suissAI

Posted on Feb 26

FullAgenticStack WhatsApp-first: RFC-WF-0016

#agents #architecture #documentation #security

RFC-WF-0016

Reference Compliance Matrix & Control IDs (RCMC)

Status: Draft Standard
Version: 1.0.0
Date: 20 Nov 2025
Category: Standards Track
Author: FullAgenticStack Initiative
Dependencies: RFC-WF-0001 (WFCS), RFC-WF-0003 (CCP), RFC-WF-0004 (ACSM), RFC-WF-0005 (CRCD), RFC-WF-0006 (EAS), RFC-WF-0007 (OoC), RFC-WF-0008 (RCP), RFC-WF-0009 (TMSI), RFC-WF-0010 (IDS), RFC-WF-0011 (CATS), RFC-WF-0015 (PPGP)
License: Open Specification (Public, Royalty-Free)

Abstract

This document specifies the Reference Compliance Matrix & Control IDs (RCMC) for WhatsApp-first systems. RCMC defines a canonical catalog of control identifiers and a mapping from controls to RFC requirements, enabling consistent certification reporting, audit tooling interoperability, and unambiguous compliance communication (e.g., “WFS-C-013 failed”). RCMC serves as the normative bridge between the specification set and the Compliance Audit Toolkit (CATS).

Index Terms— compliance controls, control IDs, certification, audit interoperability, requirement mapping, WhatsApp-first.

I. Introduction

RFCs define requirements, but audits need stable identifiers to track them over time. Without control IDs, compliance reporting becomes ambiguous (“you failed the idempotency part”). RCMC provides a standard naming and categorization system for controls, plus a required mapping from each control to the RFC sections it enforces.

RCMC is essential for:

consistent certification levels
diffing compliance across versions
automated remediation guidance
ecosystem-wide shared terminology

II. Scope

RCMC specifies:

Control ID format and naming rules
Mandatory control metadata fields
Control categories and minimum catalog
Mapping from controls to RFC requirements
Versioning rules for controls
Report interoperability requirements with CATS outputs

RCMC does not define pricing or certification branding; it defines the technical control catalog.

III. Normative Language

MUST, MUST NOT, SHOULD, SHOULD NOT, MAY are normative.

IV. Definitions

Control: A testable compliance requirement with pass/fail criteria.
Control ID: A stable identifier for a control (e.g., WFS-C-013).
Matrix: A mapping from controls to RFC clauses and evidence expectations.

V. Control ID Format (Normative)

Controls MUST use the format:

WFS-<Domain>-<NNN>

Where:

WFS is the standard prefix
<Domain> is one of:
- C (Core/Foundation)
- X (Conversion Web→WhatsApp)
- P (Command Protocol & Safety)
- S (Security & Threat Invariants)
- I (Idempotency & Delivery Semantics)
- E (Evidence)
- O (Observability over Conversation)
- R (Recovery & Compensation)
- G (Governance & Policy Packs)
- A (Agent Integration)
- D (Discovery & Interop)
<NNN> is a zero-padded numeric identifier (000–999)

Example: WFS-I-013 for idempotency duplicate-effect prevention.

VI. Control Metadata (Required Fields)

Each control entry in the matrix MUST include:

control_id
title
category (Domain)
severity (critical|high|medium|low)
method (static|runtime|hybrid)
requirement (normative summary)
references (list of RFC clause pointers)
evidence_expected (what artifacts prove pass/fail)
pass_criteria
fail_examples (at least one)
remediation (short guidance)

VII. Reference Compliance Matrix (Canonical File)

A. Distribution

Implementations and toolkits MUST be able to reference a canonical matrix file:

/.well-known/wfs/rcmc.json (recommended; may be advertised via WKD)

B. Minimal Structure

The matrix MUST be machine-readable JSON (YAML optional). Minimal shape:

{
  "matrix_version": "1.0.0",
  "generated_at": "2026-02-22T00:00:00Z",
  "controls": [ ... ]
}

VIII. Minimum Control Catalog (v1.0.0)

Below is the minimum catalog set. (Entries shown condensed; full matrix file enumerates pass/fail details.)

