risk-domain-assessment-udm¶

Slugrisk-domain-assessment-udm

Version0.1.0

Statusexperimental

Last fully evaluatednone

Eval stateno validated eval cases

Categoryreview

Domainresearch-administration

Manifestationsprompt

Created2026-05-20

Updated2026-05-20

Tags: risk-assessment risk-scoring 14-domain-rubric post-award pre-award compliance research-security audit sustainability intellectual-property reputational-risk udm structured-extraction json

Audience: sponsored-programs-staff, post-award-teams, research-security-officers, audit-and-compliance, institutional-leadership

Manifestations in repo: prompt.md

Evaluates one or more award documents (Notice of Award, FOA / NOFO / RFA, modification, proposal) across 14 institutional risk domains using a standardized 1–5 scoring rubric. Each domain captures a distinct dimension of risk — programmatic complexity, financial structure, subrecipient risk, research security, compliance burden, reporting burden, administrative burden, audit risk, strategic alignment, sustainability, sensitive data, IP / privacy, sponsor reliability, reputational risk — and produces an evidence-cited justification supporting an informed institutional risk-acceptance decision.

Output contract: schema.json Contract scope: repo-local, UDM-aligned

Inputs¶

One or more award documents. The typical input set is:

a Notice of Award (NOA) plus
the originating FOA / NOFO / RFA, and
optionally modifications and the proposal / Statement of Work.

Document complexity ranges from 10 to 150+ pages across the input set. All documents are uploaded as workflow documents to Vandalizer.

Outputs¶

A single JSON object with three structured blocks:

award_metadata — award_number (FAIN), cfda_number, sponsor_name, pi_name, award_period_start, award_period_end, assessment_date
domain_scores — 14 typed domain blocks, each with a JSON integer score (1–5), an evidence-cited justification, and domain-specific evidence fields. Domain names: domain_1_programmatic_complexity, domain_2_financial_budgetary_risk, domain_3_subrecipient_partner_risk, domain_4_research_security, domain_5_compliance_regulatory, domain_6_reporting_burden, domain_7_administrative_burden, domain_8_audit_risk, domain_9_strategic_alignment, domain_10_sustainability_closeout, domain_11_doj_bulk_data, domain_12_ip_privacy, domain_13_unusual_terms, domain_14_reputational_risk
aggregate_metrics — total_risk_score (integer 14–70), average_risk_score (number 1.0–5.0), overall_risk_level (four-value enum: Low, Moderate, High, Very High), high_risk_domains[] (names of domains with score ≥ 4), key_risk_findings[], recommended_mitigations[]

See schema.json for the authoritative definition and prompt.md for encoding rules (scores as JSON integers, JSON-number monetary evidence fields, evidence-cited justification rules, insufficient-evidence handling).

Critical: scores are JSON integers, not enum strings¶

This component applies the boss's PR #33 number-vs-string review feedback to every scoring field. The source workflow types Domain_X_Score as Integer. The schema enforces this: every score is a JSON integer in [1, 5]. Quoted strings like "3" will fail validation. Mirrors the source workflow's Field_Type: Integer.

Contract scope¶

Repo-local, UDM-aligned. Award metadata fields and select evidence fields resolve to UDM entities (Award, Organization, Subaward, CostShare, IndirectRate, ComplianceRequirement, Terms). The 14-domain rubric itself is repo-local — the AI4RA-UDM repository does not (yet) own a shared risk-rubric table.

Relationship to other components¶

Concern	Source of truth
14-domain institutional risk profile	`risk-domain-assessment-udm` (this component)
Operational Banner ERP setup from a fully-executed award	`export-to-banner-extraction-udm`
Broader compliance monitoring (audit thresholds, deliverable schedules)	`award-compliance-extraction-udm`
Prior-approval procedural mechanics per approval type	`prior-approval-extraction-udm`

The risk-domain-assessment is intended to run early in the post-award lifecycle (before signing or accepting) and again whenever a modification materially changes the risk profile. The other three components run continuously through the award lifecycle.

Triad integration¶

Evaluation datasets: none yet — planned: a multi-document fixture (NOA + RFA + proposal) that exercises diverse risk profiles across the 14 domains (e.g., low programmatic but high research-security; high IP and reputational concurrent).
Harness notes: canonical manifestation is prompt.md. Validation surface is schema.json. The workflow runs across multiple uploaded documents.
Shared UDM relationship: aligned, not owning. Leaf evidence fields bind to UDM entities; the 14-domain rubric and aggregate metrics are repo-local.

Runtime topology — the Vandalizer workflow¶

The canonical runtime for this component is the risk-domain-assessment workflow shipped at the top level of this repo. The single source of truth is workflows/risk-domain-assessment/manifest.yaml; the companion .vandalizer.json envelope is generated by scripts/build_vandalizer_workflows.py and committed alongside. The runtime mirrors the source ui-insight/ProcessMapping/workflows/risk-domain-assessment/ workflow:

Step 1 (parallel Extraction) — six Extraction tasks each cover 2–4 of the 14 domains. Task-1 = Domains 1+9 (Programmatic + Strategic). Task-2 = Domains 2+8 (Financial + Audit). Task-3 = Domains 3+13 (Subrecipient + Unusual Terms). Task-4 = Domains 4+5 (Research Security + Compliance). Task-5 = Domains 6+7 (Reporting + Administrative Burden). Task-6 = Domains 10+11+12+14 (Sustainability + DOJ Data + IP / Privacy + Reputational). The split mirrors the source workflow's TASK-1-1 through TASK-1-6 one-for-one.
Step 2 (Consolidation Prompt) — assembles the six JSON fragments into the schema-conformant three-block object, computes aggregate_metrics (total_risk_score = sum of 14 scores, average_risk_score = total/14, overall_risk_level from the average), and derives high_risk_domains / key_risk_findings / recommended_mitigations from the per-domain scores and justifications.

