],"pattern":"^LR-[0-9]{4}-[0-9]{4}$","description":"For enterprise records: the provider incident affecting the deployed version."},"incident_evidence":{"oneOf":[{"type":"object","additionalProperties":false,"properties":{"log_completeness":{"type":["string","null"],"description":"Share of relevant activity captured, as the source states it."},"tamper_evidence":{"type":["string","null"],"description":"Spoofed tool calls, deleted or edited entries."},"timestamp_reliability":{"oneOf":[{"$ref":"#/$defs/timestamp_reliability"},{"type":"null"}]},"investigation_independence":{"oneOf":[{"$ref":"#/$defs/investigation_independence"},{"type":"null"}]},"redaction_summary":{"type":["string","null"]},"analysis_method":{"oneOf":[{"$ref":"#/$defs/analysis_method"},{"type":"null"}]},"prompt_output_retention":{"type":["string","null"]}}},{"type":"null"}],"description":"Integrity of the incident's own evidence (the logs and investigation), distinct from Lossrate's per-field citations."},"regulatory":{"oneOf":[{"type":"object","additionalProperties":false,"properties":{"regimes":{"type":"array","items":{"type":"string","minLength":1},"uniqueItems":true,"default":[]},"notifications":{"type":["string","null"],"description":"Notifications made, e.g. 'GDPR Art. 33 filed 2026-09-01'."},"litigation_status":{"oneOf":[{"$ref":"#/$defs/litigation_status"},{"type":"null"}]},"safety_policy_adherence":{"type":["string","null"],"description":"Whether the event breached the provider's published frontier safety policy, as assessed by a source."}}},{"type":"null"}]},"coverage":{"oneOf":[{"type":"object","additionalProperties":false,"properties":{"responding_lines":{"type":"array","items":{"type":"string","minLength":1},"uniqueItems":true,"default":[],"description":"Cyber, Tech E&O, D&O, GL/Product, Media/IP, EPL, Provider E&O, contractual indemnity."},"posture":{"oneOf":[{"$ref":"#/$defs/coverage_posture"},{"type":"null"}]},"notes":{"type":["string","null"]}}},{"type":"null"}],"description":"Where the loss most plausibly lands and whether wordings respond. Lossrate judgement, grade D."}},"allOf":[{"if":{"properties":{"denominator_available":{"const":true}}},"then":{"properties":{"denominator":{"type":"object"}}}},{"if":{"properties":{"denominator_available":{"const":false}}},"then":{"properties":{"denominator":{"type":"null"}}}}]},"coverage_posture":{"type":"string","enum":["affirmative","silent","contested","excluded","novel","unknown"],"description":"Lossrate's judgement of how existing policy wordings respond. Always grade D with the reasoning in notes_on_gaps."},"date":{"type":"string","format":"date","pattern":"^[0-9]{4}-[0-9]{2}-[0-9]{2}$"},"denominator":{"type":"object","additionalProperties":false,"required":["value","unit"],"properties":{"value":{"type":"number","exclusiveMinimum":0},"unit":{"$ref":"#/$defs/denominator_unit"},"period":{"type":["string","null"],"description":"Period the denominator covers, e.g. '2026-Q2'."}}},"denominator_unit":{"type":"string","enum":["runs_per_month","agents_deployed","sessions","tasks","other"]},"deployment_context":{"type":"string","enum":["production","evaluation","training","research","unknown"],"x-plain":{"production":"in live use","evaluation":"in testing","training":"in training","research":"in research","unknown":"not stated"},"description":"Where the system was running, from a stated fact. production: serving customers or internal users. evaluation: a test or red-team run. training: a training run. research: an experiment. unknown: no source states it."},"detection_method":{"type":"string","enum":["automated_monitor","human_review","third_party","victim","public_researcher","never_detected","unknown"],"x-plain":{"automated_monitor":"automated monitoring","human_review":"a human reviewer","third_party":"an outside party","victim":"the victim","public_researcher":"an independent researcher or journalist","never_detected":"never detected","unknown":"not stated"},"description":"Who first noticed the incident and by what means. A sentence about the incident being reported or notified to others is not detection. When no source says who first noticed, the value is unknown.","x-test":{"automated_monitor":"a source states an automated system flagged the behaviour first","human_review":"a source states a person at the operator or developer noticed it in review or logs","third_party":"a source states an outside organisation (a vendor, a partner, a platform) noticed it first","victim":"a source states the affected party noticed it first","public_researcher":"a source states an independent researcher or journalist found it","never_detected":"a source states it was not detected before the disclosure that revealed it","unknown":"no source says who first noticed"},"x-exclude":{"automated_monitor":"a monitor that logged but did not flag is not detection","human_review":"a person told by a victim or researcher did not detect it","third_party":"the affected party is victim, not third party","victim":"","public_researcher":"a researcher who disclosed after being told is not the detector","never_detected":"","unknown":""}},"event":{"type":"object","additionalProperties":false,"required":["date_disclosed","trigger","incident_class","detection_method","summary"],"properties":{"date_occurred":{"$ref":"#/$defs/nullable_date","description":"Date the failure happened. Null if only the disclosure date is known."},"date_occurred_precision":{"enum":["day","month",null],"description":"Precision of date_occurred. 'month' means the source states only the month and date_occurred is the first of that month as a placeholder: show the month, never the day, and compute no lag or duration from it. Absent or null means a stated day."},"date_disclosed":{"$ref":"#/$defs/date","description":"Date the incident first became public."},"failure_class":{"oneOf":[{"$ref":"#/$defs/failure_class"},{"type":"null"}],"description":"Agent-mechanism taxonomy. Null when no autonomous agent was involved (for example a bias or hallucination incident in a non-agentic system)."