A. Core/Foundation (WFS-C-xxx)

WFS-C-001 Full Capability Parity (incl. admin/recovery) — critical
WFS-C-002 Multimodal Input Parity (text+audio STT) — critical
WFS-C-003 No Dashboard-Only Mutations — critical

B. Conversion (WFS-X-xxx)

WFS-X-001 Buttons → numbered actions or explicit commands — high
WFS-X-002 Forms → conversational sequential flows — high

C. Command Safety (WFS-P-xxx)

WFS-P-001 Canonical Envelope Before Execution — critical
WFS-P-002 Confirmation Required for Mutations — critical
WFS-P-003 Strengthened Confirmation for Destructive — high

D. Security (WFS-S-xxx)

WFS-S-001 Scope Gating for Mutations — critical
WFS-S-002 Step-up for Admin High-Impact — critical
WFS-S-003 Ambiguity Rejection for Targets/Intents — high
WFS-S-004 Evidence Completeness for Security Decisions — high

E. Idempotency (WFS-I-xxx)

WFS-I-001 Idempotency Key Derivation Determinism — critical
WFS-I-002 Atomic Dedup Check-and-Set — critical
WFS-I-003 Outcome Replay for Duplicates — high

F. Evidence (WFS-E-xxx)

WFS-E-001 EAS Schema Conformance — critical
WFS-E-002 Append-only Evidence (No Mutations) — high
WFS-E-003 Trace Binding to Conversation/Message IDs — high

G. Observability (WFS-O-xxx)

WFS-O-001 Conversational Status/Health Available — high
WFS-O-002 Error Transparency (why failed/denied) — high
WFS-O-003 Evidence Drill-down via Conversation — medium
WFS-O-004 Redaction & Least Privilege in OoC — critical

H. Recovery (WFS-R-xxx)

WFS-R-001 Recovery Options Discoverable (RCP.OPTIONS) — high
WFS-R-002 Governed Retry (RCP.RETRY) — high
WFS-R-003 Governed Compensation where applicable — critical

I. Governance (WFS-G-xxx)

WFS-G-001 Policy Pack Versioning and Binding — high
WFS-G-002 Fail-Closed for Missing High-Impact Policies — critical
WFS-G-003 Policy Enforcement Proof in Evidence — high

J. Agent Integration (WFS-A-xxx)

WFS-A-001 Proposal/Execution Separation — critical
WFS-A-002 HITL for S2/S3/R3 Actions — high
WFS-A-003 Agent Actions Evidence Linkage — high

K. Discovery (WFS-D-xxx)

WFS-D-001 Well-known Discovery Document Present — medium
WFS-D-002 Registry/Evidence Endpoints Discoverable — medium

IX. Versioning Rules for Controls

The matrix MUST be versioned with SemVer.
Adding controls is MINOR.
Changing pass/fail semantics is MAJOR.
Deprecating controls MUST include deprecated_since and optional replacements.

X. Reporting Interoperability with CATS

CATS audit outputs MUST reference controls using control_id. Reports MUST include:

pass/fail per control
evidence references per control
remediation guidance per failed control
matrix version used

XI. Relationship to Other RFCs

RCMC binds requirements from WFCS/CCP/ACSM/IDS/EAS/OoC/RCP and governance RFCs to stable controls consumable by CATS and certification tooling.

XII. Security Considerations

Publishing a full control matrix publicly can help attackers understand your defenses. Systems MAY publish redacted versions publicly, and keep full details privileged. Tooling MUST support both.

XIII. Conclusion

RCMC gives WhatsApp-first a certifiable backbone: stable control IDs and a normative mapping to RFC requirements. This transforms “compliance” from opinion into repeatable audits and comparable reports, enabling ecosystem tooling and reliable certification programs.

References

[1] RFC-WF-0001, WhatsApp-First Compliance Core (WFCS).
[2] RFC-WF-0003, Conversational Command Protocol (CCP).
[3] RFC-WF-0004, Administrative Command Security Model (ACSM).
[4] RFC-WF-0005, Command Registry & Capability Declaration (CRCD).
[5] RFC-WF-0006, Evidence Artifact Schema (EAS).
[6] RFC-WF-0007, Observability over Conversation (OoC).
[7] RFC-WF-0008, Recovery & Compensation Protocol (RCP).
[8] RFC-WF-0009, Threat Model & Security Invariants (TMSI).
[9] RFC-WF-0010, Idempotency & Delivery Semantics (IDS).
[10] RFC-WF-0011, Compliance Audit Toolkit Spec (CATS).
[11] RFC-WF-0015, Policy Packs & Governance Profiles (PPGP).

Concepts and Technologies

Control catalogs, stable control IDs, compliance matrices, SemVer for requirements, audit interoperability, evidence-backed certification reporting, redacted public compliance, remediation mapping.

DEV Community