# Policy Applicability Evaluation

How control applicability is derived from recorded inputs and pinned to a policy_bundle_version.

- Control applicability is derived from an action's recorded inputs, never from how familiar or unfamiliar a framework name is to the evaluator.
- A policy-to-control mapping produced by this agent is a candidate for an accountable owner to confirm, not a final determination.
- Recording the policy_bundle_version on every evaluation pins exactly which version of the controls was in force for that action.

## Sources

- https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
- https://www.nist.gov/cyberframework
- https://eur-lex.europa.eu/eli/reg/2024/1689/oj