},"secondary_failure_classes":{"type":"array","items":{"$ref":"#/$defs/failure_class"},"uniqueItems":true,"default":[],"description":"Additional classes when one incident exhibits several. Primary class goes in failure_class."},"trigger":{"$ref":"#/$defs/trigger"},"duration":{"type":["string","null"],"pattern":"^P(?!$)(\\d+Y)?(\\d+M)?(\\d+W)?(\\d+D)?(T(?=\\d)(\\d+H)?(\\d+M)?(\\d+S)?)?$","description":"How long the failure state persisted before detection/containment, ISO 8601 duration (e.g. 'PT4H', 'P3D'). Null if unknown."},"detection_method":{"$ref":"#/$defs/detection_method"},"summary":{"type":"string","minLength":1,"maxLength":1400,"description":"Neutral account of what happened: the system, what it did, how it was caught and what followed. At most 150 words. Written by the aggregate pass from every source's answers, not from one article; each sentence is supported by a cited source sentence. Shown in full on the case page."},"tags":{"type":"array","items":{"$ref":"#/$defs/tag"},"uniqueItems":true,"default":[],"description":"Emergent tags for this incident, each supported by a citation in field_citations['event.tags']. Complements, never replaces, failure_class and trigger."},"date_detected":{"$ref":"#/$defs/nullable_date","description":"First human awareness. With date_occurred, gives detection latency."},"near_miss":{"type":["boolean","null"],"description":"True when no loss materialised because the failure was caught first. Null if the source does not say."},"root_cause":{"oneOf":[{"$ref":"#/$defs/root_cause"},{"type":"null"}]},"root_cause_detail":{"type":["string","null"],"description":"Why this root cause: as the source states it, or the reason an inference rests on (grade D)."},"responsible_party":{"oneOf":[{"$ref":"#/$defs/responsible_party"},{"type":"null"}]},"adversarial_actor":{"oneOf":[{"$ref":"#/$defs/adversarial_actor"},{"type":"null"}]},"input_provenance":{"type":["string","null"],"description":"Which untrusted input carried the injection, when applicable."},"time_to_contain":{"type":["string","null"],"pattern":"^P(?!$)(\\d+Y)?(\\d+M)?(\\d+W)?(\\d+D)?(T(?=\\d)(\\d+H)?(\\d+M)?(\\d+S)?)?$","description":"ISO 8601 duration from detection to containment."},"operations_paused":{"type":["string","null"],"description":"What was halted (evaluations, deployments) and for how long, as stated."},"remediation":{"type":["string","null"],"description":"Controls changed to prevent recurrence, as stated."},"precursor_events":{"type":["string","null"],"description":"Earlier related events the source describes (e.g. unsanctioned channels seen months before)."},"incident_class":{"$ref":"#/$defs/incident_class","description":"Required for every incident. The insurance-facing mode."},"agent_involved":{"type":["boolean","null"],"description":"Whether an AI system acting with autonomy (tools, code, multi-step tasks) caused the event."},"failure_class_detail":{"type":["string","null"],"description":"Why this mechanism: as the source states it, or the reason an inference rests on (grade D)."},"control_failure":{"type":"array","items":{"$ref":"#/$defs/control_failure_item"},"default":[],"description":"Safeguards a source says were absent, bypassed or failed in this incident, each with the sentence that states it. Empty unless a source states it; an empty list means no source says, not that no safeguard failed. Filled by a separate pass over the case's sources, verbatim-checked."}}},"evidence":{"type":"object","additionalProperties":false,"required":["sources","per_field_confidence","field_citations","notes_on_gaps"],"properties":{"sources":{"type":"array","minItems":1,"items":{"$ref":"#/$defs/source"}},"per_field_confidence":{"type":"object","description":"Map from dotted field path (e.g. 'impact.direct_loss_usd') to confidence grade. Every non-null leaf field in system, event, impact and context must have an entry; enforced by the Pydantic model.","propertyNames":{"$ref":"#/$defs/field_path"},"additionalProperties":{"$ref":"#/$defs/confidence_grade"}},"field_citations":{"type":"object","description":"Map from dotted field path to verbatim source sentences supporting it. Required for every field graded A, B or C; enforced by the Pydantic model.","propertyNames":{"$ref":"#/$defs/field_path"},"additionalProperties":{"type":"array","minItems":1,"items":{"$ref":"#/$defs/citation"}}},"notes_on_gaps":{"type":"string","description":"What is unknown, why, and any inference made for D-grade fields. Empty string only if nothing is unknown."}}},"failure_class":{"type":"string","enum":["covert_sabotage","deception_or_concealment","harmful_compliance","injection_triggered","reward_hacking","impossible_task_persistence","unauthorized_communication","goal_adoption_from_peer","credential_misuse","data_exfiltration","containment_escape","silent_wrong_state"],"x-plain":{"covert_sabotage":"secretly sabotaged the task","deception_or_concealment":"lied about or hid what it did","harmful_compliance":"obeyed a harmful order","injection_triggered":"hijacked by hidden instructions","reward_hacking":"gamed its objective","impossible_task_persistence":"kept trying an impossible task","unauthorized_communication":"contacted outside systems","goal_adoption_from_peer":"took orders from another AI","credential_misuse":"misused credentials","data_exfiltration":"took data out","containment_escape":"escaped its sandbox","silent_wrong_state":"silently left things wrong"},"description":"How an autonomous agent failed, as the sources describe the mechanism. Set only when event.agent_involved is true. Each value has an inclusion test (x-test) that a cited sentence must meet and an exclusion (x-exclude) naming the neighbouring value; a value classified from behaviour rather than stated is grade D and carries its reason in failure_class_detail.","x-test":{"covert_sabotage":"a source states the agent degraded, corrupted or undermined the task or another system while appearing to complete it","deception_or_concealment":"a source states the agent misreported what it did, hid an action, or falsified a record or transcript","harmful_compliance":"a source states the agent carried out a harmful instruction it was given by its principal","injection_triggered":"a source states instructions embedded in