Regenerate the workflow JSON whenever this component bumps MINOR or MAJOR (or whenever the workflow manifest changes); CI fails if the committed .vandalizer.json drifts from a fresh build.

Manifestations¶

prompt.md — canonical, LLM-agnostic prompt

Evals¶

See evals/ for reference inputs and known-good outputs. Initial case pending: a multi-document fixture (NOA + RFA + proposal) with deliberately mixed risk profile, validated by a Research Security Officer and a Sponsored Programs Administrator together.

Provenance¶

Authored 2026-05-20 against the risk-domain-assessment (Workflow_ID: WF-RISK-DOMAIN-ASSESSMENT) process-mapping workflow in ui-insight/ProcessMapping at commit 2c1f47f46474130743af5aee44d074bcd21787e9. The 14-domain rubric is the institutional risk-scoring framework adopted by the University of Idaho sponsored-programs office; this component makes the rubric a harness-evaluatable, versioned artifact rather than a manual scoring spreadsheet.

Contract scope¶

Output format: json_object
Contract scope: shared_udm_semantics_repo_local_schema
Validation surfaces: json_schema
Schema entrypoints: #
Notes: Repo-local 14-domain institutional risk-rubric contract. Three structured blocks (award_metadata, domain_scores, aggregate_metrics) where domain_scores is 14 typed blocks each with a JSON integer score (1-5), an evidence-cited justification, and domain-specific evidence fields. The consolidator computes aggregate_metrics deterministically (total_risk_score sum, average_risk_score quotient, four-value overall_risk_level enum) and derives high_risk_domains, key_risk_findings, recommended_mitigations from the per-domain scores. All scores are JSON integers per the boss's PR #33 review feedback.
Machine-readable catalog entry: component_catalog.json

Triad integration¶

UDM alignment: shared_udm_semantics_repo_local_schema — award_metadata fields and selected evidence fields resolve to UDM entities: award_number to Award.Award_Number; award_period_start / award_period_end to Award.Original_Start_Date / Original_End_Date; sponsor_name to Organization.Organization_Name; cfda_number to Award.CFDA_Number; domain_1.project_title to Award.Award_Title; domain_2.total_federal_funding to Award.Current_Total_Funded; domain_2.cost_share_required and cost_share_amount to CostShare.Is_Mandatory and CostShare.Committed_Amount; domain_2.idc_rate_restriction to IndirectRate.Rate_Percentage; domain_3.subrecipient_risk_level and subrecipient_monitoring_requirements to Subaward.Risk_Level and Subaward.Monitoring_Plan; domain_5.compliance_requirement_type and compliance_risk_level to ComplianceRequirement (Requirement_Type, Risk_Level); domain_6.reporting_frequency and reporting_requirements_detail to Terms.Invoicing_Frequency and Terms.Reporting_Requirements; domain_8.pass_through_indicator to Award.Flow_Through_Indicator; domain_10.closeout_requirements and property_equipment_obligations to Terms.Closeout_Requirements and Terms.Property_Requirements; domain_12.publication_requirements to Terms.Publication_Requirements; domain_13.special_conditions to Terms.Special_Conditions. The 14-domain rubric and aggregate-metrics shape themselves are repo-local — no shared UDM risk-rubric table exists yet.
Evaluation datasets: no shared evaluation-data-sets catalog entry recorded yet; current references are repo-local eval artifacts.
Harness notes: Validate JSON outputs against schema.json. Canonical single-call invocation surface is prompt.md. The companion top-level workflows/risk-domain-assessment Vandalizer workflow at v0.1.0 implements the contract as six parallel Extraction tasks (each covering 2-4 of the 14 domains) plus a Consolidation Prompt that assembles the 14 domain blocks, computes aggregate_metrics deterministically, and derives high_risk_domains / key_risk_findings / recommended_mitigations. Campaign authors should record both single-call and post-consolidation signals when both are available.
Related component: award-compliance-extraction-udm (complementary_focus) — risk-domain-assessment-udm produces a one-time institutional risk profile (run at award acceptance and on major modifications); award-compliance-extraction-udm runs continuously through the award lifecycle to monitor the compliance framework. The risk-assessment Domain 5 (Compliance & Regulatory) evidence fields overlap with the award-compliance contract's compliance_framework block.
Related component: export-to-banner-extraction-udm (sibling_award_consumption) — Both components consume the same fully-executed award document(s). risk-domain-assessment-udm produces an institutional risk profile; export-to-banner-extraction-udm produces operational Banner ERP setup fields.

Prompt body¶

Source: prompt.md.

