Vendor Inheritance

Many compliance controls are partially or fully satisfied by external providers (cloud platforms, SaaS tools, managed services). Pretorin tracks these inheritance relationships and keeps inherited narratives in sync with vendor documentation.

Concepts

• Vendor — An external provider or internal shared service (CSP, SaaS, managed service, internal)
• Responsibility edge — A link between a control and a vendor indicating the control is inherited or shared
• Stale edge — A responsibility edge where the source narrative has changed but the inherited control hasn’t been updated

Workflow

1. Create Vendor Entities

pretorin vendor create "AWS GovCloud" --type csp \
  --description "Primary cloud infrastructure" \
  --authorization-level "FedRAMP High P-ATO" \
  --inherent-risk high

pretorin vendor create "Okta" --type saas \
  --description "Identity and access management" \
  --inherent-risk moderate

Vendor inherent risk and residual risk tiers use low, moderate, high, and critical. medium is accepted only as a deprecated input alias for moderate.

2. Upload Vendor Documentation

pretorin vendor upload-doc <vendor_id> ./aws-crm.pdf \
  --name "AWS Customer Responsibility Matrix" \
  --attestation-type vendor_provided

pretorin vendor upload-doc <vendor_id> ./okta-soc2.pdf \
  --name "Okta SOC 2 Type II Report" \
  --attestation-type third_party_attestation

3. Set Control Responsibility

Via MCP tools:

set_control_responsibility(
  system_id,
  control_id,
  framework_id,
  responsibility_mode,  # "inherited" or "shared"
  source_type,          # "provider" or "org_system"
  vendor_id,            # required when source_type is "provider"
  source_system_id,     # required when source_type is "org_system"
  source_control_id,    # optional — defaults to control_id
)

Responsibility modes:

• inherited — Fully satisfied by the source
• shared — Partially satisfied; your system handles the remainder

Source types:

• provider — A vendor entry on the Pretorin vendor portal. Pass its vendor_id.
• org_system — Another org-internal system (a shared platform, a common control provider). Pass its source_system_id.

source_control_id is the control id on the source side. It defaults to the target control_id, which fits the common vendor-inheritance case where the source covers the same control concept; set it explicitly when the source tracks the requirement under a different id.

Only system_id, control_id, framework_id, and responsibility_mode are required by the tool schema — the source fields are validated against the source_type you pick.

To inspect or undo an edge:

get_control_responsibility(system_id, control_id, framework_id)     # inherited, shared, or system-specific
remove_control_responsibility(system_id, control_id, framework_id)  # back to system-specific

4. Generate Inheritance Narratives

generate_inheritance_narrative(system_id, control_id, framework_id)

AI generates a narrative grounded in the vendor’s uploaded documentation (resolved via the responsibility edge), explaining how the vendor satisfies the control requirements.

5. Monitor Staleness

Over time, vendor documentation or source narratives may be updated. Check for stale inheritance:

get_stale_edges(system_id)

Returns controls where the source has changed but the inherited narrative hasn’t been refreshed.

6. Sync Stale Edges

sync_stale_edges(system_id)

Bulk updates inherited controls by regenerating narratives from the latest source.

Linking Evidence to Vendors

link_evidence_to_vendor(evidence_id, vendor_id, attestation_type)

Attestation types: self_attested, third_party_attestation, vendor_provided