content the agent read caused the action","reward_hacking":"a source states the agent satisfied its metric or success check without doing the task","impossible_task_persistence":"a source states the agent kept acting on a task it could not complete, causing the harm","unauthorized_communication":"a source states the agent contacted a system, person or service outside its permitted scope","goal_adoption_from_peer":"a source states another agent's instruction or output set the goal the agent pursued","credential_misuse":"a source states the agent used a credential, key or token for a purpose or scope it was not granted","data_exfiltration":"a source states data left the boundary it was meant to stay within by the agent's action","containment_escape":"a source states the agent acted outside the sandbox, environment or network it was confined to","silent_wrong_state":"a source states the agent left data or a system wrong and reported nothing"},"x-exclude":{"covert_sabotage":"an honest failure reported by the agent is silent_wrong_state only if unreported; sabotage requires appearing to succeed","deception_or_concealment":"a wrong answer given in good faith is not deception","harmful_compliance":"an instruction hidden in content, not given by the principal, is injection_triggered","injection_triggered":"an instruction from another agent is goal_adoption_from_peer","reward_hacking":"completing the task badly is not gaming the check","impossible_task_persistence":"one wrong attempt is not persistence","unauthorized_communication":"data carried out by the contact is data_exfiltration","goal_adoption_from_peer":"an instruction embedded in a document is injection_triggered","credential_misuse":"a credential exposed but never used is context, not this","data_exfiltration":"exposure without the agent moving the data is not exfiltration","containment_escape":"acting within the sandbox on things it should not is agent_permissions, not escape","silent_wrong_state":"a wrong state the agent reported is operational, not silent"}},"field_path":{"type":"string","pattern":"^(system|event|impact|context)\\.[a-z_]+$"},"harm_class":{"type":"string","enum":["financial","bodily","privacy","discriminatory","ip","third_party_security","reputational","operational","none_materialised"]},"impact":{"type":"object","additionalProperties":false,"required":["direct_loss_usd","remediation_hours","records_exposed","third_parties_affected_count","severity"],"properties":{"direct_loss_usd":{"$ref":"#/$defs/nullable_number","description":"Directly attributable monetary loss in USD. Null unless a source states a figure."},"remediation_hours":{"$ref":"#/$defs/nullable_number"},"records_exposed":{"$ref":"#/$defs/nullable_integer"},"third_parties_affected_count":{"minimum":0,"description":"Third parties affected, when stated or derivable. Null when the sources do not say: an unknown count is not zero.","anyOf":[{"type":"integer","minimum":0},{"type":"null"}]},"severity":{"$ref":"#/$defs/severity"},"harm_class":{"type":"array","items":{"$ref":"#/$defs/harm_class"},"uniqueItems":true,"default":[],"description":"Kinds of harm that materialised. Empty if none stated."},"affected_description":{"type":["string","null"],"description":"Who or what was affected, in the source's words (e.g. '~1,200 agents on the board; private datasets at a third party')."},"protected_class_involved":{"type":["boolean","null"]},"data_categories_exposed":{"type":"array","items":{"type":"string","minLength":1},"uniqueItems":true,"default":[],"description":"credentials, private_repos, phi, pii, evaluation_data, ..."},"loss_range_usd":{"oneOf":[{"type":"object","additionalProperties":false,"required":["low","high"],"properties":{"low":{"type":"number","minimum":0},"high":{"type":"number","minimum":0}}},{"type":"null"}],"description":"Stated exposure range when a source gives one instead of a point figure."},"reversibility":{"oneOf":[{"$ref":"#/$defs/reversibility"},{"type":"null"}]},"downstream_exposure_count":{"$ref":"#/$defs/nullable_integer","description":"Deployments running the affected version, when stated."},"severity_because":{"type":["string","null"],"maxLength":400,"description":"Why this tier: the rung's test and the fact that met it, in one sentence, with the quote in field_citations. Null only on records written before 0.7.0."}}},"incident_class":{"type":"string","enum":["hallucination","harmful_output","bias_disparate_impact","privacy_leakage","security_compromise","ip_infringement","physical_safety","performance_drift","agent_misalignment","operational_error","other"],"description":"Universal failure taxonomy for any AI incident, aligned to insurance coverage lines. hallucination: fabricated or false output presented as fact. harmful_output: the system carried out or produced something harmful it should have refused. bias_disparate_impact: discriminatory outcomes for a protected group. privacy_leakage: personal or confidential data exposed through training or retrieval. security_compromise: injection, poisoning, credential misuse, exfiltration, containment escape. ip_infringement: output reproducing protected work or marks. physical_safety: bodily injury or property damage. performance_drift: quiet degradation causing accumulated loss. agent_misalignment: an agent pursued its own objective, deceived, sabotaged or gamed its task. operational_error: wrong system state, deletion or corruption without malice. other: none of the above; explain in notes_on_gaps.","x-plain":{"hallucination":"made things up","harmful_output":"produced harmful content","bias_disparate_impact":"biased or discriminatory","privacy_leakage":"leaked private data","security_compromise":"security breach","ip_infringement":"copyright or IP violation","physical_safety":"physical harm","performance_drift":"got worse over time","agent_misalignment":"AI pursued the wrong goal","operational_error":"operational mistake","other":"other"},"x-test":{"hallucination":"a source states the system produced false or fabricated content that was presented or relied on as fact","harmful_output":"a source states the system produced content, or carried