Rename control to mitigation

Signed-off-by: gearnode <bryan@frimin.fr>

pkg/coredata/control.go

@@ -28,47 +28,47 @@ import (
 )
 
 type (
-	Control struct {
-		ID          gid.GID           `db:"id"`
-		FrameworkID gid.GID           `db:"framework_id"`
-		Category    string            `db:"category"`
-		Name        string            `db:"name"`
-		Description string            `db:"description"`
-		Importance  ControlImportance `db:"importance"`
-		State       ControlState      `db:"state"`
-		ContentRef  string            `db:"content_ref"`
-		CreatedAt   time.Time         `db:"created_at"`
-		UpdatedAt   time.Time         `db:"updated_at"`
-		Version     int               `db:"version"`
-		Standards   []string          `db:"standards"`
+	Mitigation struct {
+		ID          gid.GID              `db:"id"`
+		FrameworkID gid.GID              `db:"framework_id"`
+		Category    string               `db:"category"`
+		Name        string               `db:"name"`
+		Description string               `db:"description"`
+		Importance  MitigationImportance `db:"importance"`
+		State       MitigationState      `db:"state"`
+		ContentRef  string               `db:"content_ref"`
+		CreatedAt   time.Time            `db:"created_at"`
+		UpdatedAt   time.Time            `db:"updated_at"`
+		Version     int                  `db:"version"`
+		Standards   []string             `db:"standards"`
 	}
 
-	Controls []*Control
+	Mitigations []*Mitigation
 
-	UpdateControlParams struct {
+	UpdateMitigationParams struct {
 		ExpectedVersion int
 		Name            *string
 		Description     *string
 		Category        *string
-		State           *ControlState
-		Importance      *ControlImportance
+		State           *MitigationState
+		Importance      *MitigationImportance
 	}
 )
 
-func (c Control) CursorKey(orderBy ControlOrderField) page.CursorKey {
+func (c Mitigation) CursorKey(orderBy MitigationOrderField) page.CursorKey {
 	switch orderBy {
-	case ControlOrderFieldCreatedAt:
+	case MitigationOrderFieldCreatedAt:
 		return page.NewCursorKey(c.ID, c.CreatedAt)
 	}
 
 	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
 }
 
-func (c *Control) LoadByID(
+func (c *Mitigation) LoadByID(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
-	controlID gid.GID,
+	mitigationID gid.GID,
 ) error {
 	q := `
 SELECT
@@ -85,41 +85,41 @@ SELECT
 	standards,
 	version
 FROM
-    controls
+    mitigations
 WHERE
     %s
-    AND id = @control_id
+    AND id = @mitigation_id
 LIMIT 1;
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	args := pgx.StrictNamedArgs{"control_id": controlID}
+	args := pgx.StrictNamedArgs{"mitigation_id": mitigationID}
 	maps.Copy(args, scope.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query controls: %w", err)
+		return fmt.Errorf("cannot query mitigations: %w", err)
 	}
 
-	control, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Control])
+	mitigation, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Mitigation])
 	if err != nil {
-		return fmt.Errorf("cannot collect controls: %w", err)
+		return fmt.Errorf("cannot collect mitigations: %w", err)
 	}
 
-	*c = control
+	*c = mitigation
 
 	return nil
 }
 
-func (c Control) Insert(
+func (c Mitigation) Insert(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
 ) error {
 	q := `
 INSERT INTO
-    controls (
+    mitigations (
         tenant_id,
         id,
         framework_id,
@@ -136,7 +136,7 @@ INSERT INTO
     )
 VALUES (
     @tenant_id,
-    @control_id,
+    @mitigation_id,
     @framework_id,
 	@category,
     @name,
@@ -152,30 +152,30 @@ VALUES (
 `
 
 	args := pgx.StrictNamedArgs{
-		"tenant_id":    scope.GetTenantID(),
-		"control_id":   c.ID,
-		"framework_id": c.FrameworkID,
-		"category":     c.Category,
-		"name":         c.Name,
-		"version":      0,
-		"description":  c.Description,
-		"content_ref":  c.ContentRef,
-		"created_at":   c.CreatedAt,
-		"updated_at":   c.UpdatedAt,
-		"state":        c.State,
-		"importance":   c.Importance,
-		"standards":    c.Standards,
+		"tenant_id":     scope.GetTenantID(),
+		"mitigation_id": c.ID,
+		"framework_id":  c.FrameworkID,
+		"category":      c.Category,
+		"name":          c.Name,
+		"version":       0,
+		"description":   c.Description,
+		"content_ref":   c.ContentRef,
+		"created_at":    c.CreatedAt,
+		"updated_at":    c.UpdatedAt,
+		"state":         c.State,
+		"importance":    c.Importance,
+		"standards":     c.Standards,
 	}
 	_, err := conn.Exec(ctx, q, args)
 	return err
 }
 
-func (c *Controls) LoadByFrameworkID(
+func (c *Mitigations) LoadByFrameworkID(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
 	frameworkID gid.GID,
-	cursor *page.Cursor[ControlOrderField],
+	cursor *page.Cursor[MitigationOrderField],
 ) error {
 	q := `
 SELECT
@@ -192,7 +192,7 @@ SELECT
 	standards,
 	version
 FROM
-    controls
+    mitigations
 WHERE
     %s
     AND framework_id = @framework_id
@@ -206,27 +206,27 @@ WHERE
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query controls: %w", err)
+		return fmt.Errorf("cannot query mitigations: %w", err)
 	}
 
-	controls, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Control])
+	mitigations, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Mitigation])
 	if err != nil {
-		return fmt.Errorf("cannot collect controls: %w", err)
+		return fmt.Errorf("cannot collect mitigations: %w", err)
 	}
 
-	*c = controls
+	*c = mitigations
 
 	return nil
 }
 
-func (c *Control) Update(
+func (c *Mitigation) Update(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
-	params UpdateControlParams,
+	params UpdateMitigationParams,
 ) error {
 	q := `
-UPDATE controls SET
+UPDATE mitigations SET
     name = COALESCE(@name, name),
     description = COALESCE(@description, description),
     category = COALESCE(@category, category),
@@ -235,7 +235,7 @@ UPDATE controls SET
     updated_at = @updated_at,
     version = version + 1
 WHERE %s
-    AND id = @control_id
+    AND id = @mitigation_id
     AND version = @expected_version
 RETURNING 
     id,
@@ -254,7 +254,7 @@ RETURNING
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
 	args := pgx.NamedArgs{
-		"control_id":       c.ID,
+		"mitigation_id":    c.ID,
 		"expected_version": params.ExpectedVersion,
 		"name":             params.Name,
 		"description":      params.Description,
@@ -268,15 +268,15 @@ RETURNING
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query controls: %w", err)
+		return fmt.Errorf("cannot query mitigations: %w", err)
 	}
 
