Appearance
Control Sources
Most organisations already have their controls written down — in policies, procedures, standards and configuration baselines. Control Source ingestion reads those documents and proposes the controls inside them.
The flow
Persisted layers
Ingestion stores the document broken into layers: document, section, paragraph, sentence, extracted control, normalised control.
The reason is practical. If a better extraction model becomes available, it runs a new pass over the same persisted text rather than requiring the document to be re-uploaded. Controls in your register can be regenerated, compared and superseded rather than frozen at whatever quality the extractor happened to have on the day.
Character offsets are computed against a canonical text reproducible from the stored units, so a candidate's citation back into the source stays valid regardless of parser changes.
Confidence banding
Each extracted candidate carries a confidence value and a recorded band. The band is stored on the candidate rather than recomputed at read time, so a later threshold change never silently rewrites how an existing control was released.
| Band | Meaning |
|---|---|
| Auto | High confidence, verbatim from the document |
| Review | Normal review queue |
| Validate | Lower confidence; needs careful checking against the source |
Banding routes attention. It is not a quality guarantee, and a candidate in the auto band is still a proposal.
Reviewing candidates
For each candidate you can edit its text, reject it, or publish it into the Control Register.
What to check:
- Is it a control? Policy documents contain principles, definitions and aspirations as well as controls. "The organisation values information security" is not a control.
- Is it operational? A control that cannot be tested is not a control. Look for a trigger, an actor, a frequency and an outcome.
- Is it a duplicate? Several documents often describe the same control. Consolidate rather than publishing near-identical records.
- Does it match the source? The candidate cites its source location. Read it.
Editing requires control_source.review. Publishing requires control_source.publish.
The extraction trust override
Occasionally a candidate needs to be published or mapped when the AI pass did not read the full clause — for example where a document section could not be fully processed.
Doing so requires a separate, deliberately narrower permission: control_source.override_trust.
The override cannot be self-consumed
control_source.override_trust is deliberately narrower than control_source.publish. Accepting, in writing and on the record, the risk of publishing clauses the AI pass never read in full is a senior act — and the permission cannot be consumed by the person who granted it.
Without that separation, one person holding one permission could grant the override and immediately use it, which is self-approval of the one control standing between an organisation and a fabricated compliance finding.
Permissions
| Action | Permission |
|---|---|
| View source documents, extraction status and candidates | control_source.read |
| Upload and process source documents | control_source.ingest |
| Edit or reject candidates | control_source.review |
| Publish candidates as canonical controls | control_source.publish |
| Accept extraction trust risk | control_source.override_trust |
All require the control_assurance entitlement.
Example
A bank ingests its Information Security Policy, its Access Management Standard and its Change Management Procedure.
| Document | Candidates | Published | Rejected | Merged |
|---|---|---|---|---|
| Information Security Policy | 61 | 18 | 39 | 4 |
| Access Management Standard | 44 | 31 | 9 | 4 |
| Change Management Procedure | 38 | 27 | 8 | 3 |
The policy yields the fewest controls relative to its length, which is expected — policies state principles and delegate the operational detail to standards. Most rejections from it were statements of intent rather than controls.
The two operational documents yield a much higher proportion, because they are written as instructions.
Ingest standards and procedures before policies
Standards and procedures describe what people actually do and produce better candidates. Policies are worth ingesting for completeness, but expect a low yield and a lot of rejection.
Troubleshooting
"Extraction produced nothing." The document could not be converted to text. Scanned images without a text layer are the usual cause.
"Candidates are fragments." Documents with heavy formatting, tables or numbered sub-clauses can split awkwardly. Edit during review.
"I cannot publish." Publishing requires control_source.publish, which is separate from review.
"A candidate cites a section that does not match." Report it. Citation drift indicates a conversion problem worth investigating before publishing anything from that document.