set_control_assumption_groups
Replace the assumption group structure for a control: groups are OR'd, with all assumptions in a group AND'd. Pass an empty object to clear all groups and revert to not externally handled.
Instructions
Declaratively set the assumption group structure for a control.
Replaces all assumption group assignments for this control. Each group is a set of assumption IDs that together externally handle the control; any one group being fully active+attested is sufficient.
Within a group: AND — all referenced assumptions must be active and attested for the group to count as complete
Across groups: OR — any one complete group marks the control as externally handled for mitigation purposes
To clear all assumption groups (revert to "not externally handled"),
pass an empty JSON object: {}.
AI relevance gate (per group, no override): Each non-empty proposed group is evaluated independently. The behavior depends on how many groups pass:
All groups accepted → 200 success, structure persisted as submitted.
Some groups accepted (partial): the accepted groups ARE persisted (runtime OR-semantics activate immediately), the rejected groups are NOT saved, the call raises with HTTP 422 detailing both persisted_groups and rejected_groups (with per-group reasoning). Resubmit only the rejected groups with assumptions that cover the control, or sharpen those assumptions' descriptions.
All groups rejected: existing groups on this control are re-evaluated through the same gate. Relevant existing groups are preserved; irrelevant existing groups are dropped (assumptions themselves remain in the model — only this control's linkage is removed). The call raises with HTTP 422 detailing what was persisted, what was rejected, and what existing was dropped.
Empty submission ({}): clears all groups, no evaluation.
There is no force-override. To get a group accepted, choose assumptions whose descriptions actually cover the control or refine an assumption's description so coverage is explicit.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| groups | Yes | JSON object mapping group numbers to assumption ID lists. Example: '{"1": ["AS1", "AS2"], "2": ["AS3"]}' Empty object `{}` clears all groups. | |
| model_id | Yes | ID of the threat model. | |
| control_id | Yes | ID of the control (e.g., "CTRL-03"). | |
| justification | No | Why this group structure is appropriate (min 10 chars when groups is non-empty; optional when clearing). | |
| server_version | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||