{
  "$defs": {
    "AssetCriticality": {
      "description": "Classification level (often parallel to Confidentiality but with\na separate, more granular axis for risk modelling).",
      "oneOf": [
        {
          "const": "low",
          "description": "Low value, easily replaceable.",
          "type": "string"
        },
        {
          "const": "material",
          "description": "Material — disruption is noticeable.",
          "type": "string"
        },
        {
          "const": "high",
          "description": "High — disruption blocks business.",
          "type": "string"
        },
        {
          "const": "mission_critical",
          "description": "Mission-critical — total dependency.",
          "type": "string"
        }
      ]
    },
    "AssetLifecycle": {
      "description": "Asset lifecycle.",
      "oneOf": [
        {
          "const": "provisioning",
          "description": "Procured but not yet active.",
          "type": "string"
        },
        {
          "const": "active",
          "description": "In service.",
          "type": "string"
        },
        {
          "const": "decommissioning",
          "description": "Decommissioning underway.",
          "type": "string"
        },
        {
          "const": "retired",
          "description": "Retired (out of service, awaiting disposal).",
          "type": "string"
        },
        {
          "const": "disposed",
          "description": "Disposed (fully gone).",
          "type": "string"
        }
      ]
    },
    "Confidentiality": {
      "description": "Cross-cutting confidentiality classification used across privacy,\nsecurity, knowledge, IR pillars. Default rendering rule: `corpospec-report`\nexcludes `Restricted | BoardOnly | InvestorOnly` records from public output\nunless an explicit audience parameter overrides. See BDR 0076 §1.",
      "oneOf": [
        {
          "const": "public",
          "description": "Safe to publish anywhere.",
          "type": "string"
        },
        {
          "const": "customer",
          "description": "Visible to customers under standard ToS.",
          "type": "string"
        },
        {
          "const": "internal",
          "description": "Employees and contractors only.",
          "type": "string"
        },
        {
          "const": "restricted",
          "description": "Need-to-know subset of internal.",
          "type": "string"
        },
        {
          "const": "board_only",
          "description": "Board members and direct staff.",
          "type": "string"
        },
        {
          "const": "investor_only",
          "description": "Existing investors + prospective with NDA.",
          "type": "string"
        }
      ]
    },
    "DisposalMethod": {
      "description": "Disposal method (ISO 27001 A.7.14 secure disposal).",
      "oneOf": [
        {
          "const": "crypto_erase",
          "description": "Cryptographic erase (DEK / KEK rotation).",
          "type": "string"
        },
        {
          "const": "physical_destruction",
          "description": "Physical destruction (shred / pulverise).",
          "type": "string"
        },
        {
          "const": "secure_wipe",
          "description": "Secure wipe / DoD 5220.22-M.",
          "type": "string"
        },
        {
          "const": "return_to_vendor",
          "description": "Return to vendor.",
          "type": "string"
        },
        {
          "const": "recycle",
          "description": "Standard recycle.",
          "type": "string"
        },
        {
          "const": "none",
          "description": "Not applicable.",
          "type": "string"
        }
      ]
    },
    "InventoryAssetKind": {
      "description": "Asset kind.",
      "oneOf": [
        {
          "const": "data",
          "description": "Data set (database, file repository).",
          "type": "string"
        },
        {
          "const": "system",
          "description": "System / service / application.",
          "type": "string"
        },
        {
          "const": "endpoint",
          "description": "Endpoint (laptop, phone, IoT).",
          "type": "string"
        },
        {
          "const": "network_device",
          "description": "Network device (router, firewall).",
          "type": "string"
        },
        {
          "const": "cloud_resource",
          "description": "Cloud resource (S3, RDS, VPC).",
          "type": "string"
        },
        {
          "const": "container",
          "description": "Container / image / cluster.",
          "type": "string"
        },
        {
          "const": "facility",
          "description": "Physical facility / office.",
          "type": "string"
        },
        {
          "const": "document",
          "description": "Document / specification.",
          "type": "string"
        },
        {
          "const": "process",
          "description": "Business process.",
          "type": "string"
        },
        {
          "const": "intellectual_property",
          "description": "Intellectual property (PathRef to intellectual_property.rs).",
          "type": "string"