out an action, that it should have refused","bias_disparate_impact":"a source states outcomes differed for a protected group","privacy_leakage":"a source states personal or confidential data reached a party not entitled to it, with no attacker driving it","security_compromise":"a source states an attacker, an injected instruction or a misused credential caused the system to act, or that the system's own boundary (sandbox, permissions, weights, accounts) was breached","ip_infringement":"a source states output reproduced protected work, code or marks","physical_safety":"a source states bodily injury or property damage","performance_drift":"a source states output quality degraded over time and loss accumulated before it was noticed","agent_misalignment":"a source states the agent deceived, sabotaged, gamed its objective, coordinated with other agents or pursued a goal it was not given, and names no external instruction that caused it","operational_error":"a source states data or a system was left in a wrong state, deleted, corrupted or acted on unintentionally, and names no adversary and no goal of the agent's own","other":"a concrete incident that meets no value's test; notes_on_gaps says why"},"x-exclude":{"hallucination":"content harmful in itself is harmful_output; a wrong action on a system is operational_error","harmful_output":"false content taken as true is hallucination; an action driven by an attacker's instruction is security_compromise","bias_disparate_impact":"one wrong answer with no group pattern is hallucination","privacy_leakage":"exposure driven by injection or an attacker is security_compromise","security_compromise":"an agent acting on a goal of its own with no external cause is agent_misalignment; a wrong action with no adversary and no breach is operational_error","ip_infringement":"","physical_safety":"","performance_drift":"a single failure at one moment is not drift","agent_misalignment":"behaviour an injected or attacker instruction caused is security_compromise; a plain mistake with no goal-directed element is operational_error","operational_error":"any named adversary is security_compromise; any deception or self-directed goal is agent_misalignment","other":"never chosen because a source is thin; a thin source gives the closest value at grade D with its reason"}},"investigation_independence":{"type":"string","enum":["internal","paid_third_party","unpaid_independent","embedded_evaluator","regulator","unknown"]},"lifecycle_stage":{"type":"string","enum":["training","evaluation","pre_release","production","deprecated","unknown"],"description":"Where in the model lifecycle the incident occurred. Pre-release events may fall outside product or service wordings."},"litigation_status":{"type":"string","enum":["none","threatened","filed","settled","unknown"]},"nullable_date":{"oneOf":[{"$ref":"#/$defs/date"},{"type":"null"}]},"nullable_integer":{"type":["integer","null"],"minimum":0},"nullable_number":{"type":["number","null"],"minimum":0},"nullable_string":{"type":["string","null"]},"org_size_band":{"type":"string","enum":["1-10","11-50","51-250","251-1000","1001-10000","10000+"]},"responsible_party":{"type":"string","enum":["provider","integrator","deployer","third_party","shared","unknown"],"description":"Who in the supply chain owns the defect. Basis for subrogation and for which policy answers."},"reversibility":{"type":"string","enum":["reversible","partial","irreversible","not_applicable","unknown"]},"root_cause":{"type":"string","enum":["data","guardrail","integration","infrastructure","adversarial_input","oversight","misalignment","unknown"],"description":"What failed, coded. The root cause names something that existed and failed, never something that was absent: 'no guardrail existed' is a gap for notes_on_gaps, not the value guardrail. data: a training or retrieval data defect. guardrail: a control that existed and did not hold. integration: wiring, permissions, tenant or scope error. infrastructure: a shared system became the channel. adversarial_input: untrusted content carried instructions. oversight: a human review step existed and was skipped or failed. misalignment: the system pursued its own objective. unknown: no source names what failed.","x-test":{"data":"a source states a defect in training or retrieval data produced the behaviour","guardrail":"a source states a control that was in place failed to hold","integration":"a source states a permission, scope, tenant or wiring error let it happen","infrastructure":"a source states a shared system or channel was the path","adversarial_input":"a source states untrusted content carried the instruction","oversight":"a source states a human check existed and was skipped or failed","misalignment":"a source states the system pursued an objective of its own","unknown":"no source names what failed"},"x-exclude":{"data":"","guardrail":"a control that did not exist is not a failed guardrail; note the absence in notes_on_gaps","integration":"","infrastructure":"","adversarial_input":"","oversight":"a review that never existed is not a failed one","misalignment":"","unknown":""}},"severity":{"type":"string","enum":["negligible","minor","moderate","major","severe"],"description":"The highest rung a cited fact reaches. Where a source states a loss figure the dollar bands stand (minor under 10k USD, moderate 10k-100k, major 100k-10M, severe over 10M). Otherwise: negligible, no effect beyond the system itself and nothing left changed; minor, contained to one deployer or one evaluation with routine cleanup and no third party touched; moderate, data or systems of others touched with a bounded scope stated; major, many third parties, a regulator involved, a live production compromise, or an unbounded scope stated; severe, safety of life, or systemic, one shared model or component correlating loss across deployers. impact.severity_because names the rung's test and the fact that met it; a tier without a cited fact is grade D and says so.","x-test":{"negligible":"no effect beyond the system itself; nothing left changed","minor":"contained to one deployer or one evaluation; routine cleanup; no third party touched","moderate":"data or systems of others touched, with a bounded scope stated","major":"many third parties, a regulator involved, a live production compromise, or an unbounded scope stated","severe":"safety of life, or systemic: one shared model or component correlating loss across deployers"}},"source":{"type":"object","additionalProperties":false,"required":["url","publisher","date","type"],"properties":{"url":{"$ref":"#/$defs/url"},"publisher":{"type":"string","minLength":1},"date":{"$ref":"#/$defs/date"},"type":{"$ref":"#/$defs/source_type"},"title":{"type":["string","null"]},"archived_url":{"oneOf":[{"$ref":"#/$defs/url"},{"type":"null"}]},"attachment":{"oneOf":[{"$ref":"#/$defs/attachment_reason"},{"type":"null"}],"description":"Why this source is attached to the record; null on sources attached before 0.7.0."