-	control, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Control])
+	mitigation, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Mitigation])
 	if err != nil {
-		return fmt.Errorf("cannot collect controls: %w", err)
+		return fmt.Errorf("cannot collect mitigations: %w", err)
 	}
 
-	*c = control
+	*c = mitigation
 
 	return nil
 }

pkg/coredata/control_importance.go

@@ -20,48 +20,48 @@ import (
 	"fmt"
 )
 
-type ControlImportance uint8
+type MitigationImportance uint8
 
 const (
-	ControlImportanceMandatory ControlImportance = iota
-	ControlImportancePreferred
-	ControlImportanceAdvanced
+	MitigationImportanceMandatory MitigationImportance = iota
+	MitigationImportancePreferred
+	MitigationImportanceAdvanced
 )
 
-func (i ControlImportance) String() string {
+func (i MitigationImportance) String() string {
 	return []string{"MANDATORY", "PREFERRED", "ADVANCED"}[i]
 }
 
-func (i *ControlImportance) Scan(value interface{}) error {
+func (i *MitigationImportance) Scan(value interface{}) error {
 	switch v := value.(type) {
 	case uint8:
-		*i = ControlImportance(v)
+		*i = MitigationImportance(v)
 	case string:
 		switch v {
 		case "MANDATORY":
-			*i = ControlImportanceMandatory
+			*i = MitigationImportanceMandatory
 		case "PREFERRED":
-			*i = ControlImportancePreferred
+			*i = MitigationImportancePreferred
 		case "ADVANCED":
-			*i = ControlImportanceAdvanced
+			*i = MitigationImportanceAdvanced
 		default:
-			return fmt.Errorf("invalid ControlImportance value: %q", v)
+			return fmt.Errorf("invalid MitigationImportance value: %q", v)
 		}
 	default:
-		return fmt.Errorf("unsupported type for ControlImportance: %T", value)
+		return fmt.Errorf("unsupported type for MitigationImportance: %T", value)
 	}
 	return nil
 }
 
-func (i ControlImportance) Value() (driver.Value, error) {
+func (i MitigationImportance) Value() (driver.Value, error) {
 	return i.String(), nil
 }
 
-func (i ControlImportance) MarshalJSON() ([]byte, error) {
+func (i MitigationImportance) MarshalJSON() ([]byte, error) {
 	return json.Marshal(i.String())
 }
 
-func (i *ControlImportance) UnmarshalJSON(data []byte) error {
+func (i *MitigationImportance) UnmarshalJSON(data []byte) error {
 	var s string
 	if err := json.Unmarshal(data, &s); err != nil {
 		return err
@@ -69,18 +69,18 @@ func (i *ControlImportance) UnmarshalJSON(data []byte) error {
 
 	switch s {
 	case "MANDATORY":
-		*i = ControlImportanceMandatory
+		*i = MitigationImportanceMandatory
 	case "PREFERRED":
-		*i = ControlImportancePreferred
+		*i = MitigationImportancePreferred
 	case "ADVANCED":
-		*i = ControlImportanceAdvanced
+		*i = MitigationImportanceAdvanced
 	default:
-		return fmt.Errorf("invalid ControlImportance value: %q", s)
+		return fmt.Errorf("invalid MitigationImportance value: %q", s)
 	}
 	return nil
 }
 
-func (i *ControlImportance) UnmarshalText(text []byte) error {
+func (i *MitigationImportance) UnmarshalText(text []byte) error {
 	var s string
 	if err := json.Unmarshal(text, &s); err != nil {
 		return err
@@ -88,13 +88,13 @@ func (i *ControlImportance) UnmarshalText(text []byte) error {
 
 	switch s {
 	case "MANDATORY":
-		*i = ControlImportanceMandatory
+		*i = MitigationImportanceMandatory
 	case "PREFERRED":
-		*i = ControlImportancePreferred
+		*i = MitigationImportancePreferred
 	case "ADVANCED":
-		*i = ControlImportanceAdvanced
+		*i = MitigationImportanceAdvanced
 	default:
-		return fmt.Errorf("invalid ControlImportance value: %q", s)
+		return fmt.Errorf("invalid MitigationImportance value: %q", s)
 	}
 	return nil
 }

pkg/coredata/control_order_field.go

@@ -15,26 +15,26 @@
 package coredata
 
 type (
-	ControlOrderField string
+	MitigationOrderField string
 )
 
 const (
-	ControlOrderFieldCreatedAt ControlOrderField = "CREATED_AT"
+	MitigationOrderFieldCreatedAt MitigationOrderField = "CREATED_AT"
 )
 
-func (p ControlOrderField) Column() string {
+func (p MitigationOrderField) Column() string {
 	return string(p)
 }
 
-func (p ControlOrderField) String() string {
+func (p MitigationOrderField) String() string {
 	return string(p)
 }
 
-func (p ControlOrderField) MarshalText() ([]byte, error) {
+func (p MitigationOrderField) MarshalText() ([]byte, error) {
 	return []byte(p.String()), nil
 }
 
-func (p *ControlOrderField) UnmarshalText(text []byte) error {
-	*p = ControlOrderField(text)
+func (p *MitigationOrderField) UnmarshalText(text []byte) error {
+	*p = MitigationOrderField(text)
 	return nil
 }

pkg/coredata/control_state.go

@@ -20,65 +20,65 @@ import (
 )
 
 type (
-	ControlState uint8
+	MitigationState uint8
 )
 
 const (
-	ControlStateNotStarted ControlState = iota
-	ControlStateInProgress
-	ControlStateNotApplicable
-	ControlStateImplemented
+	MitigationStateNotStarted MitigationState = iota
+	MitigationStateInProgress
+	MitigationStateNotApplicable
+	MitigationStateImplemented
 )
 
-func (cs ControlState) MarshalText() ([]byte, error) {
+func (cs MitigationState) MarshalText() ([]byte, error) {
 	return []byte(cs.String()), nil
 }
 
