Control Evidence

Control evidence links a control id in your catalog to one or more evidence objects on a case or RCSA scope. Examiners should follow control_id to a hash, not to a paragraph the model wrote.

Catalog

GET /v1/risk/controls
Authorization: Bearer eridian_sk_...
X-Eridian-Project: prj_risk_001

Upload custom catalogs as JSONL (control_id, title, statement, owner_desk). Built-ins are empty on purpose. Your bank's control library is yours.

Map

POST /v1/risk/controls/map
Authorization: Bearer eridian_sk_...

{
  "project_id": "prj_risk_001",
  "case_id": "cse_0912",
  "control_id": "CTL-FC-14",
  "evidence_ids": ["evd_01", "evd_02"],
  "period": { "start": "2026-08-01", "end": "2026-08-31" },
  "model": "gpt",
  "note": "TM rule coverage for after-hours bursts."
}

If model is set, GPT or Gemini drafts operating_effectiveness commentary that must cite those evidence ids. If you omit model, the map is a structured link only (no inference).

{
  "id": "cem_14",
  "object": "eridian.risk.control_map",
  "control_id": "CTL-FC-14",
  "coverage": "partial",
  "commentary": "Evidence shows daytime TM coverage. After-hours burst not in rule pack.",
  "eridian": { "route": "gpt" }
}

Effectiveness values

The model cannot emit full without at least one evidence id. The API rejects it.

Pack for examiners

Control maps are included when you create an Evidence Export with include: ["risk_control_maps"] and a case or project window. Prefer that over pasting commentary into email.

Gaps as work items

POST /v1/risk/controls/map/cem_14/gap

{
  "title": "Add after-hours TM rule",
  "owner_id": "usr_tm_eng",
  "due": "2026-10-01"
}

Gaps are not closed by the model. Closing is risk:write plus optional dual control.

See Risk Assessments which consume the same control_id space.