explore-exposure

Explore Exposure (by product or component)

Given a product/technology or a component, show its CoSAI Risk Map exposure — the controls that apply to it and the risks those controls address — and, when it's a curated two-part lexicon row, the exposure of the components it protects too (the exposure via candidates). Read-only.

Key structural fact: risks do not reference components directly. Exposure flows component → the controls that apply to it (a control's components field) → the risks those controls address (the control's risks field). Make that indirection explicit to the reader.

Audience and voice

Security architects/engineers. Explain framework terms (component, how controls/risks connect); link every entity id. When you map a product to a component, say why.

How to answer

1. Resolve to component(s).

   • If the input is a component (id or name), use it directly.
   • If it's a product/technology (AWS Nitro, LangChain, Pinecone, an MCP server…), map it to the component(s) it implements or protects using references/product-component-lexicon.md (curated). (Explain: components are the framework's architectural building blocks — the loci where risks and controls attach.)
   • Hybrid — if the product isn't in the lexicon: reason about the role it plays, optionally confirm with a live web lookup, and map it to the nearest component(s) — but flag it as an inferred mapping, not a curated one. Do not present inference as corpus fact.

2. State the component's own applying controls — no walk. "Applying controls" means controls in risk-map/yaml/controls.yaml whose components list contains the component's id. Grep for it. This is a measured statement about the current corpus: some components have none today. If there are none, say so plainly — never invent one, and never borrow another component's controls to fill the gap. A component's edges carry no exposure semantics, whatever the edge kind: ADR-018 D3 defines edges only as a structured-reference field the schema/validator check for membership and bidirectional consistency, not as an "applies to" relation; and even where an edge is a containment relationship rather than data flow — ADR-030 D9 types componentIsolationRuntime → componentToolHosting/componentRuntimeHosting as containment, not data flow — the contained workload's controls are still not the containing component's own. You may name a neighbour, by any edge kind, as a place to explore next, without listing its controls.