-func (cs *ControlState) UnmarshalText(data []byte) error {
+func (cs *MitigationState) UnmarshalText(data []byte) error {
 	val := string(data)
 
 	switch val {
-	case ControlStateNotStarted.String():
-		*cs = ControlStateNotStarted
-	case ControlStateInProgress.String():
-		*cs = ControlStateInProgress
-	case ControlStateNotApplicable.String():
-		*cs = ControlStateNotApplicable
-	case ControlStateImplemented.String():
-		*cs = ControlStateImplemented
+	case MitigationStateNotStarted.String():
+		*cs = MitigationStateNotStarted
+	case MitigationStateInProgress.String():
+		*cs = MitigationStateInProgress
+	case MitigationStateNotApplicable.String():
+		*cs = MitigationStateNotApplicable
+	case MitigationStateImplemented.String():
+		*cs = MitigationStateImplemented
 	default:
-		return fmt.Errorf("invalid ControlState value: %q", val)
+		return fmt.Errorf("invalid MitigationState value: %q", val)
 	}
 
 	return nil
 }
 
-func (cs ControlState) String() string {
+func (cs MitigationState) String() string {
 	var val string
 
 	switch cs {
-	case ControlStateNotStarted:
+	case MitigationStateNotStarted:
 		val = "NOT_STARTED"
-	case ControlStateInProgress:
+	case MitigationStateInProgress:
 		val = "IN_PROGRESS"
-	case ControlStateNotApplicable:
+	case MitigationStateNotApplicable:
 		val = "NOT_APPLICABLE"
-	case ControlStateImplemented:
+	case MitigationStateImplemented:
 		val = "IMPLEMENTED"
 	}
 
 	return val
 }
 
-func (cs *ControlState) Scan(value any) error {
+func (cs *MitigationState) Scan(value any) error {
 	val, ok := value.(string)
 	if !ok {
-		return fmt.Errorf("invalid scan source for ControlState, expected string got %T", value)
+		return fmt.Errorf("invalid scan source for MitigationState, expected string got %T", value)
 	}
 
 	return cs.UnmarshalText([]byte(val))
 }
 
-func (cs ControlState) Value() (driver.Value, error) {
+func (cs MitigationState) Value() (driver.Value, error) {
 	return cs.String(), nil
 }

pkg/coredata/entity_type_reg.go

@@ -17,7 +17,7 @@ package coredata
 const (
 	OrganizationEntityType uint16 = iota
 	FrameworkEntityType
-	ControlEntityType
+	MitigationEntityType
 	TaskEntityType
 	EvidenceEntityType
 	ControlStateTransitionEntityType

pkg/coredata/migrations/20250327T093314Z.sql

@@ -0,0 +1,97 @@
+-- Rename control_state ENUM to mitigation_state
+-- We need to create a new type and update all references since 
+-- PostgreSQL doesn't support renaming enum types directly
+CREATE TYPE mitigation_state AS ENUM (
+    'NOT_STARTED',
+    'IN_PROGRESS',
+    'NOT_APPLICABLE',
+    'IMPLEMENTED'
+);
+
+-- Create new mitigation_importance type
+CREATE TYPE mitigation_importance AS ENUM (
+    'MANDATORY', 
+    'PREFERRED', 
+    'ADVANCED'
+);
+
+-- Rename controls table to mitigations, adding the new columns with the new types
+CREATE TABLE mitigations (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    framework_id TEXT NOT NULL,
+    name TEXT NOT NULL,
+    description TEXT NOT NULL,
+    content_ref TEXT NOT NULL,
+    category TEXT NOT NULL,
+    state mitigation_state NOT NULL,
+    importance mitigation_importance NOT NULL,
+    version INTEGER NOT NULL,
+    standards TEXT[] NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL
+);
+
+-- Copy data from controls to mitigations table
+INSERT INTO mitigations (
+    id, 
+    tenant_id, 
+    framework_id, 
+    name, 
+    description, 
+    content_ref, 
+    category, 
+    state, 
+    importance, 
+    version,
+    standards,
+    created_at, 
+    updated_at
+)
+SELECT 
+    id, 
+    tenant_id, 
+    framework_id, 
+    name, 
+    description, 
+    content_ref, 
+    category, 
+    (state::TEXT)::mitigation_state, 
+    (importance::TEXT)::mitigation_importance, 
+    version,
+    standards,
+    created_at, 
+    updated_at
+FROM controls;
+
+-- Update tasks to reference mitigations instead of controls
+ALTER TABLE tasks RENAME COLUMN control_id TO mitigation_id;
+
+-- Update foreign key constraint
+ALTER TABLE tasks DROP CONSTRAINT fk_tasks_control_id;
+ALTER TABLE tasks ADD CONSTRAINT fk_tasks_mitigation_id
+    FOREIGN KEY (mitigation_id) REFERENCES mitigations(id) ON DELETE CASCADE;
+
+-- If we have any control_state_transitions table, rename it
+-- Since the original migration file 20250310T161900Z.sql dropped it, this might not be necessary,
+-- but including for completeness
+DO $$
+BEGIN
+    IF EXISTS (
+        SELECT FROM information_schema.tables 
+        WHERE table_name = 'control_state_transitions'
+    ) THEN
+        ALTER TABLE control_state_transitions RENAME TO mitigation_state_transitions;
+        ALTER TABLE mitigation_state_transitions RENAME COLUMN control_id TO mitigation_id;
+        ALTER TABLE mitigation_state_transitions 
+            DROP CONSTRAINT IF EXISTS control_state_transitions_control_id_fkey;
+        ALTER TABLE mitigation_state_transitions 
+            ADD CONSTRAINT mitigation_state_transitions_mitigation_id_fkey
+            FOREIGN KEY (mitigation_id) REFERENCES mitigations(id);
+    END IF;
+END $$;
+
+-- Drop old controls table and enum types after migration is complete
+DROP TABLE controls;
+DROP TYPE control_state;
+DROP TYPE control_importance; 

pkg/coredata/task.go

@@ -30,16 +30,15 @@ import (
 type (
 	Task struct {
 		ID           gid.GID        `db:"id"`
-		ControlID    gid.GID        `db:"control_id"`
+		MitigationID gid.GID        `db:"mitigation_id"`
 		Name         string         `db:"name"`
 		Description  string         `db:"description"`
 		State        TaskState      `db:"state"`
-		ContentRef   string         `db:"content_ref"`
+		TimeEstimate *time.Duration `db:"time_estimate"`
+		AssignedToID *gid.GID       `db:"assigned_to"`
 		CreatedAt    time.Time      `db:"created_at"`
 		UpdatedAt    time.Time      `db:"updated_at"`
 		Version      int            `db:"version"`
-		AssignedTo   *gid.GID       `db:"assigned_to"`
-		TimeEstimate *time.Duration `db:"time_estimate"`
 	}
 
 	Tasks []*Task
@@ -53,16 +52,16 @@ type (
 	}
 )
 
-func (t Task) CursorKey(orderBy TaskOrderField) page.CursorKey {
+func (c Task) CursorKey(orderBy TaskOrderField) page.CursorKey {
 	switch orderBy {
 	case TaskOrderFieldCreatedAt:
-		return page.NewCursorKey(t.ID, t.CreatedAt)
+		return page.NewCursorKey(c.ID, c.CreatedAt)
 	}
 
