/**
 * ISO 42001 AI Management System Evidence Template
 *
 * ISO/IEC 42001:2023 -- Information technology. AI management system (AIMS).
 * Requirements for organisations providing or using AI systems to manage AI
 * responsibly and ethically. Aligns with the PDCA (Plan-Do-Check-Act) cycle
 * common to all ISO management-system standards.
 *
 * This template generates evidence documentation for the major clauses of
 * ISO 42001 as observed through the AI governance audit chain.
 *
 * Regulatory references:
 *   ISO/IEC 42001:2023, Clause 4 -- Context of the organisation
 *   ISO/IEC 42001:2023, Clause 5 -- Leadership
 *   ISO/IEC 42001:2023, Clause 6 -- Planning
 *   ISO/IEC 42001:2023, Clause 7 -- Support
 *   ISO/IEC 42001:2023, Clause 8 -- Operation
 *   ISO/IEC 42001:2023, Clause 9 -- Performance evaluation
 *   ISO/IEC 42001:2023, Clause 10 -- Improvement
 *   ISO/IEC 42001:2023, Annex A -- Reference control objectives (AI-specific)
 *   ISO/IEC TR 24028 -- Trustworthiness in AI
 *   ISO/IEC 42006:2024 -- Requirements for certification bodies for AI
 *
 * Required audit event types:
 *   agent:registered       -- AI system inventory (Clause 8 operation)
 *   policy:snapshot        -- AIMS policy documentation (Clause 5 leadership)
 *   governance:verdict     -- Control effectiveness evidence (Clause 9)
 *   retention:job-completed -- Records management (Clause 7.5 documented information)
 *
 * Spec: P4-AIR-02 item 8
 *
 * @connexum/ai-governance
 */
const CITATION_INSTRUCTION = `
MANDATORY CITATION RULES: Every factual claim MUST immediately reference the
audit-chain event ID in square brackets, e.g. [EVT-abc123]. You may ONLY cite
event IDs from the AVAILABLE EVENTS list. If evidence is absent for an ISO
42001 clause requirement, write "Evidence not available in audit chain; the
organisation must supplement with documented information per ISO 42001 Clause
7.5." Never invent event IDs.
`.trim();
export const ISO_42001_AMS_TEMPLATE = {
    templateId: 'tpl-iso-42001-ams-v1',
    name: 'ISO 42001 AI Management System Evidence Report',
    framework: 'iso-42001',
    requiredAuditEventTypes: [
        'agent:registered',
        'policy:snapshot',
        'governance:verdict',
        'retention:job-completed',
    ],
    artefactFormat: 'both',
    legalReviewRequired: false,
    sections: [
        {
            id: 'iso42001-clause4-context',
            title: 'Clause 4: Context of the Organisation',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Clause 4 (Context of the Organisation) section for an ISO
42001:2023 AI Management System evidence report.

ISO 42001 Clause 4 requires the organisation to:
  4.1 Understand the organisation and its context (internal/external factors)
  4.2 Understand the needs of interested parties
  4.3 Determine the scope of the AI management system
  4.4 AI management system
  4.5 AI policy (reference to leadership commitment)

Using ONLY the audit-chain events provided, describe:
1. The AI systems in scope: agent:registered events during the review period
   establishing which AI agents are within the AIMS boundary.
2. The governance policy framework: policy:snapshot events establishing that
   a documented AI policy is in place and was current during the period.
3. Evidence that the scope includes all relevant AI agent types (different
   registration categories observed in the chain).
4. External context: LLM provider diversity as evidenced by governance verdicts
   from different provider adapters.

${CITATION_INSTRUCTION}

Write 3-5 formal paragraphs aligned with ISO 42001 clause language.
`.trim(),
        },
        {
            id: 'iso42001-clause6-planning',
            title: 'Clause 6: Planning -- Risks and AI Impact Assessment',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Clause 6 (Planning) section for an ISO 42001:2023 AI
Management System evidence report.

ISO 42001 Clause 6 requires:
  6.1 Actions to address risks and opportunities
  6.1.2 AI risk assessment -- identification of AI-specific risks
  6.1.3 AI risk treatment
  6.2 AI objectives and planning to achieve them
  6.3 Planning of changes

For AI governance, risk planning is evidenced through:
  - Compliance pack bindings (which risk domains are actively governed)
  - Policy configurations (how risks are addressed in the governance policy)
  - Change management: how AI system changes are planned and approved

Using ONLY the audit-chain events provided, describe:
1. AI risk events identified during the period (anomalies, denials, violations)
   demonstrating that risk identification is ongoing and effective.
2. Risk treatment effectiveness: the ratio of denied vs. allowed actions as an
   indicator of policy-based risk treatment.
3. Policy changes during the period and their planning/approval evidence.
4. Any unmitigated risks (recurring violation patterns without remediation events).

${CITATION_INSTRUCTION}

Write 3-5 formal paragraphs.
`.trim(),
        },
        {
            id: 'iso42001-clause8-operation',
            title: 'Clause 8: Operation -- AI System Lifecycle Management',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Clause 8 (Operation) section for an ISO 42001:2023 AI
Management System evidence report.