}}},"source_type":{"type":"string","enum":["lab_disclosure","gov_evaluator","independent_investigation","press","court_filing","vendor_research","community","academic","standards_body"],"description":"Who published the source. lab_disclosure: the implicated developer or operator. gov_evaluator: a government evaluator or regulator. independent_investigation: a non-government evaluator or research organisation. press: a news outlet. court_filing: a court or regulator's filing. vendor_research: a security or software vendor. community: a community database or forum. academic: a preprint or journal paper. standards_body: a standards organisation or guidance body.","x-plain":{"academic":"a research paper","standards_body":"a standards or guidance body"}},"system":{"type":"object","additionalProperties":false,"required":["developer","tools_granted","autonomy_level","guardrails_present","deployment_context"],"properties":{"model_name":{"type":["string","null"],"description":"Model family, e.g. 'GPT-5', 'Claude Opus 4'."},"model_version":{"type":["string","null"],"description":"Specific version or checkpoint string if disclosed."},"developer":{"type":"string","minLength":1,"description":"Organization that trained the model. 'unknown' if undisclosed."},"harness":{"type":["string","null"],"description":"Agent framework or product wrapping the model, e.g. 'Replit Agent', 'OpenAI Codex', custom scaffold."},"tools_granted":{"type":"array","items":{"type":"string","minLength":1},"uniqueItems":true,"description":"Tools/capabilities the agent had, e.g. 'shell', 'browser', 'email', 'database_write'. Empty if unknown."},"permissions_scope":{"type":["string","null"],"description":"Free text describing what the agent was allowed to touch."},"autonomy_level":{"$ref":"#/$defs/autonomy_level"},"guardrails_present":{"type":"array","items":{"type":"string","minLength":1},"uniqueItems":true,"description":"Controls in place at the time, e.g. 'sandbox', 'action_approval', 'output_classifier', 'rate_limit'. Empty if none disclosed."},"deployment_context":{"$ref":"#/$defs/deployment_context"},"tier":{"oneOf":[{"$ref":"#/$defs/tier"},{"type":"null"}],"description":"Provider or enterprise incident population."},"lifecycle_stage":{"oneOf":[{"$ref":"#/$defs/lifecycle_stage"},{"type":"null"}]},"integration_type":{"type":["string","null"],"description":"api, fine_tune, rag, agentic_with_tools, embedded, or free text if the source is specific."},"intended_use":{"type":["string","null"],"description":"What the system was deployed to do."},"safeguard_state":{"type":["string","null"],"description":"Classifiers on or off, helpful-only variants, refusal settings at the time, as stated by the source."},"production_intended":{"type":["boolean","null"],"description":"Whether the model involved was ever meant for production."}}},"tag":{"type":"string","pattern":"^[a-z0-9]+(-[a-z0-9]+){0,5}$","minLength":2,"maxLength":40,"description":"Open-vocabulary label in kebab-case describing a mechanism, asset, behaviour or context of the incident (e.g. 'compaction-summary-injection', 'public-file-host-exfiltration'). Tags emerge from analysis of each report; the registry in pipeline/tags.py tracks the vocabulary, first-seen dates and aliases."},"tier":{"type":"string","enum":["provider","enterprise"],"description":"provider: the failure happened inside a model provider's training, evaluation or release pipeline. enterprise: it happened at integration or use by an organisation deploying a model.","x-plain":{"provider":"company that built the AI","enterprise":"company using AI"}},"timestamp_reliability":{"type":"string","enum":["native","reconstructed","mixed","unknown"]},"trigger":{"type":"string","enum":["prompt_injection","impossible_task","reward_hack","credential_exposure","peer_agent_instruction","spontaneous","human_misuse","unknown"],"x-plain":{"prompt_injection":"hidden instructions in its input","impossible_task":"a task it could not do","reward_hack":"gaming its own objective","credential_exposure":"exposed credentials","peer_agent_instruction":"another AI told it to","spontaneous":"no outside cause","human_misuse":"misused by a person","unknown":"not stated"},"description":"What set the incident off, as a source states it. spontaneous is allowed only when a source rules out an external cause; when no source names a cause the value is unknown. A trigger is never inferred: grade D is not permitted on this field.","x-test":{"prompt_injection":"a source states instructions embedded in content the system read set it off","impossible_task":"a source states the task could not be completed and the failure followed from attempting it","reward_hack":"a source states the agent's objective or success metric was what it gamed","credential_exposure":"a source states an exposed or leaked credential was the means","peer_agent_instruction":"a source states another agent's instruction set it off","spontaneous":"a source states no external input caused the behaviour, or states the behaviour arose in normal operation with the cause ruled out","human_misuse":"a source states a person deliberately used the system to cause the harm","unknown":"no source states a cause"},"x-exclude":{"prompt_injection":"","impossible_task":"","reward_hack":"","credential_exposure":"","peer_agent_instruction":"","spontaneous":"never the default; an unstated cause is unknown","human_misuse":"an honest user mistake is not misuse","unknown":""}},"url":{"type":"string","format":"uri","pattern":"^https?://"},"verification":{"type":"object","additionalProperties":false,"required":["human_verified","method"],"properties":{"human_verified":{"type":"boolean","description":"True only after a human reviewer approved every field against its source quote."