Show prompt

Risk Domain Assessment — UDM JSON¶

Purpose: Evaluate an award document (Notice of Award, FOA / NOFO / RFA, modification, or proposal) across 14 institutional risk domains using a standardized 1–5 scoring rubric. Each domain captures a distinct dimension of risk — from programmatic complexity and financial structure to research security, compliance burden, intellectual property, and reputational exposure — producing a comprehensive evidence-backed risk profile that supports informed award-acceptance and post-award management decisions.

Expected input: One or more award documents — typically a Notice of Award plus the FOA / NOFO / RFA and any modifications. Optional but useful: the proposal and Statement of Work. Document complexity ranges from 10 to 150+ pages.

Expected output: A single JSON object that validates against schema.json. No prose, no markdown outside the JSON.

When to use this contract¶

This component is the risk-profile cut of an award document, distinct from the operational cuts (Banner setup, FFR cadence, compliance framework). It is intended to:

support the institutional risk-acceptance decision before signing or accepting an award;
inform post-award management priorities (which domains need monitoring or mitigation);
give research security, audit, and compliance officers a consistent evidence-backed scoring across awards rather than ad-hoc narrative reviews.

The 14 domains are mapped 1-for-1 to the source ProcessMapping workflow's domain rubric. Each domain produces an integer score (1–5) and an evidence-based justification that cites specific document sections rather than inferring from general practice. The contract enforces:

Scores are JSON integers (1–5), not enum strings — this is the boss's number-vs-string requirement applied to scoring fields.
Every score has a non-empty justification.
When the document does not contain sufficient information to assess a domain, the score is conservative (typically 1–2) and the justification says "Insufficient document evidence: ...".
The consolidator derives aggregate metrics (total_risk_score 14–70 integer; average_risk_score 1.0–5.0 number; overall_risk_level four-value enum; high_risk_domains array of domain names with score ≥ 4).

This component does not cover Banner setup — that lives in export-to-banner-extraction-udm. It does not cover modification-intake routing — that lives in award-modification-intake-udm.

Prompt¶

You are evaluating one or more award documents (Notice of Award, FOA / NOFO / RFA, modification, proposal) against a 14-domain institutional risk rubric. Your output is a single JSON object conforming to schema.json.

Evidence-based scoring only. Every score must cite specific document sections or provisions. When the document does not contain sufficient information to assess a domain, score conservatively (1 or 2) and write "Insufficient document evidence: <what was missing>" as the justification. Never infer or assume information not present in the documents.

Search the entire input across all uploaded documents. Each domain has its own search-section hints (see below). Keywords cluster around the domain — follow them.

Return a single JSON object that validates against schema.json with these top-level keys:

award_metadata — object with award_number, cfda_number, sponsor_name, pi_name, award_period_start, award_period_end, assessment_date.
domain_scores — object with 14 typed domain blocks (one per domain), each containing the domain's score (integer), justification (string), and any domain-specific evidence fields.
aggregate_metrics — object with total_risk_score, average_risk_score, overall_risk_level, high_risk_domains, key_risk_findings, recommended_mitigations.

Critical: scores are JSON integers¶

Every *_score field below is a JSON integer 1–5 inclusive. Not a quoted string "3". Not an enum entry. A JSON integer. Mirrors the source workflow's Field_Type: Integer.

average_risk_score is a JSON number (decimal allowed, e.g., 3.4). total_risk_score is a JSON integer (sum of the 14 domain scores; range 14–70).

The 14 domains¶

Each domain produces a {score, justification, ...evidence} block. Score 1 = minimal risk; 5 = maximum risk. Justifications must cite document sections.

Domain 1 — Programmatic Complexity¶

Search: Project Narrative, Project Summary / Abstract, Statement of Work, Award Face Sheet, Program Description.

Evidence fields: project_title, project_description_summary, number_of_project_components (integer or null), partnership_requirements (string or null), technical_sophistication_indicators (array of strings).

Domain 2 — Financial & Budgetary Risk¶

Search: Award Face Sheet, Budget, Funding Information, Cost Sharing or Matching, Funding Restrictions, Award Provisions.

Evidence fields: total_federal_funding (JSON number), total_anticipated_funding (JSON number or null), cost_share_required (boolean), cost_share_amount (JSON number or null), idc_rate_restriction (string), budget_flexibility_restrictions (array), multiple_funding_streams (boolean or null).

Domain 3 — Subrecipient / Partner Risk¶

Search: Subaward Information, Consortium Agreements, Award Terms and Conditions, Special Conditions.

Evidence fields: number_of_subrecipients (integer), subrecipient_details (array of strings), foreign_partners_present (boolean or null), subrecipient_risk_level (string or null), subrecipient_monitoring_requirements (string or null).

Domain 4 — Research Security & Foreign Influence¶

Search: Award Terms and Conditions, Ethical Conduct, Research Security, Certifications and Assurances.

Evidence fields: foreign_collaboration_indicators (array), export_control_concerns (boolean or null), nspm33_chips_applicability (string or null).

Domain 5 — Compliance & Regulatory Requirements¶

Search: Compliance Requirements, Cross-cutting Requirements, Certifications and Assurances.