 	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
 }
 
-func (t *Task) LoadByID(
+func (c *Task) LoadByID(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
@@ -71,13 +70,12 @@ func (t *Task) LoadByID(
 	q := `
 SELECT
     id,
-    control_id,
+    mitigation_id,
     name,
     description,
-	time_estimate,
     state,
-	assigned_to,
-    content_ref,
+    time_estimate,
+    assigned_to,
     created_at,
     updated_at,
     version
@@ -96,104 +94,100 @@ LIMIT 1;
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query task: %w", err)
+		return fmt.Errorf("cannot query tasks: %w", err)
 	}
 
 	task, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Task])
 	if err != nil {
-		return fmt.Errorf("cannot collect task: %w", err)
+		return fmt.Errorf("cannot collect tasks: %w", err)
 	}
 
-	*t = task
+	*c = task
 
 	return nil
 }
 
-func (t Task) Insert(
+func (c Task) Insert(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
 ) error {
 	q := `
-INSERT INTO tasks (
-    tenant_id,
-    id,
-    name,
-    control_id,
-    description,
-    content_ref,
-    created_at,
-    updated_at,
-    version,
-    state,
-	time_estimate,
-	assigned_to
-)
+INSERT INTO
+    tasks (
+        tenant_id,
+        id,
+        mitigation_id,
+        name,
+        description,
+        state,
+        time_estimate,
+        assigned_to,
+        created_at,
+        updated_at,
+        version
+    )
 VALUES (
     @tenant_id,
     @task_id,
+    @mitigation_id,
     @name,
-    @control_id,
     @description,
-    @content_ref,
+    @state,
+    @time_estimate,
+    @assigned_to,
     @created_at,
     @updated_at,
-    @version,
-    @state,
-	@time_estimate,
-	@assigned_to
+    @version
 );
 `
 
 	args := pgx.StrictNamedArgs{
 		"tenant_id":     scope.GetTenantID(),
-		"task_id":       t.ID,
-		"control_id":    t.ControlID,
-		"name":          t.Name,
-		"description":   t.Description,
-		"content_ref":   t.ContentRef,
-		"created_at":    t.CreatedAt,
-		"updated_at":    t.UpdatedAt,
-		"version":       t.Version,
-		"state":         t.State,
-		"time_estimate": t.TimeEstimate,
-		"assigned_to":   t.AssignedTo,
+		"task_id":       c.ID,
+		"mitigation_id": c.MitigationID,
+		"name":          c.Name,
+		"description":   c.Description,
+		"state":         c.State,
+		"time_estimate": c.TimeEstimate,
+		"assigned_to":   c.AssignedToID,
+		"created_at":    c.CreatedAt,
+		"updated_at":    c.UpdatedAt,
+		"version":       0,
 	}
 	_, err := conn.Exec(ctx, q, args)
 	return err
 }
 
-func (t *Tasks) LoadByControlID(
+func (c *Tasks) LoadByMitigationID(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
-	controlID gid.GID,
+	mitigationID gid.GID,
 	cursor *page.Cursor[TaskOrderField],
 ) error {
 	q := `
 SELECT
     id,
-    control_id,
+    mitigation_id,
     name,
     description,
     state,
-	time_estimate,
-    content_ref,
+    time_estimate,
+    assigned_to,
     created_at,
     updated_at,
-    version,
-	assigned_to
+    version
 FROM
     tasks
 WHERE
     %s
-    AND control_id = @control_id
+    AND mitigation_id = @mitigation_id
     AND %s
 `
-
 	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
 
-	args := pgx.StrictNamedArgs{"control_id": controlID}
+	args := pgx.StrictNamedArgs{"mitigation_id": mitigationID}
 	maps.Copy(args, scope.SQLArguments())
 	maps.Copy(args, cursor.SQLArguments())
 
@@ -207,40 +201,44 @@ WHERE
 		return fmt.Errorf("cannot collect tasks: %w", err)
 	}
 
-	*t = tasks
+	*c = tasks
 
 	return nil
 }
 
-func (t *Task) Update(
+func (c *Task) Update(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
 	params UpdateTaskParams,
 ) error {
 	q := `
-UPDATE tasks
-SET
+UPDATE tasks SET
     name = COALESCE(@name, name),
     description = COALESCE(@description, description),
     state = COALESCE(@state, state),
-	time_estimate = COALESCE(@time_estimate, time_estimate),
+    time_estimate = COALESCE(@time_estimate, time_estimate),
     updated_at = @updated_at,
     version = version + 1
-WHERE
-    %s
+WHERE %s
     AND id = @task_id
     AND version = @expected_version
-RETURNING
-	state,
-	time_estimate,
-	updated_at,
-    version;
+RETURNING 
+    id,
+    mitigation_id,
+    name,
+    description,
+    state,
+    time_estimate,
+    assigned_to,
+    created_at,
+    updated_at,
+    version
 `
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	args := pgx.StrictNamedArgs{
-		"task_id":          t.ID,
+	args := pgx.NamedArgs{
+		"task_id":          c.ID,
 		"expected_version": params.ExpectedVersion,
 		"name":             params.Name,
 		"description":      params.Description,
@@ -248,75 +246,235 @@ RETURNING
 		"time_estimate":    params.TimeEstimate,
 		"updated_at":       time.Now(),
 	}
+
 	maps.Copy(args, scope.SQLArguments())
 
-	err := conn.QueryRow(ctx, q, args).Scan(&t.State, &t.TimeEstimate, &t.UpdatedAt, &t.Version)
-	return err
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query tasks: %w", err)
+	}
+
+	task, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Task])
+	if err != nil {
+		return fmt.Errorf("cannot collect tasks: %w", err)
+	}
+
+	*c = task
+
+	return nil
 }
 
-func (t *Task) AssignTo(
+func (c *Task) AssignTo(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
-	assignedTo gid.GID,
+	assignTo gid.GID,
 ) error {
 	q := `
-UPDATE tasks
-SET
-    assigned_to = @assigned_to
-WHERE
-    %s
+UPDATE tasks SET
+    assigned_to = @assigned_to,
+    updated_at = @updated_at,
+    version = version + 1
+WHERE %s
     AND id = @task_id
+RETURNING 
+    id,
+    mitigation_id,
+    name,
+    description,
+    state,
+    time_estimate,
+    assigned_to,
+    created_at,
+    updated_at,
+    version
 `
-
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	args := pgx.StrictNamedArgs{
-		"task_id":     t.ID,
-		"assigned_to": assignedTo,
+	args := pgx.NamedArgs{
+		"task_id":     c.ID,
+		"assigned_to": assignTo,
+		"updated_at":  time.Now(),
 	}
+
 	maps.Copy(args, scope.SQLArguments())
 
-	_, err := conn.Exec(ctx, q, args)
-	return err
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query tasks: %w", err)
+	}
+
+	task, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Task])
+	if err != nil {
+		return fmt.Errorf("cannot collect tasks: %w", err)
+	}
+
+	*c = task
+
+	return nil
 }
 