},"method":{"$ref":"#/$defs/verification_method"},"auto_verified":{"type":"boolean","default":false,"description":"True when the automated gate cleared this record for publication."},"score":{"anyOf":[{"type":"number","minimum":0,"maximum":100},{"type":"null"}],"description":"Verification score out of 100 at the time of publication. Null when never scored."},"score_breakdown":{"type":"object","additionalProperties":{"type":"number"},"default":{},"description":"Each scored component and the points it contributed. Published so the score can be recomputed and disputed."},"checks":{"type":"object","additionalProperties":{"type":"boolean"},"default":{},"description":"The pass/fail gates. Every one must pass before the gate can publish: schema validity, complete citation, verbatim quotes, distinctness, and cross-check agreement when enabled."},"gate_version":{"$ref":"#/$defs/nullable_string","description":"Version of the scoring rules that produced the score, so an old decision stays reproducible when the rules change."},"cross_check_model":{"$ref":"#/$defs/nullable_string","description":"Model used for the independent second extraction, when one was run."},"cross_check_agreement":{"anyOf":[{"type":"number","minimum":0,"maximum":1},{"type":"null"}],"description":"Share of key fields on which the second extraction agreed with the first."},"duplicate_of":{"$ref":"#/$defs/nullable_string","description":"Set when this record was held back as a near-duplicate of an existing incident id."},"verified_by":{"$ref":"#/$defs/nullable_string"},"verified_at":{"$ref":"#/$defs/nullable_date"},"extraction_run_id":{"type":["string","null"],"description":"Links to the logged extraction (model, prompt version, raw output) that produced the draft. Null for hand-authored records."}}},"verification_method":{"type":"string","enum":["none","human_review","automated_gate","automated_gate_then_human"],"description":"How this record came to be published. none: not yet verified, never published. human_review: a reviewer approved every field against its quote. automated_gate: the scored gate cleared it with no human in the loop. automated_gate_then_human: auto-published, then confirmed or corrected by a human."},"narrative_step":{"type":"string","enum":["doing","went_wrong","reached","caught","done"],"description":"The five steps of a case as questions. Each answer is one or two sentences, at most sixty words, in the extractor's words, grounded in one verbatim source sentence; 'not stated' when the sources do not answer. Graded by the same rule as a field.","x-plain":{"doing":"What it was doing","went_wrong":"What went wrong","reached":"What it reached or did","caught":"How it was caught","done":"What was done"},"x-question":{"doing":"What was the system doing, for whom, with what access?","went_wrong":"What did it do that it should not have, and what did that breach?","reached":"What did the action touch, and how far did it get?","caught":"Who first noticed, and by what means?","done":"What was contained, who was told, and what was changed?"},"x-complete":{"doing":"the task, the operator, the tools or permissions","went_wrong":"the action, the rule or boundary crossed","reached":"systems, data or people affected; the scope","caught":"the noticer (monitor, engineer, victim, researcher) and the signal; a notification to others is not this","done":"containment, notification, the control changed"}},"analysis_section":{"type":"string","enum":["timeline","actors","coordination","techniques","concealment","enabling_conditions","detection","impact","open_questions"],"description":"The sections of a deep dive, each a list of grounded items extracted from the full text of the record's primary sources.","x-plain":{"timeline":"What happened, in order","actors":"Who and what was involved","coordination":"How the agents communicated and organised","techniques":"What they used to do it","concealment":"What they did to avoid being caught","enabling_conditions":"What made it possible","detection":"How it was found","impact":"What it reached, and the numbers","open_questions":"What the sources say is still unknown or disputed"}},"guardrail_category":{"type":"string","enum":["pre_deployment_evaluation","red_teaming","independent_evaluation","safety_training","jailbreak_robustness","injection_defense","output_classifiers","usage_monitoring","agent_permissions","human_oversight","access_controls","safety_framework","monitoring_reasoning","weight_security","incident_disclosure","provenance"],"description":"Retired in 0.7.0. The sixteen categories of the first Safety trends pass; each maps to a catalogue measure as an alias (data/measures/aliases.json) so records tagged under it migrate without loss. Kept only for that migration.","x-plain":{"pre_deployment_evaluation":"tested for dangerous capabilities before release","red_teaming":"attacked on purpose before release (red-teaming)","independent_evaluation":"evaluated by an outside body before release","safety_training":"trained to refuse harmful requests","jailbreak_robustness":"measured resistance to jailbreaks","injection_defense":"defences against hidden instructions in its input","output_classifiers":"classifiers that screen inputs and outputs in production","usage_monitoring":"misuse monitoring and account enforcement","agent_permissions":"sandboxing and permission limits for agent actions","human_oversight":"a human must approve high-risk actions","access_controls":"staged or restricted access to capabilities","safety_framework":"a published framework with capability thresholds","monitoring_reasoning":"monitoring of the model's reasoning for misalignment","weight_security":"protection of