# T12 — The standards mini-graphs inside the vault: GDPR, the EU AI Act and ATT&CK as nodes to link to

> Rendered from .claude/briefs/T12-standards-mini-graphs.md in the repository. The text below is that file.
> Source: https://riskmandate.ai/admin/work/T12/ · noindex · written by scripts/site/build-admin.mjs

> **Done** v1.24.0 — built for `oc433z3m` and the template. See `docs/briefs/direction__mvp-vault-and-the-reading-app.md` and the v1.24.0 notes.

**From:** `docs/briefs/direction__consequences-assets-and-the-vault-as-a-website.md` §3 and §5 item 3; the graph brief §3 (`links {mitre[], standards[], gdpr[]}`) and T03. **Size:** a day, alongside T03. **Touches:** `site/vaults/_template/data/standards/` (new: `gdpr.json`, `eu-ai-act.json`, `attack.json`, copied into every vault by the build), `data/consequences.json` and the behaviours extension (the `links` they point at), `site/vaults/_app/index.html` (a link renders as title + id, opening the source), `scripts/site/build-abp-vault.mjs` (validates every link resolves to a node).

## The task
A consequence that says *you can forward any message* should link, inside the vault, to the GDPR
article titles it touches, the EU AI Act article titles where they apply, and the ATT&CK technique
names — so a reader clicks from the consequence to the standard without leaving the vault and
without the vault reproducing a standard's text. Build the three mini-graphs as data: one node per
article or technique with its number or id, its **title**, and the link to the source. Make the
build refuse a `links` entry that names a node the mini-graph does not have.

## Constraints
- **Titles only** (rule 7). Never the body text of a standard. The EU regulation may be quoted;
  the default is still the title.
- **No conformity language** (rule 6). A link says *touches* or *is named by*; never
  *complies with*, *aligned with*, *covered by*.
- Only the nodes a vault's consequences and behaviours actually link to are copied into that
  vault; the template holds the full mini-graph.
- ATT&CK: technique id and name from the public matrix, with the URL; the version read and the
  date, in the file's provenance.
- Where a link is a judgement (which article a consequence touches), the entry carries
  `authored_by` and a one-line reason.

## Done means
- The three files exist under `_template/data/standards/` with provenance and dates.
- `oc433z3m` carries the subset its links use; every link in `consequences.json` and the
  behaviours extension resolves; the build fails on one that does not.
- The app renders a link as *title · id ↗*; no standard's text appears anywhere in the vault.
- The ask to the model site — a sanctioned `links` property, or an extension namespace — is on
  Lab 03 (`site/lab-abp-requests.html`) with a date.
- `npm run check` green.