Evidence fields: compliance_requirements_identified (array), compliance_requirement_type (string or null), compliance_risk_level (string or null), cross_cutting_federal_requirements (array).

Domain 6 — Performance Measurement & Reporting Burden¶

Search: Reporting Requirements, Performance Metrics, Deliverables.

Evidence fields: reporting_frequency (string), reporting_requirements_detail (string), performance_metrics_complexity (string or null), evaluator_required (boolean or null), data_use_agreements_required (boolean or null).

Domain 7 — Administrative / Operational Burden¶

Search: Award Administration, Prior Approval Matrix, Personnel.

Evidence fields: prior_approval_requirements (array), administrative_complexity_indicators (array), pi_capacity_considerations (string or null).

Domain 8 — Audit Risk¶

Same search corpus as Domain 2 plus audit-specific keywords.

Evidence fields: pass_through_indicator (boolean or null), audit_exposure_indicators (array).

Domain 9 — Strategic / Mission Alignment¶

Same search corpus as Domain 1.

Evidence fields: institutional_mission_fit (string or null), institutional_resource_requirements (array).

Domain 10 — Sustainability & Closeout Risk¶

Search: Closeout Requirements, Property Requirements, Terms and Conditions, Sustainment.

Evidence fields: post_award_obligations (array), closeout_requirements (string or null), property_equipment_obligations (string or null).

Domain 11 — DOJ Bulk Data & Sensitive Information¶

Search: Data Management Plan, Privacy, Confidentiality, Sensitive Data.

Evidence fields: sensitive_data_requirements (string or null), data_security_standards (array).

Domain 12 — Intellectual Property, Data Rights & Privacy¶

Search: Intellectual Property, Data Rights, Publication Requirements, Confidentiality.

Evidence fields: ip_ownership_terms (string or null), data_sharing_requirements (string or null), publication_requirements (string or null), privacy_risk_indicators (array).

Search: Award Terms and Conditions, Special Conditions, Provisions.

Evidence fields: non_standard_terms (array), special_conditions (array).

Domain 14 — Institutional / Reputational Risk¶

Search: Award Terms and Conditions, Special Terms, Publication Requirements.

Evidence fields: reputational_risk_indicators (array).

aggregate_metrics¶

total_risk_score — JSON integer in [14, 70]. Sum of the 14 domain scores. The consolidator computes this; the schema validates it.
average_risk_score — JSON number with one decimal place in [1.0, 5.0]. total_risk_score / 14.
overall_risk_level — one of "Low" (average 1.0–1.9), "Moderate" (2.0–2.9), "High" (3.0–3.9), "Very High" (4.0–5.0).
high_risk_domains — array of strings (domain names with score >= 4). E.g., ["Domain 4 — Research Security & Foreign Influence", "Domain 11 — DOJ Bulk Data & Sensitive Information"]. Empty array when no domain scores 4 or 5.
key_risk_findings — array of strings (top evidence-cited findings across high-risk domains). Empty array when overall risk is Low.
recommended_mitigations — array of strings (mitigation strategies for high-risk domains). Empty array when overall risk is Low.

Cross-field rules¶

Every domain score is a JSON integer in [1, 5].
Every domain score has a non-empty justification.
When score >= 3, the justification MUST cite specific document evidence (mirrors source workflow's CFR-01).
total_risk_score equals the sum of the 14 individual *_score integers (mirrors source workflow's CHK-03).
average_risk_score equals total_risk_score / 14 (rounded to one decimal place).

Encoding rules¶

Scores are JSON integers, never quoted strings or enum entries.
Boolean evidence fields are JSON booleans, not "Yes" / "No".
Monetary evidence fields are JSON numbers (total_federal_funding, total_anticipated_funding, cost_share_amount).
Justifications must be evidence-based, never inferred from general practice.
Insufficient evidence is scored conservatively (1 or 2) with "Insufficient document evidence: ..." justification, never silently scored 3.

Output¶

A single JSON object. No surrounding markdown.

Output schema¶

Source: schema.json.

Show schema.json

{

  "$schema": "https://json-schema.org/draft/2020-12/schema",

  "$id": "https://github.com/AI4RA/prompt-library/components/risk-domain-assessment-udm/schema.json",

  "title": "Risk Domain Assessment \u2014 UDM Output",

  "description": "JSON contract for an institutional risk profile derived from one or more award documents (Notice of Award, FOA / NOFO / RFA, modification, proposal) using a standardized 14-domain 1-5 rubric. Each domain produces a JSON integer score plus an evidence-cited justification plus domain-specific evidence fields. The consolidator derives aggregate metrics (total / average risk scores, overall risk level, high-risk-domain list, key findings, recommended mitigations). Mirrors the source ui-insight/ProcessMapping risk-domain-assessment workflow's six parallel extraction tasks plus a Consolidation Prompt.",

  "version": "0.1.0",

  "type": "object",

  "additionalProperties": false,

  "required": [

    "award_metadata",

    "domain_scores",

    "aggregate_metrics"

  ],

  "$defs": {

    "domain_score_integer": {

      "type": "integer",

      "minimum": 1,

      "maximum": 5,

      "description": "JSON integer score 1-5 inclusive. 1 = minimal risk; 5 = maximum risk. Mirrors the source workflow's Field_Type: Integer; do not encode as a quoted string."

