# ACAM Annex: Entity-Risk Declaration (A5)

**Version 0.1.0-draft** · Status: **draft for review** · License: **CC BY 4.0** · apeiris.ai

> Part of the ACAM release unit (`ACAM-SPEC.md` §17 V-1); versions with the standard.
> Normative for: `ACAM-SPEC.md` §14.3 (entity-risk declaration) and the risk key consumed by
> the §11.2 minimum-n table (work package A2, `acam-sampling.json`). Machine-readable half:
> `acam/acam-entity-risk.json` (axes, ordinal enums, tier rules as data). Design of record:
> `../COVERAGE_ASSESSMENT_PLAN.md` §5. Field names align to the platform's
> `assurance-target.schema.json` (apeiris-control-core) wherever an equivalent exists; §4
> records exactly where they do and where ACAM extends.
>
> The A1 drafting discipline applies: every normative clause carries an **Enforcement:** line.
> Schema/verifier mechanisms are WS-B work — specified here, not yet implemented.

---

## 1. Principle: judgment made visible

Entity risk is a judgment. ACAM does not remove the judgment; it makes it **declared, ordinal,
signed, and challengeable** — never hidden inside a weighting nobody can inspect:

- **ER-1 (declared and signed).** The dossier scoping header records all five axes of §2, each
  with its ordinal value and a free-text `basis` naming what the value rests on. The axes are
  inside the signed payload and render on the dossier cover. All five are required at
  `status: final`. Enforcement: schema `required` at final; cover rendering is computed from
  the recorded fields (the §11.1 cover-line pattern).
- **ER-2 (fail-closed default).** In any computation that consumes an axis (sampling minimums,
  recommendation weights), an undeclared or unparseable axis evaluates at its **maximum
  ordinal** — risk defaults high, never low. This governs draft dossiers, which may not yet
  declare axes; it never substitutes for ER-1 at final. Enforcement: the consuming functions
  take the declared vector through a totalizing step published in `acam-entity-risk.json`
  (`fail_closed_default`); the conformance corpus includes an axes-absent draft specimen whose
  computed minimums must equal the maximum-tier minimums.
- **ER-3 (challengeable, append-only).** Any party to the dossier may file a signed
  **`entity-risk-challenge`** record naming the axis, the declared value, the proposed value,
  and a basis. Challenges are append-only and rendered alongside the declaration; they never
  silently mutate it — an accepted challenge is a restatement (the §13 restatement machinery),
  which recomputes every consumer of the axis. Enforcement: schema — the declaration has no
  mutable fields; the challenge record references it by digest; the verifier lists open
  challenges in its output for the dossier.
- **ER-4 (never a synthetic index).** No blended entity-risk score exists (the SC-3 rule
  applied to scoping). Axes combine only through the published dominance rules of §5 —
  per-axis thresholds, no arithmetic blending. Enforcement: the closed schema has no score
  field; the tier rules in `acam-entity-risk.json` are threshold predicates, not weights.

## 2. The five axes

All axes are ordinal, ascending in risk (0 = lowest). Values ship as data in
`acam-entity-risk.json` (`axes`); the schema generates from that file. Enforcement: the JSON
is the normative machine form; a diverging schema fails the release consistency check (V-3).

### 2.1 `consequence_class` — per-category consequence (financial / safety / rights)

Three required categories — `financial`, `safety`, `rights` — each rated on the ordinal
vocabulary ACAM **reuses verbatim from `assurance-target.schema.json` `impact_level`**:

```
minimal (0) < limited (1) < significant (2) < high (3) < critical (4)
```

The category meanings follow the source enum's definitions applied per harm family: what an
erroneous or malicious output could do to affected parties' finances, to their health and
physical safety, and to their legal or fundamental rights. Declaring three categories rather
than one blended level is the ACAM extension (§4): a lending model can be
`financial: critical` and `safety: minimal`, and the difference must drive different sampling
and different recommendations. Consistency rule: where a dossier also pins an assurance-target
snapshot, that snapshot's single `impact_level` must equal the **maximum** of the three
declared categories. Enforcement: schema requires all three; the max-consistency check is a
verifier computation (ER-6).

