Submit Attestation
submit_attestationRecord a responsible party's affirmation that an external assumption holds, mitigating linked compliance objectives until expiry. Non-applicability assumptions require CI verification.
Instructions
Record that a responsible party affirmed an assumption holds.
Only for external assumptions. Non-applicability assumptions require CI verification (submit assertions + run mipiti-verify) — manual attestation is rejected for them.
An assumption with a current attestation can mitigate linked COs. When the attestation expires, those COs become at-risk until re-attested or covered by controls.
An attestation is a responsible party's claim, never a proof over every
site: it can cover an existential clause of a control (its tier reads
claimed) and never a for-all one, where only a sound witness
counts. An attestation the platform mints from CI results is no
stronger than the weakest assertion behind it. The exits for a
universal objective that cannot be proven are a risk acceptance or a
not-applicable disposition.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| model_id | Yes | ID of the threat model. | |
| statement | No | What was attested. | |
| expires_at | No | ISO 8601 expiry date (e.g., "2026-06-30T00:00:00Z"). | |
| attested_by | No | Who is attesting (name, role, organization). | |
| evidence_url | No | Optional link to supporting documentation. | |
| assumption_id | Yes | ID of the assumption (e.g., "AS1"). | |
| server_version | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||