    },

    "justification_string": {

      "type": "string",

      "minLength": 1,

      "description": "Evidence-based justification citing specific document sections. When the document is insufficient, format as 'Insufficient document evidence: ...' rather than fabricating a rationale."

    }

  },

  "properties": {

    "award_metadata": {

      "type": "object",

      "additionalProperties": false,

      "required": [

        "award_number",

        "sponsor_name",

        "pi_name",

        "award_period_start",

        "award_period_end"

      ],

      "properties": {

        "award_number": {

          "type": "string",

          "minLength": 1,

          "description": "Federal Award Identification Number (FAIN) or sponsor award number. Required by source workflow. Resolves to UDM Award.Award_Number."

        },

        "cfda_number": {

          "type": [

            "string",

            "null"

          ],

          "description": "CFDA / Assistance Listing number. Resolves to UDM Award.CFDA_Number."

        },

        "sponsor_name": {

          "type": "string",

          "minLength": 1,

          "description": "Name of the sponsoring agency. Required by source workflow. Resolves to UDM Organization.Organization_Name."

        },

        "pi_name": {

          "type": "string",

          "minLength": 1,

          "description": "Principal Investigator / Project Director name. Required by source workflow."

        },

        "award_period_start": {

          "type": "string",

          "minLength": 1,

          "description": "Award period of performance start date (ISO YYYY-MM-DD when unambiguous). Required by source workflow. Resolves to UDM Award.Original_Start_Date."

        },

        "award_period_end": {

          "type": "string",

          "minLength": 1,

          "description": "Award period of performance end date (ISO YYYY-MM-DD when unambiguous). Required by source workflow. Resolves to UDM Award.Original_End_Date."

        },

        "assessment_date": {

          "type": [

            "string",

            "null"

          ],

          "description": "ISO YYYY-MM-DD date the risk assessment was performed."

        }

      }

    },

    "domain_scores": {

      "type": "object",

      "additionalProperties": false,

      "required": [

        "domain_1_programmatic_complexity",

        "domain_2_financial_budgetary_risk",

        "domain_3_subrecipient_partner_risk",

        "domain_4_research_security",

        "domain_5_compliance_regulatory",

        "domain_6_reporting_burden",

        "domain_7_administrative_burden",

        "domain_8_audit_risk",

        "domain_9_strategic_alignment",

        "domain_10_sustainability_closeout",

        "domain_11_doj_bulk_data",

        "domain_12_ip_privacy",

        "domain_13_unusual_terms",

        "domain_14_reputational_risk"

      ],

      "properties": {

        "domain_1_programmatic_complexity": {

          "type": "object",

          "additionalProperties": false,

          "required": [

            "score",

            "justification",

            "project_title",

            "project_description_summary",

            "technical_sophistication_indicators"

          ],

          "properties": {

            "score": {

              "$ref": "#/$defs/domain_score_integer"

            },

            "justification": {

              "$ref": "#/$defs/justification_string"

            },

            "project_title": {

              "type": "string",

              "minLength": 1,

              "description": "Resolves to UDM Award.Award_Title."

            },

            "project_description_summary": {

              "type": "string",

              "minLength": 1

            },

            "number_of_project_components": {

              "type": [

                "integer",

                "null"

              ],

              "minimum": 0

            },

            "partnership_requirements": {

              "type": [

                "string",

                "null"

              ]

            },

            "technical_sophistication_indicators": {

              "type": "array",

              "items": {

                "type": "string",

                "minLength": 1

              }

            }

          }

        },

        "domain_2_financial_budgetary_risk": {

          "type": "object",

          "additionalProperties": false,

          "required": [

            "score",

            "justification",

            "total_federal_funding",

            "cost_share_required",

            "idc_rate_restriction",

            "budget_flexibility_restrictions"

          ],

          "properties": {

            "score": {

              "$ref": "#/$defs/domain_score_integer"

            },

            "justification": {

              "$ref": "#/$defs/justification_string"

            },

            "total_federal_funding": {

              "type": "number",

              "description": "JSON number, not quoted string. Resolves to UDM Award.Current_Total_Funded."

            },

            "total_anticipated_funding": {

              "type": [

                "number",

                "null"

              ],

              "description": "JSON number. Resolves to UDM Award.Total_Anticipated_Funding."

            },

            "cost_share_required": {

              "type": "boolean",

              "description": "Resolves to UDM CostShare.Is_Mandatory."

            },

            "cost_share_amount": {

              "type": [

                "number",

                "null"

              ],

              "description": "JSON number. Resolves to UDM CostShare.Committed_Amount."

            },

            "idc_rate_restriction": {

              "type": "string",

              "minLength": 1,

              "description": "Resolves to UDM IndirectRate.Rate_Percentage."

