{
  "upload_format": "apeiris-partner-mappings/1",
  "submitter": { "organization": "Example Partner LLP", "contact": "analyst@example.com", "prepared": "2026-07-21" },
  "items": [
    {
      "ref": "apeiris://security/controls/IA-01",
      "enrichment_type": "third-party-crosswalk",
      "payload": {
        "mappings": [
          { "framework": "eu_ai_act", "requirement_id": "Article 15", "fit": "partial", "relation": "satisfies", "normative_force": "binding-law", "mapping_confidence": "medium", "rationale": "Per-agent distinct identity contributes to the Article 15 accuracy/robustness/cybersecurity obligation but does not by itself satisfy it." },
          { "framework": "iso_42001", "requirement_id": "A.6.2.2", "fit": "direct", "relation": "equivalent_to", "normative_force": "certification-standard", "mapping_confidence": "high", "rationale": "A distinct identity per agent maps directly to the AI system operation control." }
        ]
      }
    },
    {
      "ref": "apeiris://identity/controls/II-01",
      "enrichment_type": "third-party-crosswalk",
      "payload": {
        "mappings": [
          { "framework": "nist_ai_rmf", "requirement_id": "GOVERN 1.2", "fit": "supporting", "relation": "informs", "normative_force": "voluntary-standard", "mapping_confidence": "medium", "rationale": "An agent identity registry supports the accountability structures called for in GOVERN 1.2." }
        ]
      }
    },
    {
      "ref": "apeiris://agentic/controls/AA-03/frameworks/eu_ai_act/Art. 15(5)",
      "enrichment_type": "mapping-trust-vote",
      "payload": { "verdict": "direct", "confidence": "high", "rationale": "Agree — mTLS with certificate-based agent authentication is a direct technical measure toward the Art. 15(5) robustness/cybersecurity obligation." }
    }
  ]
}