### 2.2 `autonomy_level` — degree of autonomous action

**Reused verbatim** from `assurance-target.schema.json` (name, enum, definitions):

```
assistive (0) < advisory (1) < semi-autonomous (2) < autonomous (3)
```

Enforcement: same-enum reuse is asserted by the release consistency check comparing the JSON
enum against the platform schema's; a drift is a release blocker, not a silent fork.

### 2.3 `reversibility` — can the system's actions be undone?

ACAM extension (no assurance-target equivalent; the source schema embeds reversibility in
`impact_level` prose — "recoverable", "irreversible" — without a declarable field):

```
fully-reversible (0) < reversible-with-intervention (1) < partially-reversible (2) < irreversible (3)
```

- `fully-reversible` — actions undo automatically or trivially (draft content, sandboxed
  effects).
- `reversible-with-intervention` — undo exists but requires human or operational action
  (refunds, rollbacks, corrections).
- `partially-reversible` — some downstream effects persist after the best available remediation
  (disclosed data, sent communications, market actions).
- `irreversible` — no remediation restores the prior state (physical harm, destroyed data,
  executed legal effect).

Enforcement: closed enum in schema; the declared value's `basis` must name the undo mechanism
relied on for any value below `irreversible` (schema conditional requirement).

### 2.4 `population_exposed` — who can the system reach?

ACAM extension (assurance-target's `affected_parties` names who is affected, free-text and
non-ordinal; ACAM adds the ordinal band):

```
internal-only (0) < bounded-external (1) < broad-external (2) < general-public (3)
```

- `internal-only` — exposure limited to the organization's own personnel and systems.
- `bounded-external` — an enumerable external population ≤ 10,000 (draft bound, decision E-2).
- `broad-external` — an enumerable external population > 10,000.
- `general-public` — unbounded reach; no enumeration of the exposed population exists.

The band is a population claim, so the population-completeness principle (§4 of the standard)
applies: bands 0–2 must name their enumeration basis; a band declared without one evaluates as
`general-public` (fail-closed). Enforcement: schema conditional requirement mirroring §11.1
`population_enumeration_basis`; the fail-closed promotion is a verifier computation.

### 2.5 `regulatory_classification` — the strictest applicable regime

ACAM extension (assurance-target carries the **inputs** — `jurisdiction`, `sector`,
`asset_size_usd`, `actor_role` — but no ordinal classification):

```
no-applicable-regime (0) < voluntary-frameworks-only (1) < supervisory-guidance-in-scope (2)
  < binding-sector-regulation (3) < high-risk-regime (4)
```

- `voluntary-frameworks-only` — only voluntary standards apply (ISO, NIST RMF class).
- `supervisory-guidance-in-scope` — supervisory guidance reaches the entity (non-enforceable
  instruments included, per their instrument metadata).
- `binding-sector-regulation` — binding law or regulation applies to the system's operation.
- `high-risk-regime` — the system falls in a designated high-risk class of a binding regime
  (EU AI Act high-risk classification or equivalent).

Consistency rule: the declared value may never be **lower** than what the ASSESS-9/F3
applicability computation (`entity_scope_predicate` over these same declared inputs) implies —
if a binding instrument computes `applies`, the declaration must read ≥
`binding-sector-regulation`. Higher-than-computed declarations are permitted (conservatism is
never a defect). Enforcement: verifier cross-check against the applicability results pinned in
the dossier; a lower-than-computed declaration fails validation.

## 3. What the axes feed

### 3.1 Sampling minimums (the A2 risk key)

The §11.2 minimum-n table (`acam-sampling.json`, work package A2) keys on
**control frequency × risk tier**. This annex supplies the risk tier deterministically:

- **ER-5 (tier derivation — dominance, not blending).** `risk_tier ∈ {baseline, heightened}`.
  The tier is `heightened` iff **any one** of the published threshold predicates holds
  (`acam-entity-risk.json` `risk_tier_rules`, draft values — decision E-3):
  - any `consequence_class` category ≥ `high` (3);
  - `autonomy_level = autonomous` (3) **and** `reversibility` ≥ `partially-reversible` (2);
  - `population_exposed = general-public` (3);
  - `regulatory_classification` ≥ `binding-sector-regulation` (3).