            },

            "budget_flexibility_restrictions": {

              "type": "array",

              "items": {

                "type": "string",

                "minLength": 1

              }

            },

            "multiple_funding_streams": {

              "type": [

                "boolean",

                "null"

              ]

            }

          }

        },

        "domain_3_subrecipient_partner_risk": {

          "type": "object",

          "additionalProperties": false,

          "required": [

            "score",

            "justification",

            "subrecipient_details"

          ],

          "properties": {

            "score": {

              "$ref": "#/$defs/domain_score_integer"

            },

            "justification": {

              "$ref": "#/$defs/justification_string"

            },

            "number_of_subrecipients": {

              "type": [

                "integer",

                "null"

              ],

              "minimum": 0

            },

            "subrecipient_details": {

              "type": "array",

              "items": {

                "type": "string",

                "minLength": 1

              }

            },

            "foreign_partners_present": {

              "type": [

                "boolean",

                "null"

              ]

            },

            "subrecipient_risk_level": {

              "type": [

                "string",

                "null"

              ],

              "description": "Resolves to UDM Subaward.Risk_Level."

            },

            "subrecipient_monitoring_requirements": {

              "type": [

                "string",

                "null"

              ],

              "description": "Resolves to UDM Subaward.Monitoring_Plan."

            }

          }

        },

        "domain_4_research_security": {

          "type": "object",

          "additionalProperties": false,

          "required": [

            "score",

            "justification",

            "foreign_collaboration_indicators"

          ],

          "properties": {

            "score": {

              "$ref": "#/$defs/domain_score_integer"

            },

            "justification": {

              "$ref": "#/$defs/justification_string"

            },

            "foreign_collaboration_indicators": {

              "type": "array",

              "items": {

                "type": "string",

                "minLength": 1

              }

            },

            "export_control_concerns": {

              "type": [

                "boolean",

                "null"

              ]

            },

            "nspm33_chips_applicability": {

              "type": [

                "string",

                "null"

              ]

            }

          }

        },

        "domain_5_compliance_regulatory": {

          "type": "object",

          "additionalProperties": false,

          "required": [

            "score",

            "justification",

            "compliance_requirements_identified",

            "cross_cutting_federal_requirements"

          ],

          "properties": {

            "score": {

              "$ref": "#/$defs/domain_score_integer"

            },

            "justification": {

              "$ref": "#/$defs/justification_string"

            },

            "compliance_requirements_identified": {

              "type": "array",

              "items": {

                "type": "string",

                "minLength": 1

              }

            },

            "compliance_requirement_type": {

              "type": [

                "string",

                "null"

              ],

              "description": "Resolves to UDM ComplianceRequirement.Requirement_Type."

            },

            "compliance_risk_level": {

              "type": [

                "string",

                "null"

              ],

              "description": "Resolves to UDM ComplianceRequirement.Risk_Level."

            },

            "cross_cutting_federal_requirements": {

              "type": "array",

              "items": {

                "type": "string",

                "minLength": 1

              }

            }

          }

        },

        "domain_6_reporting_burden": {

          "type": "object",

          "additionalProperties": false,

          "required": [

            "score",

            "justification",

            "reporting_frequency",

            "reporting_requirements_detail"

          ],

          "properties": {

            "score": {

              "$ref": "#/$defs/domain_score_integer"

            },

            "justification": {

              "$ref": "#/$defs/justification_string"

            },

            "reporting_frequency": {

              "type": "string",

              "minLength": 1,

              "description": "Resolves to UDM Terms.Invoicing_Frequency."

            },

            "reporting_requirements_detail": {

              "type": "string",

              "minLength": 1,

              "description": "Resolves to UDM Terms.Reporting_Requirements."

            },

            "performance_metrics_complexity": {

              "type": [

                "string",

                "null"

              ]

            },

            "evaluator_required": {

              "type": [

                "boolean",

                "null"

              ]

            },

            "data_use_agreements_required": {

              "type": [

                "boolean",

                "null"

              ]

            }

          }

        },

        "domain_7_administrative_burden": {

          "type": "object",

          "additionalProperties": false,

          "required": [

            "score",

            "justification",

            "prior_approval_requirements",

            "administrative_complexity_indicators"

          ],

          "properties": {

            "score": {

              "$ref": "#/$defs/domain_score_integer"

            },

            "justification": {

              "$ref": "#/$defs/justification_string"

            },

            "prior_approval_requirements": {

              "type": "array",

              "items": {

                "type": "string",

                "minLength": 1

              }

            },

            "administrative_complexity_indicators": {

              "type": "array",

              "items": {

                "type": "string",

                "minLength": 1

              }

            },

            "pi_capacity_considerations": {

              "type": [

                "string",

                "null"

              ]

            }

          }

        },

        "domain_8_audit_risk": {

          "type": "object",

          "additionalProperties": false,

          "required": [

            "score",

            "justification",

            "audit_exposure_indicators"

          ],

          "properties": {

            "score": {

              "$ref": "#/$defs/domain_score_integer"

            },

            "justification": {

              "$ref": "#/$defs/justification_string"

            },

            "pass_through_indicator": {

              "type": [

                "boolean",

                "null"

              ],

              "description": "Resolves to UDM Award.Flow_Through_Indicator."