-func (t *Task) Unassign(
+func (c *Task) Unassign(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
 ) error {
 	q := `
-UPDATE tasks
-SET
-    assigned_to = NULL
-WHERE
-    %s
+UPDATE tasks SET
+    assigned_to = NULL,
+    updated_at = @updated_at,
+    version = version + 1
+WHERE %s
     AND id = @task_id
+RETURNING 
+    id,
+    mitigation_id,
+    name,
+    description,
+    state,
+    time_estimate,
+    assigned_to,
+    created_at,
+    updated_at,
+    version
 `
-
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	args := pgx.StrictNamedArgs{
-		"task_id": t.ID,
+	args := pgx.NamedArgs{
+		"task_id":    c.ID,
+		"updated_at": time.Now(),
 	}
+
 	maps.Copy(args, scope.SQLArguments())
 
-	_, err := conn.Exec(ctx, q, args)
-	return err
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query tasks: %w", err)
+	}
+
+	task, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Task])
+	if err != nil {
+		return fmt.Errorf("cannot collect tasks: %w", err)
+	}
+
+	*c = task
+
+	return nil
 }
 
-func (t *Task) Delete(
+func (c *Task) Delete(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
 ) error {
-	q := `DELETE FROM tasks WHERE %s AND id = @task_id`
+	q := `
+DELETE FROM tasks
+WHERE %s
+    AND id = @task_id
+`
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	args := pgx.StrictNamedArgs{"task_id": t.ID}
+	args := pgx.NamedArgs{
+		"task_id": c.ID,
+	}
+
 	maps.Copy(args, scope.SQLArguments())
 
 	_, err := conn.Exec(ctx, q, args)
-	return err
+	if err != nil {
+		return fmt.Errorf("cannot delete task: %w", err)
+	}
+
+	return nil
+}
+
+// Helper functions for task management
+
+var (
+	ErrAssignTaskFailed   = fmt.Errorf("failed to assign task")
+	ErrUnassignTaskFailed = fmt.Errorf("failed to unassign task")
+	ErrUpdateTaskFailed   = fmt.Errorf("failed to update task")
+	ErrDeleteTaskFailed   = fmt.Errorf("failed to delete task")
+)
+
+type TaskUpdate struct {
+	Name         *string
+	Description  *string
+	State        *TaskState
+	TimeEstimate *time.Duration
+}
+
+func AssignTask(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	taskID gid.GID,
+	assignedToID gid.GID,
+) (*Task, error) {
+	task := &Task{ID: taskID}
+	if err := task.LoadByID(ctx, conn, scope, taskID); err != nil {
+		return nil, ErrAssignTaskFailed
+	}
+
+	if err := task.AssignTo(ctx, conn, scope, assignedToID); err != nil {
+		return nil, ErrAssignTaskFailed
+	}
+
+	return task, nil
+}
+
+func UnassignTask(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	taskID gid.GID,
+) (*Task, error) {
+	task := &Task{ID: taskID}
+	if err := task.LoadByID(ctx, conn, scope, taskID); err != nil {
+		return nil, ErrUnassignTaskFailed
+	}
+
+	if err := task.Unassign(ctx, conn, scope); err != nil {
+		return nil, ErrUnassignTaskFailed
+	}
+
+	return task, nil
+}
+
+func UpdateTask(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	taskID gid.GID,
+	expectedVersion int,
+	updates *TaskUpdate,
+) (*Task, error) {
+	task := &Task{ID: taskID}
+
+	if err := task.Update(ctx, conn, scope, UpdateTaskParams{
+		ExpectedVersion: expectedVersion,
+		Name:            updates.Name,
+		Description:     updates.Description,
+		State:           updates.State,
+		TimeEstimate:    updates.TimeEstimate,
+	}); err != nil {
+		return nil, ErrUpdateTaskFailed
+	}
+
+	return task, nil
+}
+
+func DeleteTask(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	taskID gid.GID,
+) error {
+	task := &Task{ID: taskID}
+
+	if err := task.Delete(ctx, conn, scope); err != nil {
+		return ErrDeleteTaskFailed
+	}
+
+	return nil
 }

pkg/probo/framework_service.go

@@ -53,12 +53,12 @@ type (
 				Description string `json:"description"`
 				Version     string `json:"version"`
 				Controls    []struct {
-					ContentRef  string                     `json:"content-ref"`
-					Category    string                     `json:"category"`
-					Importance  coredata.ControlImportance `json:"importance"`
-					Standards   []string                   `json:"standards"`
-					Name        string                     `json:"name"`
-					Description string                     `json:"description"`
+					ContentRef  string                        `json:"content-ref"`
+					Category    string                        `json:"category"`
+					Importance  coredata.MitigationImportance `json:"importance"`
+					Standards   []string                      `json:"standards"`
+					Name        string                        `json:"name"`
+					Description string                        `json:"description"`
 					Tasks       []struct {
 						Name         string `json:"name"`
 						Description  string `json:"description"`
@@ -212,31 +212,31 @@ func (s FrameworkService) Import(
 		UpdatedAt:      now,
 	}
 
-	importedControls := coredata.Controls{}
+	importedMitigations := coredata.Mitigations{}
 	importedTasks := coredata.Tasks{}
-	for _, control := range req.Data.Framework.Controls {
-		controlID, err := gid.NewGID(organizationID.TenantID(), coredata.ControlEntityType)
+	for _, mitigation := range req.Data.Framework.Controls {
+		controlID, err := gid.NewGID(organizationID.TenantID(), coredata.MitigationEntityType)
 		if err != nil {
 			return nil, fmt.Errorf("cannot create global id: %w", err)
 		}
 
-		importedControl := &coredata.Control{
+		importedControl := &coredata.Mitigation{
 			ID:          controlID,
 			FrameworkID: frameworkID,
-			Category:    control.Category,
-			Importance:  coredata.ControlImportance(control.Importance),
-			Name:        control.Name,
-			Description: control.Description,
-			State:       coredata.ControlStateNotStarted,
-			ContentRef:  control.ContentRef,
+			Category:    mitigation.Category,
+			Importance:  coredata.MitigationImportance(mitigation.Importance),
+			Name:        mitigation.Name,
+			Description: mitigation.Description,
+			State:       coredata.MitigationStateNotStarted,
+			ContentRef:  mitigation.ContentRef,
 			CreatedAt:   now,
 			UpdatedAt:   now,
-			Standards:   control.Standards,
+			Standards:   mitigation.Standards,
 		}
 
-		importedControls = append(importedControls, importedControl)
+		importedMitigations = append(importedMitigations, importedControl)
 
