03 Normative Knowledge and Policy.en - jiale-li-orion/SecFusionAgent GitHub Wiki

Technical Standards, Policy and Regulation, and Normative Knowledge

English | 中文

This document fixes how SecFusionAgent handles technical standards, policy and regulation, and governance frameworks. Such material exists in the system as normative knowledge, used for applicability queries, risk/control mapping and runtime constraints; it is not mixed with vulnerability intelligence or research insight, and it does not gain execution authority because an Agent retrieved it. This document follows the evidence/object/relation contract of 01-Data-Sources-and-Processing and the reuse-first policy of 02-CTI-Baseline-Reuse-and-Ownership.

The research snapshot date is 2026-09-24. Regulations, standards and frameworks carry a version, a status, applicable subjects and geographic boundaries, and the system subsequently follows the latest status from official sources.

Information role

Normative knowledge answers three kinds of question: what requirements constrain a given subject in a given jurisdiction and scenario; which controls, standard clauses or governance requirements a given AI risk corresponds to; and which hard constraints or review gates SecFusionAgent itself needs to apply when performing a given kind of action.

Vulnerability intelligence describes what happened, research insight describes new understanding of risk and defense, and normative knowledge describes what ought, must not, may or is recommended to be done. The three kinds of information can reference the same risk object while keeping independent evidence and authority.

Information class Primary question Typical objects System use
threat / vulnerability intelligence what happened, who is affected, how to remediate CVE, advisory, incident, PoC monitoring, enrichment, investigation
research intelligence which attack, defense or threat model changed existing understanding paper, benchmark, experiment taxonomy, insight, residual risk
normative knowledge who must satisfy what requirement under which conditions regulation, standard, requirement, control query, control mapping, runtime policy

Normative document classification

All types below belong to the product normative source category fixed by 01; this section further classifies normative documents and does not create another product source taxonomy. Different jurisdictions and standards systems cannot be compressed into a single "authority score". The system records document type, legal/standards status, jurisdiction, binding status and applicability conditions, and preserves the relations a document has with parent documents, implementing standards and interpretive documents.

Type Typical objects Binding semantics Handling
regulation / administrative rule the Interim Measures for the Management of Generative AI Services (《生成式人工智能服务管理暂行办法》), the Measures for Labeling AI-Generated Synthetic Content (《人工智能生成合成内容标识办法》), EU AI Act legally binding under its jurisdiction and applicability conditions official full-text snapshot, clause-level requirement extraction, maintenance of effective and amended status
mandatory standard GB 45438-2025 treated as a mandatory national standard within its applicable scope store standard metadata and lawfully accessible text, extract enforceable technical requirements
recommended standard GB/T 45654-2025, GB/T 45652-2025, GB/T 45674-2025 recommended; whether it becomes a basis for contract, assessment or supervision is decided by the specific context used as a control/assessment baseline, not automatically upgraded to a legal obligation
management / risk framework NIST AI RMF, NIST GAI Profile, ISO/IEC 42001, ISO/IEC 23894, ISO/IEC 42005 mostly voluntary or standardized management frameworks; the concrete constraint depends on how they are adopted map risk, control, assessment and governance processes
policy / planning document the National Guidelines for the Construction of a Comprehensive Standardization System for the AI Industry (2024 Edition) (《国家人工智能产业综合标准化体系建设指南（2024版）》) and similar describes policy direction, standards system and construction goals used for landscape/query, not compiled into runtime hard rules
technical report / guidance ISO/IEC TR 24028, NIST Playbook and similar advisory used as mitigation/control evidence and design reference

binding_status preserves the binding nature of a document in the current context, and inference from a source name is prohibited. For example, ISO standards, NIST frameworks and recommended national standards may play different practical roles in different contractual and regulatory environments; applicability judgment is modeled separately.

First-batch normative knowledge base

Mainland China profile

The current competition and project development environment maintains the mainland China profile with priority.

Document Type / status Current use
Interim Measures for the Management of Generative AI Services (《生成式人工智能服务管理暂行办法》) a current administrative measure within the departmental rule system, effective from 2023-08-15 subjects, applicable scope, training data, service and security governance requirements for generative AI services
Measures for Labeling AI-Generated Synthetic Content (《人工智能生成合成内容标识办法》) a current administrative measure, effective from 2025-09-01 explicit/implicit labeling of generated synthetic content, dissemination links and related logging requirements
GB 45438-2025 Cybersecurity technology — Labeling method for content generated by artificial intelligence mandatory national standard, current, implemented from 2025-09-01 implements content labeling management requirements as concrete technical methods
GB/T 45654-2025 Cybersecurity technology — Basic security requirements for generative artificial intelligence services recommended national standard, current, implemented from 2025-11-01 corpus security, model security, security measures and assessment requirements
GB/T 45652-2025 Cybersecurity technology — Security specification for generative artificial intelligence pre-training and fine-tuning training data recommended national standard, current, implemented from 2025-11-01 security requirements and evaluation for pre-training and optimization training data processing activities
GB/T 45674-2025 Cybersecurity technology — Security specification for generative artificial intelligence data annotation recommended national standard, current, implemented from 2025-11-01 data annotation process, rules, personnel, verification and process security
National Guidelines for the Construction of a Comprehensive Standardization System for the AI Industry (2024 Edition) (《国家人工智能产业综合标准化体系建设指南（2024版）》) standards system construction guideline understanding the domestic AI standards system, industry layering and subsequent standards directions