  Otherwise `baseline`. No weighted sum exists; each predicate is independently sufficient and
  independently displayable ("heightened because: regulatory_classification"). Enforcement:
  pure predicate evaluation shipped as data; the verifier recomputes the tier and the firing
  predicate list; a dossier recording a tier the verifier does not recompute fails conformance.
- **ER-5a (binding to A2).** The tier feeds the minimum-n lookup alongside the control's
  frequency and its `blocking_effect`; the exact row semantics belong to `acam-sampling.json`
  and bind by version pin (V-1 — the annexes version together, so a tier-vocabulary change and
  a table re-cut are one release act). Enforcement: the dossier pins one ACAM version; the
  verifier evaluates table and tier from the same pinned release.
- **ER-5b (fail-closed interaction).** Under ER-2, undeclared axes ⇒ maximum ordinals ⇒
  `heightened` ⇒ the highest minimum-n row. A declarant lowers sampling burden only by
  declaring — and signing — lower risk. Enforcement: composition of ER-2 and ER-5; the
  conformance corpus specimen of ER-2 exercises this path.

### 3.2 Recommendation weights

Axes feed the §14.5 recommendation ranking as **displayed, decomposed inputs**:

- **ER-7 (decomposed display).** Every export that ranks recommendations shows, per item, the
  per-axis contribution to its rank position — the §14.5 display-non-optional rule extended to
  the axis level. No aggregate entity-risk multiplier appears without its per-axis
  decomposition beside it. Enforcement: export schema carries the per-axis fields as required
  siblings of the rank.
- **ER-8 (weights are versioned data).** The weight vector consuming the axes ships in the
  ACAM release (A2/A3 annex data), never hardcoded in a tool; the §14.5 rank-stability
  commitment applies to it before the ranking is marketed as more than a default sort.
  Enforcement: the weights carry the release version; the claim-language rule of §14.5 gates
  the marketing.

### 3.3 Aggregation pattern flags

The §14.4 pattern flags evaluate against the declared axes where relevant (an `effective`-on-
n=1 flag on a `heightened`-tier dossier is a stronger prompt than on baseline). Flags remain
judgment prompts requiring signed responses; the axes never auto-answer them. Enforcement:
flag predicates are pure functions over dossier + axes; unanswered flags fail validation
(§14.4).

## 4. Alignment map: ACAM axis ↔ `assurance-target.schema.json`

| ACAM axis | assurance-target field | Status |
|---|---|---|
| `consequence_class.{financial,safety,rights}` | `impact_level` (single blended ordinal) | **Extension** — ACAM splits into three categories reusing the `impact_level` value vocabulary; declared max must reconcile to the snapshot's `impact_level` (ER-6). Proposed upstream extension: optional `impact_by_category` on assurance-target. |
| `autonomy_level` | `autonomy_level` | **Aligned** — name and enum reused verbatim. |
| `reversibility` | — (prose inside `impact_level` descriptions only) | **Extension** — new ordinal field. Proposed upstream extension: same enum on assurance-target. |
| `population_exposed` | `affected_parties` (free-text list, non-ordinal) | **Extension** — ordinal band with enumeration basis; `affected_parties` remains the qualitative companion. |
| `regulatory_classification` | inputs only: `jurisdiction`, `sector`, `asset_size_usd`, `actor_role` | **Extension** — ordinal classification derived-then-declared over those inputs; consistency-checked against the ASSESS-9 applicability computation. |

- **ER-6 (snapshot reconciliation).** Where a dossier pins an assurance-target snapshot, the
  declared axes must not contradict it: `autonomy_level` must match; max of
  `consequence_class` must equal `impact_level`; a contradiction at `status: final` fails
  validation. Enforcement: verifier field-comparison against the pinned snapshot digest.

## Annex: draft decisions flagged for founder review

- **E-1** — ER-2's fail-closed default is the maximum ordinal per axis (not a mandatory
  refusal to compute).
- **E-2** — the `bounded-external`/`broad-external` boundary is 10,000 enumerable external
  parties.
- **E-3** — the ER-5 tier thresholds (any consequence ≥ high; autonomous ∧ ≥
  partially-reversible; general-public; ≥ binding-sector-regulation), and the two-tier
  vocabulary itself (`baseline`/`heightened`), finalized jointly with the A2 table so tier
  granularity and table rows stay one decision.
- **E-4** — `consequence_class` reuses the `impact_level` value vocabulary per category rather
  than defining per-category scales.