-		for _, task := range control.Tasks {
+		for _, task := range mitigation.Tasks {
 			taskID, err := gid.NewGID(organizationID.TenantID(), coredata.TaskEntityType)
 			if err != nil {
 				return nil, fmt.Errorf("cannot create global id: %w", err)
@@ -249,11 +249,10 @@ func (s FrameworkService) Import(
 
 			importedTasks = append(importedTasks, &coredata.Task{
 				ID:           taskID,
-				ControlID:    controlID,
+				MitigationID: controlID,
 				Name:         task.Name,
 				State:        coredata.TaskStateTodo,
 				Description:  task.Description,
-				ContentRef:   "",
 				CreatedAt:    now,
 				UpdatedAt:    now,
 				TimeEstimate: timeEstimate,
@@ -270,9 +269,9 @@ func (s FrameworkService) Import(
 				return fmt.Errorf("cannot insert framework: %w", err)
 			}
 
-			for _, importedControl := range importedControls {
-				if err := importedControl.Insert(ctx, tx, s.svc.scope); err != nil {
-					return fmt.Errorf("cannot insert control: %w", err)
+			for _, importedMitigation := range importedMitigations {
+				if err := importedMitigation.Insert(ctx, tx, s.svc.scope); err != nil {
+					return fmt.Errorf("cannot insert mitigation: %w", err)
 				}
 			}
 

pkg/probo/mitigation_service.go

@@ -26,40 +26,39 @@ import (
 )
 
 type (
-	ControlService struct {
+	MitigationService struct {
 		svc *TenantService
 	}
 
-	CreateControlRequest struct {
+	CreateMitigationRequest struct {
 		FrameworkID gid.GID
 		Name        string
 		Description string
-		ContentRef  string
 		Category    string
-		Importance  coredata.ControlImportance
+		Importance  coredata.MitigationImportance
 	}
 
-	UpdateControlRequest struct {
+	UpdateMitigationRequest struct {
 		ID              gid.GID
 		ExpectedVersion int
 		Name            *string
 		Description     *string
 		Category        *string
-		State           *coredata.ControlState
-		Importance      *coredata.ControlImportance
+		State           *coredata.MitigationState
+		Importance      *coredata.MitigationImportance
 	}
 )
 
-func (s ControlService) Get(
+func (s MitigationService) Get(
 	ctx context.Context,
-	controlID gid.GID,
-) (*coredata.Control, error) {
-	control := &coredata.Control{}
+	mitigationID gid.GID,
+) (*coredata.Mitigation, error) {
+	mitigation := &coredata.Mitigation{}
 
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(conn pg.Conn) error {
-			return control.LoadByID(ctx, conn, s.svc.scope, controlID)
+			return mitigation.LoadByID(ctx, conn, s.svc.scope, mitigationID)
 		},
 	)
 
@@ -67,14 +66,14 @@ func (s ControlService) Get(
 		return nil, err
 	}
 
-	return control, nil
+	return mitigation, nil
 }
 
-func (s ControlService) Update(
+func (s MitigationService) Update(
 	ctx context.Context,
-	req UpdateControlRequest,
-) (*coredata.Control, error) {
-	params := coredata.UpdateControlParams{
+	req UpdateMitigationRequest,
+) (*coredata.Mitigation, error) {
+	params := coredata.UpdateMitigationParams{
 		ExpectedVersion: req.ExpectedVersion,
 		Name:            req.Name,
 		Description:     req.Description,
@@ -83,31 +82,31 @@ func (s ControlService) Update(
 		Importance:      req.Importance,
 	}
 
-	control := &coredata.Control{ID: req.ID}
+	mitigation := &coredata.Mitigation{ID: req.ID}
 
 	err := s.svc.pg.WithTx(
 		ctx,
 		func(conn pg.Conn) error {
-			return control.Update(ctx, conn, s.svc.scope, params)
+			return mitigation.Update(ctx, conn, s.svc.scope, params)
 		})
 	if err != nil {
 		return nil, err
 	}
 
-	return control, nil
+	return mitigation, nil
 }
 
-func (s ControlService) ListForFrameworkID(
+func (s MitigationService) ListForFrameworkID(
 	ctx context.Context,
 	frameworkID gid.GID,
-	cursor *page.Cursor[coredata.ControlOrderField],
-) (*page.Page[*coredata.Control, coredata.ControlOrderField], error) {
-	var controls coredata.Controls
+	cursor *page.Cursor[coredata.MitigationOrderField],
+) (*page.Page[*coredata.Mitigation, coredata.MitigationOrderField], error) {
+	var mitigations coredata.Mitigations
 
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(conn pg.Conn) error {
-			return controls.LoadByFrameworkID(
+			return mitigations.LoadByFrameworkID(
 				ctx,
 				conn,
 				s.svc.scope,
@@ -121,30 +120,29 @@ func (s ControlService) ListForFrameworkID(
 		return nil, err
 	}
 
-	return page.NewPage(controls, cursor), nil
+	return page.NewPage(mitigations, cursor), nil
 }
 
-func (s ControlService) Create(
+func (s MitigationService) Create(
 	ctx context.Context,
-	req CreateControlRequest,
-) (*coredata.Control, error) {
+	req CreateMitigationRequest,
+) (*coredata.Mitigation, error) {
 	now := time.Now()
-	controlID, err := gid.NewGID(s.svc.scope.GetTenantID(), coredata.ControlEntityType)
+	mitigationID, err := gid.NewGID(s.svc.scope.GetTenantID(), coredata.MitigationEntityType)
 	if err != nil {
-		return nil, fmt.Errorf("cannot create control global id: %w", err)
+		return nil, fmt.Errorf("cannot create mitigation global id: %w", err)
 	}
 
 	framework := &coredata.Framework{}
-	control := &coredata.Control{
-		ID:          controlID,
+	mitigation := &coredata.Mitigation{
+		ID:          mitigationID,
 		FrameworkID: req.FrameworkID,
 		Name:        req.Name,
 		Description: req.Description,
 		Category:    req.Category,
-		State:       coredata.ControlStateNotStarted,
-		Importance:  req.Importance,
-		ContentRef:  req.ContentRef,
+		State:       coredata.MitigationStateNotStarted,
 		Standards:   []string{},
+		Importance:  req.Importance,
 		CreatedAt:   now,
 		UpdatedAt:   now,
 	}
@@ -156,8 +154,8 @@ func (s ControlService) Create(
 				return fmt.Errorf("cannot load framework %q: %w", req.FrameworkID, err)
 			}
 
-			if err := control.Insert(ctx, conn, s.svc.scope); err != nil {
-				return fmt.Errorf("cannot insert control: %w", err)
+			if err := mitigation.Insert(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot insert mitigation: %w", err)
 			}
 
 			return nil
@@ -168,5 +166,5 @@ func (s ControlService) Create(
 		return nil, err
 	}
 