TC260-003 Basic Security Requirements for Generative Artificial Intelligence Services (TC260-003《生成式人工智能服务安全基本要求》) is kept as historical predecessor evidence for GB/T 45654-2025, and queries currently return the current national standard with priority.

International profile

The international profile serves cross-jurisdiction queries, control mapping and design reference, and does not override the applicability of the mainland China profile.

Document Status Current use
NIST AI RMF 1.0 voluntary framework; NIST started a revision in 2026 the GOVERN / MAP / MEASURE / MANAGE risk management structure, suited to control and assessment mapping
NIST AI 600-1 Generative AI Profile GenAI-specific profile, released in 2024 with the page updated in 2026 normative reference for GenAI risks and suggested actions
ISO/IEC 42001:2023 published international standard organization-level governance requirements for an AI management system
ISO/IEC 23894:2023 published international standard AI risk management guidance
ISO/IEC 42005:2025 published international standard AI system impact assessment
ISO/IEC 5259 series continuously published over 2024-2026 analytics/ML data quality, management, process and governance, later linked to model/data risk topics
ISO/IEC TR 24028:2020 technical report background and mitigation reference for AI trustworthiness, security, privacy and reliability
EU AI Act / GPAI obligations EU regulation; GPAI obligations apply from 2025-08-02, and some transparency obligations enter the application/enforcement stage from 2026-08-02 EU profile requirements on applicability, documentation, risk mitigation, incident/cybersecurity

ISO standard texts carry licensing and copyright restrictions. SecFusionAgent stores only lawfully obtained full texts, excerpts within the licensed scope, or official public metadata/abstract; access_rights and full_text_available enter the source metadata, and copying paid standards into a local full-text repository through unauthorized sources is prohibited.

Data model

Normative knowledge itself consists of three layers: normative_document → requirement → control. runtime_policy is a downstream execution object compiled from project invariants and confirmed applicable requirements; it is not part of M3 normative-knowledge storage and is never emitted directly by the normative extraction model.

Normative document

normative_document stores the document itself and its status:

document_id
title
issuer
jurisdiction
document_type
binding_status
publication_date
effective_date
expiry_date
status
version / revision
official_url
access_rights
full_text_available
supersedes / superseded_by
amends / amended_by
references

status distinguishes draft, published, effective, superseded, withdrawn and similar states. Old versions of regulations and standards are kept for historical answers and evidence replay.

Requirement

requirement is the minimal normative unit extracted from a concrete clause:

requirement_id
source_document
source_clause
modality = obligation | prohibition | permission | recommendation | guidance
subject
action
object
condition
exception
jurisdiction
applicability
valid_from / valid_to
control_mapping
risk_mapping

The clause text itself is still held by source evidence; the requirement is a structured interpretation result. An LLM can help extract subject/action/condition/exception but cannot generate an obligation detached from the clause.

Control

control describes a security measure that a system or organization can implement, such as access control, human approval, logging, content labeling, dataset validation or incident response. One control can map to multiple requirements and risks at the same time; one requirement may also need multiple controls to be covered.

Control mapping stores explicit relations such as supports / implements / partially-satisfies / mitigates and preserves mapping evidence. Recommended standards and risk frameworks produce most of their value at this layer.

Runtime policy

runtime_policy is an execution rule derived from the project's own security constraints and confirmed applicable requirements. It belongs to the M8 / Execution Control Plane and is produced by an approved policy-compilation step; it is not an M3 extraction result and is not equivalent to a regulation or standard text.

policy_id
derived_from_requirement
scope
trigger
allow / deny / require_review / require_log
enforcement_point
priority
valid_from / valid_to

After normative texts are updated, the corresponding runtime policy needs revalidation; a policy does not modify the original requirement in reverse.

Applicability

Applicability connects normative knowledge with the current investigation context. M3 extracts and stores the jurisdiction, subject, condition, exception, valid time and other applicability conditions explicitly stated by a requirement; its initial contextual status is not_evaluated. M4/M5 evaluate whether it enters a concrete investigation for a particular subject, product/service, jurisdiction, lifecycle stage and time.

applicability_status uses applicable / not_applicable / uncertain / not_evaluated. Deterministic rules can handle geography, dates and explicit subject conditions; legal interpretation, contractual context or incomplete facts keep the status uncertain for analyst/user review. Extracting a clause in M3 never makes the requirement automatically applicable.