        },
        {
          "const": "vendor",
          "description": "Supplier-managed asset (third-party SaaS).",
          "type": "string"
        },
        {
          "const": "person",
          "description": "People / role-based asset (key person).",
          "type": "string"
        },
        {
          "const": "code_repository",
          "description": "Code repository / artefact.",
          "type": "string"
        },
        {
          "const": "api_surface",
          "description": "API surface (PathRef to api_endpoint.rs).",
          "type": "string"
        },
        {
          "const": "model",
          "description": "AI/ML model.",
          "type": "string"
        },
        {
          "const": "credential",
          "description": "Credential / secret (key, certificate).",
          "type": "string"
        }
      ]
    },
    "IsoDate": {
      "description": "ISO 8601 date (YYYY-MM-DD).",
      "format": "date",
      "type": "string"
    },
    "PathRef": {
      "description": "Path-based cross-reference relative to .corpospec/ root.\nPattern: `^[a-z0-9_-]+(/[a-z0-9_.-]+)+$`",
      "pattern": "^[a-z0-9_-]+(/[a-z0-9_.-]+)+$",
      "type": "string"
    },
    "PiiClass": {
      "description": "Personal-data classification on every record carrying personal data, per\nBDR 0070 / BDR 0069 / BDR 0078. Used by `corpospec-report` to gate\nrendering and by the privacy pillar's RoPA records to determine\nsafeguards.",
      "oneOf": [
        {
          "const": "none",
          "description": "No personal data.",
          "type": "string"
        },
        {
          "const": "public_personal",
          "description": "Public personal data (already disclosed by the subject, e.g. CEO name).",
          "type": "string"
        },
        {
          "const": "internal",
          "description": "Internal-only personal data (employee directory).",
          "type": "string"
        },
        {
          "const": "personal",
          "description": "Personal data per GDPR Art. 4(1).",
          "type": "string"
        },
        {
          "const": "special_category",
          "description": "Special-category data per GDPR Art. 9 (health, biometric, genetic,\nreligion, ethnicity, sex life, political opinion, trade union).",
          "type": "string"
        },
        {
          "const": "criminal_data",
          "description": "Criminal data per GDPR Art. 10.",
          "type": "string"
        },
        {
          "const": "sensitive",
          "description": "CCPA / CPRA \"sensitive personal information\".",
          "type": "string"
        }
      ]
    }
  },
  "$id": "https://corpospec.com/schemas/v0.16.0/asset-inventory.schema.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "additionalProperties": false,
  "description": "Information-asset record.",
  "properties": {
    "canonical_ref": {
      "anyOf": [
        {
          "$ref": "#/$defs/PathRef"
        },
        {
          "type": "null"
        }
      ],
      "description": "PathRef to the canonical record in another pillar (where\napplicable; e.g. vendor.rs entry for a vendor asset)."
    },
    "confidentiality": {
      "$ref": "#/$defs/Confidentiality"
    },
    "criticality": {
      "$ref": "#/$defs/AssetCriticality"
    },
    "custodian": {
      "$ref": "#/$defs/PathRef",
      "description": "Custodian — operates day-to-day."
    },
    "description": {
      "type": "string"
    },
    "disposal_method": {
      "$ref": "#/$defs/DisposalMethod"
    },
    "entity": {
      "$ref": "#/$defs/PathRef"
    },
    "id": {
      "$ref": "#/$defs/PathRef"
    },
    "kind": {
      "$ref": "#/$defs/InventoryAssetKind"
    },
    "last_reviewed": {
      "$ref": "#/$defs/IsoDate"
    },
    "lifecycle": {
      "$ref": "#/$defs/AssetLifecycle"
    },
    "location": {
      "description": "Where the asset lives (physical address / cloud region /\nsystem path).",
      "type": "string"
    },
    "name": {
      "type": "string"
    },
    "next_review_due": {
      "$ref": "#/$defs/IsoDate"
    },
    "owner": {
      "$ref": "#/$defs/PathRef",
      "description": "Owner — has accountability."
    },
    "pii_class": {
      "$ref": "#/$defs/PiiClass"
    },
    "provisioned_on": {
      "$ref": "#/$defs/IsoDate"
    },
    "regulatory_implications": {
      "description": "Regulatory implications free-form (e.g. \"GDPR Art. 9 special\ncategory — DPIA required\").",
      "type": [
        "string",
        "null"
      ]
    },
    "retention_policy": {
      "description": "Retention narrative.",
      "type": "string"
    },
    "retired_on": {
      "anyOf": [
        {
          "$ref": "#/$defs/IsoDate"
        },
        {
          "type": "null"
        }
      ]
    }
  },
  "required": [
    "id",
    "entity",
    "kind",
    "name",
    "description",
    "owner",
    "custodian",
    "confidentiality",
    "pii_class",
    "criticality",
    "location",
    "retention_policy",
    "disposal_method",
    "lifecycle",
    "provisioned_on",
    "last_reviewed",
    "next_review_due"
  ],
  "title": "AssetInventoryEntry",
  "type": "object",
  "x-corpospec-pillar": "legal"
}