            },

            "audit_exposure_indicators": {

              "type": "array",

              "items": {

                "type": "string",

                "minLength": 1

              }

            }

          }

        },

        "domain_9_strategic_alignment": {

          "type": "object",

          "additionalProperties": false,

          "required": [

            "score",

            "justification",

            "institutional_resource_requirements"

          ],

          "properties": {

            "score": {

              "$ref": "#/$defs/domain_score_integer"

            },

            "justification": {

              "$ref": "#/$defs/justification_string"

            },

            "institutional_mission_fit": {

              "type": [

                "string",

                "null"

              ]

            },

            "institutional_resource_requirements": {

              "type": "array",

              "items": {

                "type": "string",

                "minLength": 1

              }

            }

          }

        },

        "domain_10_sustainability_closeout": {

          "type": "object",

          "additionalProperties": false,

          "required": [

            "score",

            "justification",

            "post_award_obligations"

          ],

          "properties": {

            "score": {

              "$ref": "#/$defs/domain_score_integer"

            },

            "justification": {

              "$ref": "#/$defs/justification_string"

            },

            "post_award_obligations": {

              "type": "array",

              "items": {

                "type": "string",

                "minLength": 1

              }

            },

            "closeout_requirements": {

              "type": [

                "string",

                "null"

              ],

              "description": "Resolves to UDM Terms.Closeout_Requirements."

            },

            "property_equipment_obligations": {

              "type": [

                "string",

                "null"

              ],

              "description": "Resolves to UDM Terms.Property_Requirements."

            }

          }

        },

        "domain_11_doj_bulk_data": {

          "type": "object",

          "additionalProperties": false,

          "required": [

            "score",

            "justification",

            "data_security_standards"

          ],

          "properties": {

            "score": {

              "$ref": "#/$defs/domain_score_integer"

            },

            "justification": {

              "$ref": "#/$defs/justification_string"

            },

            "sensitive_data_requirements": {

              "type": [

                "string",

                "null"

              ]

            },

            "data_security_standards": {

              "type": "array",

              "items": {

                "type": "string",

                "minLength": 1

              }

            }

          }

        },

        "domain_12_ip_privacy": {

          "type": "object",

          "additionalProperties": false,

          "required": [

            "score",

            "justification",

            "privacy_risk_indicators"

          ],

          "properties": {

            "score": {

              "$ref": "#/$defs/domain_score_integer"

            },

            "justification": {

              "$ref": "#/$defs/justification_string"

            },

            "ip_ownership_terms": {

              "type": [

                "string",

                "null"

              ]

            },

            "data_sharing_requirements": {

              "type": [

                "string",

                "null"

              ]

            },

            "publication_requirements": {

              "type": [

                "string",

                "null"

              ],

              "description": "Resolves to UDM Terms.Publication_Requirements."

            },

            "privacy_risk_indicators": {

              "type": "array",

              "items": {

                "type": "string",

                "minLength": 1

              }

            }

          }

        },

        "domain_13_unusual_terms": {

          "type": "object",

          "additionalProperties": false,

          "required": [

            "score",

            "justification",

            "non_standard_terms",

            "special_conditions"

          ],

          "properties": {

            "score": {

              "$ref": "#/$defs/domain_score_integer"

            },

            "justification": {

              "$ref": "#/$defs/justification_string"

            },

            "non_standard_terms": {

              "type": "array",

              "items": {

                "type": "string",

                "minLength": 1

              }

            },

            "special_conditions": {

              "type": "array",

              "items": {

                "type": "string",

                "minLength": 1

              },

              "description": "Resolves to UDM Terms.Special_Conditions."

            }

          }

        },

        "domain_14_reputational_risk": {

          "type": "object",

          "additionalProperties": false,

          "required": [

            "score",

            "justification",

            "reputational_risk_indicators"

          ],

          "properties": {

            "score": {

              "$ref": "#/$defs/domain_score_integer"

            },

            "justification": {

              "$ref": "#/$defs/justification_string"

            },

            "reputational_risk_indicators": {

              "type": "array",

              "items": {

                "type": "string",

                "minLength": 1

              }

            }

          }

        }

      }

    },

    "aggregate_metrics": {

      "type": "object",

      "additionalProperties": false,

      "required": [

        "total_risk_score",

        "average_risk_score",

        "overall_risk_level",

        "high_risk_domains",

        "key_risk_findings",

        "recommended_mitigations"

      ],

      "properties": {

        "total_risk_score": {

          "type": "integer",

          "minimum": 14,

          "maximum": 70,

          "description": "Sum of the 14 domain scores. JSON integer, not quoted string."

        },

        "average_risk_score": {

          "type": "number",

          "minimum": 1.0,

          "maximum": 5.0,

          "description": "total_risk_score / 14, rounded to one decimal place. JSON number."

        },

        "overall_risk_level": {

          "type": "string",

          "enum": [

            "Low",

            "Moderate",

            "High",

            "Very High"

          ],

          "description": "Low = avg 1.0-1.9; Moderate = 2.0-2.9; High = 3.0-3.9; Very High = 4.0-5.0."

        },

        "high_risk_domains": {

          "type": "array",

          "items": {

            "type": "string",

            "minLength": 1

          },

          "description": "Names of domains with score >= 4. Empty array when no domain reaches 4 or 5."

        },

        "key_risk_findings": {

          "type": "array",

          "items": {

            "type": "string",

            "minLength": 1

          },

          "description": "Top evidence-cited findings across high-risk domains. Empty array when overall risk is Low."

        },

        "recommended_mitigations": {

          "type": "array",

          "items": {

            "type": "string",

            "minLength": 1

          },

          "description": "Mitigation strategies for high-risk domains. Empty array when overall risk is Low."