For example, the applicable scope of the Interim Measures for the Management of Generative AI Services (《生成式人工智能服务管理暂行办法》) is explicitly tied to "providing generative AI services to the public within the territory of the People's Republic of China"; a case of research and development or application that does not provide the corresponding service to the domestic public is not derived directly from the same clause. The system must complete applicability before providing a requirement to an Agent.

Query and risk/control mapping

A normative query is based mainly on structured requirements, with full-text retrieval used for evidence confirmation. When a user asks "what requirements apply to a given risk", the system associates a control from the risk object and then follows the control mapping to the requirement and source clause; when the question is "what does a given regulation require", it reads requirements directly from the normative document and filters applicability according to the current context.

Risk, control and requirement form three distinct kinds of relation:

Risk --mitigated-by--> Control
Requirement --implemented-by--> Control
Requirement --derived-from--> Normative Document / Clause

This way prompt injection can be associated with controls such as input isolation, least privilege and human approval; the control is then mapped to the corresponding requirement under a given standard or regulation. A risk intelligence update does not automatically change a regulation, and a regulation update does not rewrite risk evidence.

Agent constraints

Complete regulation, standard or policy documents do not enter the system prompt directly. Runtime uses layered policy:

Policy layer Source Runtime behavior
platform invariant SecFusionAgent's own security and permission contract stable hard constraint, entering deterministic policy / system boundary
applicable normative policy confirmed applicable binding requirements loaded by context, compiled into rules such as allow/deny/review/log
control recommendation recommended standards, NIST/ISO frameworks, design guidelines used as Agent suggestions and control selection, not hard blocking by default

External web pages, papers, regulation texts and standard texts all belong to data/evidence and have no instruction authority. Only rules produced through policy compilation can change the execution boundary of an Agent.

This distinction avoids two problems: stuffing all normative full texts into context, which causes instability and conflict; and wrongly elevating recommended guidance into a legal prohibition. A runtime policy can always be traced back to a concrete requirement and source revision.

Update mechanism

Normative knowledge uses low-frequency authoritative watch. M1 monitors only the metadata and status changes of official publication sources, and does not re-run LLM parsing when the content is unchanged.

The first-batch source registry includes:

  • the Chinese government portal and the Cyberspace Administration of China: regulations, measures and formal interpretations;
  • the National Public Service Platform for Standards Information and TC260: national standard status, standards plans and technical documents;
  • NIST / AIRC: AI RMF, GenAI Profile, Playbook and version updates;
  • ISO/IEC JTC 1/SC 42 / ISO official catalogue: published/revision/withdrawn status of AI standards;
  • EUR-Lex and the European Commission AI Office: EU AI Act text, application dates and official guidelines.

Monitoring events include published, effective, amended, superseded, withdrawn, draft -> final and official interpretation/guideline updates. After an event occurs, the system stores the new revision, diffs clauses, re-extracts affected requirements, invalidates/revalidates control mappings, marks contextual applicability derived from the old requirement revision for re-evaluation, and marks downstream runtime policies for recompilation/reapproval.

Old revisions and old requirements are not deleted, to support historical queries, benchmark replay and policy audit.

M1-M8 ownership

Module Normative knowledge responsibility
M1 monitor official sources, versions and status changes
M2 store document/clause evidence, revisions, official identifiers and identity
M3 extract requirements and controls, build risk/control/requirement mappings
M4 expose currently applicable requirements and unresolved applicability to the investigation context
M5 investigate applicability, official interpretations and related controls when needed
M6 answer standards/policy questions and cite concrete clauses and versions
M7 test requirement extraction, applicability, mapping and policy regression
M8 enforce already-approved runtime policy and record enforcement/audit events

M6 can interpret and query normative knowledge; only M8 has runtime enforcement. Research papers, blogs and external content cannot write directly into M8 policy.

Fixed items for the requirements phase

SecFusionAgent manages technical standards, policies/regulations and governance frameworks as independent normative knowledge. Official texts are evidence, requirements are normalized objects, and controls connect risks with requirements; these form the evidence-backed NormativeDocument → Requirement → Control chain. RuntimePolicy enters the execution layer only after applicability is confirmed and project policy compilation/approval succeeds, preserving one-way provenance from normative evidence to execution constraints.

The first batch of the mainland China profile includes the current administrative measures for generative AI, the measures for content labeling, GB 45438-2025, GB/T 45654-2025, GB/T 45652-2025, GB/T 45674-2025 and the national AI standardization system construction guidelines; the first batch of the international profile includes NIST AI RMF/GAI Profile, ISO/IEC 42001, 23894, 42005, the 5259 series, TR 24028 and the EU AI Act/GPAI obligations.

The normative base uses low-frequency incremental monitoring of official sources, maintaining jurisdiction, binding status, effective/superseded status and applicability. Standards with restricted full-text licensing store only lawfully accessible content and official metadata. Complete documents do not serve directly as Agent system instructions; runtime consumes only constraints that have passed source tracing, applicability judgment and policy compilation.

Official sources