ISO 42001 Clause 8 requires:
  8.2 AI risk assessment (operational application)
  8.3 AI risk treatment (operational controls)
  8.4 Documentation of AI systems (system register)
  8.5 Human oversight of AI systems
  8.6 Responsibilities related to AI systems

Annex A (control objectives) includes:
  A.3.2 -- AI system lifecycle documentation
  A.5.1 -- Policies for AI development and use
  A.6.1 -- Responsible AI use policies
  A.8.1 -- AI system impact assessment

Using ONLY the audit-chain events provided, describe:
1. AI system register: agent:registered events constituting the operational AI
   system inventory maintained by the governance platform.
2. Human oversight evidence: approval events demonstrating Clause 8.5 controls
   were exercised, including escalation events.
3. Operational risk controls: governance verdict events showing active enforcement.
4. Any AI system lifecycle events (decommissions, version changes) evidenced in
   the chain.

${CITATION_INSTRUCTION}

Write 4-6 formal paragraphs.
`.trim(),
        },
        {
            id: 'iso42001-clause9-evaluation',
            title: 'Clause 9: Performance Evaluation -- Monitoring and Audit',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Clause 9 (Performance Evaluation) section for an ISO
42001:2023 AI Management System evidence report.

ISO 42001 Clause 9 requires:
  9.1 Monitoring, measurement, analysis, and evaluation
  9.2 Internal audit of the AI management system
  9.3 Management review

Clause 9.1 requires the organisation to determine:
  (a) What needs to be monitored and measured
  (b) Methods for monitoring and measurement
  (c) When monitoring is performed and results analysed
  (d) Who performs the monitoring

Using ONLY the audit-chain events provided, describe:
1. Monitoring coverage: volume and types of governance events captured during
   the period demonstrating continuous monitoring.
2. Key metrics: total verdicts, deny rate, approval rate, escalation rate,
   anomaly detection rate -- calculated from chain event evidence.
3. Evidence of management review: high-level approval or sign-off events
   suggesting leadership engagement with AI governance data.
4. Audit trail completeness: retention:job-completed events confirming that
   audit records were managed and retained.
5. Any monitoring gaps: time periods with no governance events (potential
   monitoring failures or agent inactivity).

${CITATION_INSTRUCTION}

Write 4-6 formal paragraphs.
`.trim(),
        },
        {
            id: 'iso42001-clause10-improvement',
            title: 'Clause 10: Improvement -- Corrective Actions',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Clause 10 (Improvement) section for an ISO 42001:2023 AI
Management System evidence report.

ISO 42001 Clause 10 requires:
  10.1 Continual improvement of the AIMS
  10.2 Nonconformity and corrective action (identify and address root causes)

Clause 10.2 requires the organisation to:
  (a) React to nonconformities and take action to control and correct
  (b) Evaluate the need for actions to eliminate root causes
  (c) Implement needed actions
  (d) Review effectiveness of corrective actions
  (e) Update risks and opportunities
  (f) Make changes to the AIMS if necessary

Using ONLY the audit-chain events provided, describe:
1. Nonconformities identified during the period: policy violations, anomalies,
   and governance denials that indicate AIMS gaps.
2. Corrective actions: policy changes (policy:snapshot events) made in response
   to observed nonconformities.
3. Evidence of corrective action effectiveness: whether violation rates decreased
   after policy updates.
4. Continual improvement indicators: new capabilities registered, policy
   refinements, approval workflow improvements evidenced in the chain.

${CITATION_INSTRUCTION}

Write 3-5 formal paragraphs.
`.trim(),
        },
        {
            id: 'iso42001-annex-a-controls',
            title: 'Annex A Reference Controls Evidence',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Annex A Reference Controls section for an ISO 42001:2023
AI Management System evidence report.

ISO 42001 Annex A defines control objectives across seven domains:
  A.3 -- Policies
  A.4 -- Internal organisation
  A.5 -- Resources
  A.6 -- Assessing impacts of AI systems
  A.7 -- AI system lifecycle
  A.8 -- Data for AI systems
  A.9 -- Information for interested parties about AI systems
  A.10 -- Responsible use of AI

For each domain, provide evidence from the audit chain:
1. A.3 (Policies): policy:snapshot events confirming documented, version-controlled AI policies.
2. A.6 (Impact assessment): governance verdict patterns demonstrating ongoing impact monitoring.
3. A.7 (Lifecycle): agent:registered events and decommission events covering the full AI lifecycle.
4. A.9 (Transparency): evidence that governance events are recorded for disclosure to stakeholders.
5. A.10 (Responsible use): human approval events demonstrating responsible oversight controls.

For Annex A controls without audit-chain evidence, note that the organisation
must maintain documentary evidence outside the AI governance platform.

${CITATION_INSTRUCTION}

Write 4-6 formal paragraphs.
`.trim(),
        },
    ],
};
//# sourceMappingURL=iso-42001-ams.js.map