assign_to_components
Replace an asset's or control's component scope to link security controls to the repos that implement them or bind assets to code ownership.
Instructions
Replace an asset's or a control's component scope. Mutating.
Components are the canonical bridge between security architecture
(trust boundaries) and code organization (repos). target_type
selects what is being scoped:
"control"— replace a control's component scope. A control scoped to one or more components is visible to coding agents working in those repos (matched via Component.repo_url + Component.path); an unscoped control is visible everywhere. Use when wiring a previously unscoped control to the component(s) that implement it, adding a second component to a cross-cutting control (e.g. "all microservices enforce JWT validation"), or correcting a wrong assignment.target_idis the control ID (e.g. "CTRL-03")."asset"— replace an asset's component scope. Linking assets to components flows boundary context into reachability derivation without giving Asset its owntrust_boundary_ids. Multi-component is the right shape for a multi-instance asset (e.g., a session token on client + cache + DB — each component handles a distinct instance).target_idis the asset ID (e.g. "A1").
Both variants are mechanical / non-AI-gated and validate only that every referenced component exists on the model.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| model_id | Yes | ID of the threat model. | |
| target_id | Yes | ID of the asset or control to scope (must match ``target_type``). | |
| target_type | Yes | Either "asset" or "control" — which entity to scope. | |
| change_reason | Yes | Why this scope is appropriate (min 10 chars). Captured in the version history. | |
| component_ids | Yes | Comma-separated component IDs (e.g., "CMP1,CMP2"). Empty string = unscoped (a control becomes visible to every coding agent; an asset loses its explicit code-ownership binding). Every supplied ID must exist on the model. | |
| server_version | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||