-	return control, nil
+	return mitigation, nil
 }

pkg/probo/organization_service.go

@@ -66,7 +66,7 @@ func (s OrganizationService) Create(
 		ctx,
 		func(conn pg.Conn) error {
 			if err := organization.Insert(ctx, conn); err != nil {
-				return fmt.Errorf("cannot insert control: %w", err)
+				return fmt.Errorf("cannot insert mitigation: %w", err)
 			}
 
 			return nil

pkg/probo/service.go

@@ -32,20 +32,18 @@ type (
 	}
 
 	TenantService struct {
-		pg     *pg.Client
-		s3     *s3.Client
-		bucket string
-
-		scope coredata.Scoper
-
-		Policies      *PolicyService
-		Controls      *ControlService
-		Evidences     *EvidenceService
+		pg            *pg.Client
+		s3            *s3.Client
+		bucket        string
+		scope         coredata.Scoper
 		Frameworks    *FrameworkService
+		Mitigations   *MitigationService
 		Tasks         *TaskService
+		Evidences     *EvidenceService
 		Peoples       *PeopleService
-		Organizations *OrganizationService
 		Vendors       *VendorService
+		Policies      *PolicyService
+		Organizations *OrganizationService
 	}
 )
 
@@ -76,14 +74,13 @@ func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 		scope:  coredata.NewScope(tenantID),
 	}
 
-	tenantService.Policies = &PolicyService{svc: tenantService}
-	tenantService.Controls = &ControlService{svc: tenantService}
-	tenantService.Evidences = &EvidenceService{svc: tenantService}
 	tenantService.Frameworks = &FrameworkService{svc: tenantService}
+	tenantService.Mitigations = &MitigationService{svc: tenantService}
 	tenantService.Tasks = &TaskService{svc: tenantService}
+	tenantService.Evidences = &EvidenceService{svc: tenantService}
 	tenantService.Peoples = &PeopleService{svc: tenantService}
-	tenantService.Organizations = &OrganizationService{svc: tenantService}
 	tenantService.Vendors = &VendorService{svc: tenantService}
-
+	tenantService.Policies = &PolicyService{svc: tenantService}
+	tenantService.Organizations = &OrganizationService{svc: tenantService}
 	return tenantService
 }

pkg/probo/task_service.go

@@ -16,6 +16,7 @@ package probo
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"time"
 
@@ -31,16 +32,15 @@ type (
 	}
 
 	CreateTaskRequest struct {
-		ControlID    gid.GID
+		MitigationID gid.GID
 		Name         string
-		ContentRef   string
 		Description  string
 		TimeEstimate *time.Duration
-		AssignedTo   *gid.GID
+		AssignedToID *gid.GID
 	}
 
 	UpdateTaskRequest struct {
-		ID              gid.GID
+		TaskID          gid.GID
 		ExpectedVersion int
 		Name            *string
 		Description     *string
@@ -53,173 +53,41 @@ func (s TaskService) Create(
 	ctx context.Context,
 	req CreateTaskRequest,
 ) (*coredata.Task, error) {
-	now := time.Now()
-	taskID, err := gid.NewGID(s.svc.scope.GetTenantID(), coredata.TaskEntityType)
-	if err != nil {
-		return nil, fmt.Errorf("cannot create task global id: %w", err)
-	}
-
-	control := &coredata.Control{}
-	task := &coredata.Task{
-		ID:           taskID,
-		ControlID:    req.ControlID,
-		Name:         req.Name,
-		ContentRef:   req.ContentRef,
-		State:        coredata.TaskStateTodo,
-		Description:  req.Description,
-		TimeEstimate: req.TimeEstimate,
-		AssignedTo:   req.AssignedTo,
-		CreatedAt:    now,
-		UpdatedAt:    now,
-	}
-
-	err = s.svc.pg.WithTx(
-		ctx,
-		func(conn pg.Conn) error {
-			if err := control.LoadByID(ctx, conn, s.svc.scope, req.ControlID); err != nil {
-				return fmt.Errorf("cannot laod control %q: %w", req.ControlID, err)
-			}
-
-			if err := task.Insert(ctx, conn, s.svc.scope); err != nil {
-				return fmt.Errorf("cannot insert task: %w", err)
-			}
-
-			return nil
-		},
-	)
-
-	if err != nil {
-		return nil, err
-	}
-
-	return task, nil
-}
-
-func (s TaskService) Assign(
-	ctx context.Context,
-	taskID gid.GID,
-	assignedTo gid.GID,
-) (*coredata.Task, error) {
-	task := &coredata.Task{ID: taskID}
+	mitigation := &coredata.Mitigation{}
 
 	err := s.svc.pg.WithTx(
 		ctx,
 		func(conn pg.Conn) error {
-			if err := task.LoadByID(ctx, conn, s.svc.scope, taskID); err != nil {
-				return fmt.Errorf("cannot load task %q: %w", taskID, err)
+			if err := mitigation.LoadByID(ctx, conn, s.svc.scope, req.MitigationID); err != nil {
+				return fmt.Errorf("cannot load mitigation %q: %w", req.MitigationID, err)
 			}
 
-			task.AssignedTo = &assignedTo
-
-			if err := task.AssignTo(ctx, conn, s.svc.scope, assignedTo); err != nil {
-				return fmt.Errorf("cannot assign task %q to %q: %w", taskID, assignedTo, err)
+			now := time.Now()
+			taskID, err := gid.NewGID(s.svc.scope.GetTenantID(), coredata.TaskEntityType)
+			if err != nil {
+				return fmt.Errorf("cannot generate id: %w", err)
 			}
 
-			return nil
-		},
-	)
-
-	if err != nil {
-		return nil, err
-	}
-
-	return task, nil
-}
-
-func (s TaskService) Unassign(
-	ctx context.Context,
-	taskID gid.GID,
-) (*coredata.Task, error) {
-	task := &coredata.Task{ID: taskID}
-
-	err := s.svc.pg.WithTx(
-		ctx,
-		func(conn pg.Conn) error {
-			if err := task.LoadByID(ctx, conn, s.svc.scope, taskID); err != nil {
-				return fmt.Errorf("cannot load task %q: %w", taskID, err)
+			task := &coredata.Task{
+				ID:           taskID,
+				MitigationID: req.MitigationID,
+				Name:         req.Name,
+				Description:  req.Description,
+				TimeEstimate: req.TimeEstimate,
+				AssignedToID: req.AssignedToID,
+				State:        coredata.TaskStateTodo,
+				CreatedAt:    now,
+				UpdatedAt:    now,
 			}
 
-			task.AssignedTo = nil
-
-			if err := task.Unassign(ctx, conn, s.svc.scope); err != nil {
-				return fmt.Errorf("cannot unassign task %q: %w", taskID, err)
-			}
-
-			return nil
+			return task.Insert(ctx, conn, s.svc.scope)
 		},
 	)
-
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("cannot create task: %w", err)
 	}
 