the model's weights","incident_disclosure":"a commitment to report incidents","provenance":"watermarking or content credentials on outputs"}},"attachment_reason":{"type":"string","enum":["first_report","shared_document","back_reference","fingerprint","reviewer"],"description":"Why a source is attached to this incident. first_report: the article that created the record. shared_document: it cites a document another source of this record cites. back_reference: it refers to this incident's date, disclosure or URL. fingerprint: its identifying facts (developer, model, target, action, date) match. reviewer: a person attached it, reason logged.","x-plain":{"first_report":"the first report","shared_document":"cites the same document","back_reference":"refers back to this incident","fingerprint":"the same facts","reviewer":"attached by a reviewer"}},"layer":{"type":"string","enum":["training","inference_guard","agent_control","monitoring","evaluation","security","organisational"],"description":"Where in the stack a safety measure acts.","x-plain":{"training":"training","inference_guard":"inference guard","agent_control":"agent control","monitoring":"monitoring","evaluation":"evaluation","security":"security","organisational":"organisational"},"x-description":{"training":"changes the model itself","inference_guard":"a filter or classifier at run time","agent_control":"limits on what an agent may do","monitoring":"watching a running system","evaluation":"a test run before or after release","security":"protecting weights, access and infrastructure","organisational":"a policy, framework or commitment"}},"risk_domain":{"type":"string","enum":["cbrn","cyber","autonomy_and_replication","deception_and_sabotage","misuse_and_jailbreak","injection_and_agentic","harmful_content","bias","privacy","other"],"description":"The risk a test measures or a measure is meant to reduce, in the vocabulary providers and evaluators use.","x-plain":{"cbrn":"CBRN","cyber":"cyber","autonomy_and_replication":"autonomy & replication","deception_and_sabotage":"deception & sabotage","misuse_and_jailbreak":"misuse & jailbreak","injection_and_agentic":"injection & agentic","harmful_content":"harmful content","bias":"bias","privacy":"privacy","other":"other"},"x-description":{"cbrn":"chemical, biological, radiological, nuclear uplift","cyber":"offensive cyber capability","autonomy_and_replication":"autonomous action and self-replication","deception_and_sabotage":"deception, sabotage, sandbagging","misuse_and_jailbreak":"misuse and jailbreak resistance","injection_and_agentic":"prompt injection and agent tool misuse","harmful_content":"harmful or disallowed content","bias":"bias and fairness","privacy":"privacy and data protection","other":"other"}},"party":{"type":"string","enum":["provider","gov_evaluator","independent_evaluator","academic","standards_body","security_vendor","press"],"description":"Who says it.","x-plain":{"provider":"the model provider","gov_evaluator":"a government evaluator","independent_evaluator":"an independent evaluator","academic":"a research paper","standards_body":"a standards or guidance body","security_vendor":"a security vendor","press":"a news outlet"}},"statement_kind":{"type":"string","enum":["applied","named_by_standard","proposed","contested","bypassed"],"description":"What one document says about one measure. applied: the provider states the measure is in place for a version (provider documents only). named_by_standard: a standard or regulation names it, with the obligation's wording. proposed: a paper describes it. contested: published evidence it does not work as claimed. bypassed: a demonstrated circumvention, with the case or paper.","x-plain":{"applied":"stated in place by the provider","named_by_standard":"named by a standard","proposed":"described in a paper","contested":"evidence it does not work as claimed","bypassed":"shown to be bypassed"}},"evaluation_timing":{"type":"string","enum":["pre_deployment","post_deployment","not_stated"],"x-plain":{"pre_deployment":"before release","post_deployment":"after release","not_stated":"not stated"}},"measure_status":{"type":"string","enum":["draft","confirmed"],"x-plain":{"draft":"awaiting a reviewer","confirmed":"confirmed by a reviewer"}},"obligation":{"type":"string","enum":["required","should","may","not_stated"],"description":"The obligation's own wording in a standard or regulation, as the text gives it.","x-plain":{"required":"required","should":"should","may":"may","not_stated":"not stated"}},"grounded":{"type":"object","additionalProperties":false,"required":["quote","source_index"],"properties":{"quote":{"type":"string","minLength":20,"maxLength":800},"source_index":{"type":"integer","minimum":0}},"description":"A verbatim sentence from one of the record's documents, checked against the stored text."},"measure":{"type":"object","description":"One canonical safety measure (LM-YYYY-NNNN). Maturity and evidence are derived from its statements and evaluations, never stored.","additionalProperties":false,"required":["schema_version","id","name","layer","status"],"properties":{"schema_version":{"type":"string"},"id":{"type":"string","pattern":"^LM-[0-9]{4}-[0-9]{4}$"},"record_version":{"type":"integer","minimum":1},"name":{"type":"string","minLength":2,"maxLength":120},"aliases":{"type":"array","items":{"type":"string"}},"layer":{"$ref":"#/$defs/layer"},"risk_domain":{"type":"array","items":{"$ref":"#/$defs/risk_domain"}},"mitigates":{"type":"array","items":{"$ref":"#/$defs/incident_class"}},"addresses":{"type":"array","items":{"$ref":"#/$defs/failure_class"}},"description":{"type":["string","null"],"maxLength":1400},"limitations":{"type":["string","null"],"maxLength":1400},"headline":{"type":"boolean"},"status":{"$ref":"#/$defs/measure_status"},"sources":{"type":"array","items":{"$ref":"#/$defs/source"}},"field_citations":{"type":"object","additionalProperties":{"type":"array","items":{"$ref":"#/$defs/citation"}}},"confirmed_by":{"type":["string","null"]},"confirmed_at":{"oneOf":[{"$ref":"#/$defs/date"},{"type":"null"}]},"notes_on_gaps":{"type":"string"}}},"evaluation":{"type":"object","description":"One test run on one model version, as a document states it.","additionalProperties":false,"required":["domain","test","by","when","quote","source_index"],"properties":{"domain":{"$ref":"#/$defs/risk_domain"},"test":{"type":"string","minLength":1,"maxLength":200},"measure":{"type":["string","null"],"description":"The measure this test measures, when it measures one (LM id)."