        }

      }

    }

  }

}

Changelog¶

Source: CHANGELOG.md.

All notable changes to this component. Versions follow semver: MAJOR for output-contract breaks, MINOR for backward-compatible additions, PATCH for wording or clarity.

[0.1.0] — 2026-05-20¶

Initial experimental release.
Schema derived from the risk-domain-assessment v2 Vandalizer workflow in ui-insight/ProcessMapping (six parallel extraction tasks, 14 domain scores + evidence fields, three cross-field rules, three validation-plan checks).
Three-block shape (award_metadata + domain_scores + aggregate_metrics) preserves the source workflow's per-domain rubric structure and adds explicit aggregate-metric derivations.
Scores typed as JSON integers in [1, 5] via a shared $defs/domain_score_integer definition. Mirrors the source workflow's Field_Type: Integer. The source workflow's Enum_Values: ["1","2","3","4","5"] on some domain scores is treated as documentation, not as a string-enum encoding — the schema enforces JSON integer encoding. Applies the boss's PR #33 review feedback (number vs string) to all scoring fields.
aggregate_metrics.total_risk_score typed as JSON integer in [14, 70]. aggregate_metrics.average_risk_score typed as JSON number in [1.0, 5.0]. aggregate_metrics.overall_risk_level exposed as the four-value enum (Low, Moderate, High, Very High).
Every domain block requires both score and justification — mirrors source workflow's CFR-01 (justification not empty when score ≥ 3) by enforcing minLength: 1 on every justification. The prompt strengthens this further by requiring justifications to be evidence-cited.
Domain-specific evidence fields preserved from the source workflow:
Monetary evidence fields (domain_2.total_federal_funding, total_anticipated_funding, cost_share_amount) typed as JSON numbers. Mirrors source Field_Type: Decimal.
domain_2.cost_share_required, domain_4.export_control_concerns, domain_6.evaluator_required, domain_6.data_use_agreements_required, domain_8.pass_through_indicator, domain_2.multiple_funding_streams, domain_3.foreign_partners_present typed as JSON booleans.
Source Is_Required: true fields mirrored into required lists per domain block.
UDM column bindings preserved at the leaf level:
award_metadata: award_number → Award.Award_Number; cfda_number → Award.CFDA_Number; sponsor_name → Organization.Organization_Name; award_period_start / award_period_end → Award.Original_Start_Date / Original_End_Date.
domain_1.project_title → Award.Award_Title.
domain_2.total_federal_funding → Award.Current_Total_Funded; total_anticipated_funding → Award.Total_Anticipated_Funding; cost_share_required → CostShare.Is_Mandatory; cost_share_amount → CostShare.Committed_Amount; idc_rate_restriction → IndirectRate.Rate_Percentage.
domain_3.subrecipient_risk_level → Subaward.Risk_Level; subrecipient_monitoring_requirements → Subaward.Monitoring_Plan.
domain_5.compliance_requirement_type → ComplianceRequirement.Requirement_Type; compliance_risk_level → ComplianceRequirement.Risk_Level.
domain_6.reporting_frequency → Terms.Invoicing_Frequency; reporting_requirements_detail → Terms.Reporting_Requirements.
domain_8.pass_through_indicator → Award.Flow_Through_Indicator.
domain_10.closeout_requirements → Terms.Closeout_Requirements; property_equipment_obligations → Terms.Property_Requirements.
domain_12.publication_requirements → Terms.Publication_Requirements.
domain_13.special_conditions → Terms.Special_Conditions.
The 14-domain rubric and aggregate-metrics shape are repo-local — no shared UDM risk-rubric table exists yet.
No eval cases yet — status experimental until at least one golden extraction is added under evals/cases/.

risk-domain-assessment-udm¶

Inputs¶

Outputs¶

Critical: scores are JSON integers, not enum strings¶

Contract scope¶

Relationship to other components¶

Triad integration¶

Runtime topology — the Vandalizer workflow¶

Manifestations¶

Evals¶

Provenance¶

Contract scope¶

Triad integration¶

Prompt body¶

Risk Domain Assessment — UDM JSON¶

When to use this contract¶

Prompt¶

Critical: scores are JSON integers¶

The 14 domains¶

Domain 1 — Programmatic Complexity¶

Domain 2 — Financial & Budgetary Risk¶

Domain 3 — Subrecipient / Partner Risk¶

Domain 4 — Research Security & Foreign Influence¶

Domain 5 — Compliance & Regulatory Requirements¶

Domain 6 — Performance Measurement & Reporting Burden¶

Domain 7 — Administrative / Operational Burden¶

Domain 8 — Audit Risk¶

Domain 9 — Strategic / Mission Alignment¶

Domain 10 — Sustainability & Closeout Risk¶

Domain 11 — DOJ Bulk Data & Sensitive Information¶

Domain 12 — Intellectual Property, Data Rights & Privacy¶

Domain 13 — Unusual Terms and Conditions / Sponsor Reliability¶

Domain 14 — Institutional / Reputational Risk¶

aggregate_metrics¶

Cross-field rules¶

Encoding rules¶

Output¶

Output schema¶

Changelog¶

[0.1.0] — 2026-05-20¶