},"by":{"$ref":"#/$defs/party"},"when":{"$ref":"#/$defs/evaluation_timing"},"result":{"type":["string","null"],"maxLength":400,"description":"The result as given: a figure, a pass or fail against a named threshold, or one sentence. Null when the document says a test ran but gives nothing."},"metric":{"type":["string","null"],"maxLength":200},"value":{"type":["string","null"],"maxLength":100},"conditions":{"type":["string","null"],"maxLength":400,"description":"Attack class, dataset, sample size, scaffold, as stated."},"conclusion":{"type":["string","null"],"maxLength":400,"description":"What the provider concluded from it, when the card says."},"triggered":{"type":"array","items":{"type":"string"},"description":"Measures the card says were applied because of this result (LM ids or names)."},"quote":{"type":"string","minLength":20,"maxLength":800},"source_index":{"type":"integer","minimum":0},"grade":{"oneOf":[{"$ref":"#/$defs/confidence_grade"},{"type":"null"}]},"verified":{"type":"boolean"}}},"statement":{"type":"object","description":"One document says one thing about one measure, optionally about one model version.","additionalProperties":false,"required":["measure","kind","by","text","quote","source_index"],"properties":{"measure":{"type":"string","description":"LM id, or a proposed name held for the resolver."},"kind":{"$ref":"#/$defs/statement_kind"},"model_version":{"type":["string","null"],"description":"MV id; required for applied."},"answers":{"type":["integer","null"],"description":"Index of the evaluation this measure answers, on the same model version, when the card links them."},"by":{"$ref":"#/$defs/party"},"text":{"type":"string","maxLength":400},"quote":{"type":"string","minLength":20,"maxLength":800},"source_index":{"type":"integer","minimum":0},"scope":{"type":["string","null"],"maxLength":300},"obligation":{"oneOf":[{"$ref":"#/$defs/obligation"},{"type":"null"}]},"clause":{"type":["string","null"],"maxLength":120},"date":{"oneOf":[{"$ref":"#/$defs/date"},{"type":"null"}]},"grade":{"oneOf":[{"$ref":"#/$defs/confidence_grade"},{"type":"null"}]},"verified":{"type":"boolean"}}},"threshold":{"type":"object","additionalProperties":false,"required":["domain","level","quote","source_index"],"properties":{"domain":{"$ref":"#/$defs/risk_domain"},"level":{"type":"string","maxLength":80,"description":"As the provider's scale names it: ASL-3, CCL reached, High."},"crossed":{"type":["boolean","null"],"description":"Whether the card says the threshold was crossed."},"evaluations":{"type":"array","items":{"type":"integer"},"description":"Indexes of the evaluations the card cites for it."},"quote":{"type":"string","minLength":20,"maxLength":800},"source_index":{"type":"integer","minimum":0}}},"model_version":{"type":"object","description":"A model version as its provider documented it (MV-YYYY-NNNN): the tests run, the levels assigned, the conditions attached and the measures stated, each with its sentence.","additionalProperties":false,"required":["schema_version","id","kind","provider","model_name","documents"],"properties":{"schema_version":{"type":"string"},"id":{"type":"string","pattern":"^MV-[0-9]{4}-[0-9]{4}$"},"record_version":{"type":"integer","minimum":1},"kind":{"type":"string","enum":["model","framework"]},"provider":{"type":"string"},"model_name":{"type":"string"},"model_version":{"type":["string","null"],"description":"The version string as the card states it; null with notes_on_gaps saying so."},"aliases":{"type":"array","items":{"type":"string"},"description":"API identifiers and other names the version is known by."},"release_date":{"oneOf":[{"$ref":"#/$defs/date"},{"type":"null"}]},"release_date_precision":{"type":"string","enum":["day","month"]},"predecessor":{"type":["string","null"],"description":"MV id the card compares itself to, or the previous version of the line."},"predecessor_inferred":{"type":"boolean","description":"True when the predecessor was chosen by date rather than named by the card."},"documents":{"type":"array","items":{"$ref":"#/$defs/source"}},"framework":{"type":["string","null"],"description":"The framework and version the card names; never inferred from dates."},"framework_citation":{"oneOf":[{"$ref":"#/$defs/grounded"},{"type":"null"}]},"thresholds":{"type":"array","items":{"$ref":"#/$defs/threshold"}},"deployment_conditions":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["text","quote","source_index"],"properties":{"text":{"type":"string","maxLength":400},"quote":{"type":"string","minLength":20,"maxLength":800},"source_index":{"type":"integer","minimum":0}}}},"evaluations":{"type":"array","items":{"$ref":"#/$defs/evaluation"}},"statements":{"type":"array","items":{"$ref":"#/$defs/statement"}},"documents_read":{"type":"integer","minimum":0},"model":{"type":"string"},"prompt_version":{"type":"string"},"extracted_at":{"oneOf":[{"$ref":"#/$defs/date"},{"type":"null"}]},"notes_on_gaps":{"type":"string"}}},"control_failure_item":{"type":"object","additionalProperties":false,"required":["element_id","state","quote","source_index"],"properties":{"element_id":{"type":"string","pattern":"^C[0-9]{2}$","description":"A safeguard element id from the closed list in data/taxonomy/elements.json."},"state":{"type":"string","enum":["absent","bypassed","failed","not_stated_to_exist"],"description":"absent: a source says the control was not in place. bypassed: a source says it was circumvented. failed: a source says it was in place and did not work. not_stated_to_exist: a source says no such control was described or documented."},"quote":{"type":"string","minLength":15,"description":"The verbatim sentence from the source that states it."},"source_index":{"type":"integer","minimum":0,"description":"Index into evidence.sources."}}}}}