-	return task, nil
-}
-
-func (s TaskService) Update(
-	ctx context.Context,
-	req UpdateTaskRequest,
-) (*coredata.Task, error) {
-	params := coredata.UpdateTaskParams{
-		ExpectedVersion: req.ExpectedVersion,
-		Name:            req.Name,
-		Description:     req.Description,
-		State:           req.State,
-		TimeEstimate:    req.TimeEstimate,
-	}
-
-	task := &coredata.Task{ID: req.ID}
-
-	err := s.svc.pg.WithTx(
-		ctx,
-		func(conn pg.Conn) error {
-			return task.Update(ctx, conn, s.svc.scope, params)
-		})
-	if err != nil {
-		return nil, err
-	}
-
-	return task, nil
-}
-
-func (s TaskService) ListForControlID(
-	ctx context.Context,
-	controlID gid.GID,
-	cursor *page.Cursor[coredata.TaskOrderField],
-) (*page.Page[*coredata.Task, coredata.TaskOrderField], error) {
-	var tasks coredata.Tasks
-
-	err := s.svc.pg.WithConn(
-		ctx,
-		func(conn pg.Conn) error {
-			return tasks.LoadByControlID(
-				ctx,
-				conn,
-				s.svc.scope,
-				controlID,
-				cursor,
-			)
-		},
-	)
-
-	if err != nil {
-		return nil, err
-	}
-
-	return page.NewPage(tasks, cursor), nil
-}
-
-func (s TaskService) Delete(
-	ctx context.Context,
-	taskID gid.GID,
-) error {
-	task := coredata.Task{ID: taskID}
-	return s.svc.pg.WithConn(
-		ctx,
-		func(conn pg.Conn) error {
-			return task.Delete(ctx, conn, s.svc.scope)
-		},
-	)
+	return s.Get(ctx, req.MitigationID)
 }
 
 func (s TaskService) Get(
@@ -234,10 +102,140 @@ func (s TaskService) Get(
 			return task.LoadByID(ctx, conn, s.svc.scope, taskID)
 		},
 	)
-
 	if err != nil {
 		return nil, err
 	}
 
 	return task, nil
 }
+
+func (s TaskService) Assign(
+	ctx context.Context,
+	taskID gid.GID,
+	assignedToID gid.GID,
+) (*coredata.Task, error) {
+	task := &coredata.Task{}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			var assignErr error
+			task, assignErr = coredata.AssignTask(ctx, conn, s.svc.scope, taskID, assignedToID)
+			return assignErr
+		},
+	)
+	if err != nil {
+		if errors.Is(err, coredata.ErrAssignTaskFailed) {
+			return nil, errors.New("failed to assign task, please try again")
+		}
+		return nil, err
+	}
+
+	return task, nil
+}
+
+func (s TaskService) Unassign(
+	ctx context.Context,
+	taskID gid.GID,
+) (*coredata.Task, error) {
+	task := &coredata.Task{}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			var unassignErr error
+			task, unassignErr = coredata.UnassignTask(ctx, conn, s.svc.scope, taskID)
+			return unassignErr
+		},
+	)
+	if err != nil {
+		if errors.Is(err, coredata.ErrUnassignTaskFailed) {
+			return nil, errors.New("failed to unassign task, please try again")
+		}
+		return nil, err
+	}
+
+	return task, nil
+}
+
+func (s TaskService) Update(
+	ctx context.Context,
+	req UpdateTaskRequest,
+) (*coredata.Task, error) {
+	task := &coredata.Task{}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			var updateErr error
+			task, updateErr = coredata.UpdateTask(
+				ctx,
+				conn,
+				s.svc.scope,
+				req.TaskID,
+				req.ExpectedVersion,
+				&coredata.TaskUpdate{
+					Name:         req.Name,
+					Description:  req.Description,
+					State:        req.State,
+					TimeEstimate: req.TimeEstimate,
+				},
+			)
+			return updateErr
+		},
+	)
+	if err != nil {
+		if errors.Is(err, coredata.ErrUpdateTaskFailed) {
+			return nil, errors.New("failed to update task, please try again")
+		}
+		return nil, err
+	}
+
+	return task, nil
+}
+
+func (s TaskService) Delete(
+	ctx context.Context,
+	taskID gid.GID,
+) error {
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			return coredata.DeleteTask(ctx, conn, s.svc.scope, taskID)
+		},
+	)
+	if err != nil {
+		if errors.Is(err, coredata.ErrDeleteTaskFailed) {
+			return errors.New("failed to delete task, please try again")
+		}
+		return err
+	}
+
+	return nil
+}
+
+func (s TaskService) ListForMitigationID(
+	ctx context.Context,
+	mitigationID gid.GID,
+	cursor *page.Cursor[coredata.TaskOrderField],
+) (*page.Page[*coredata.Task, coredata.TaskOrderField], error) {
+	var tasks coredata.Tasks
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return tasks.LoadByMitigationID(
+				ctx,
+				conn,
+				s.svc.scope,
+				mitigationID,
+				cursor,
+			)
+		},
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(tasks, cursor), nil
+}

pkg/server/api/console/v1/schema.graphql

@@ -21,23 +21,23 @@ interface Node {
   id: ID!
 }
 
-enum ControlState
-  @goModel(model: "github.com/getprobo/probo/pkg/coredata.ControlState") {
+enum MitigationState
+  @goModel(model: "github.com/getprobo/probo/pkg/coredata.MitigationState") {
   NOT_STARTED
     @goEnum(
-      value: "github.com/getprobo/probo/pkg/coredata.ControlStateNotStarted"
+      value: "github.com/getprobo/probo/pkg/coredata.MitigationStateNotStarted"
     )
   IN_PROGRESS
     @goEnum(
-      value: "github.com/getprobo/probo/pkg/coredata.ControlStateInProgress"
+      value: "github.com/getprobo/probo/pkg/coredata.MitigationStateInProgress"
     )
   NOT_APPLICABLE
     @goEnum(
-      value: "github.com/getprobo/probo/pkg/coredata.ControlStateNotApplicable"
+      value: "github.com/getprobo/probo/pkg/coredata.MitigationStateNotApplicable"
     )
   IMPLEMENTED
     @goEnum(
-      value: "github.com/getprobo/probo/pkg/coredata.ControlStateImplemented"
+      value: "github.com/getprobo/probo/pkg/coredata.MitigationStateImplemented"
     )
 }
 
@@ -75,19 +75,21 @@ enum PeopleKind
     )
 }
 
-enum ControlImportance
-  @goModel(model: "github.com/getprobo/probo/pkg/coredata.ControlImportance") {
+enum MitigationImportance
+  @goModel(
+    model: "github.com/getprobo/probo/pkg/coredata.MitigationImportance"
+  ) {
   MANDATORY
     @goEnum(
-      value: "github.com/getprobo/probo/pkg/coredata.ControlImportanceMandatory"
+      value: "github.com/getprobo/probo/pkg/coredata.MitigationImportanceMandatory"
     )
   PREFERRED
     @goEnum(
-      value: "github.com/getprobo/probo/pkg/coredata.ControlImportancePreferred"
+      value: "github.com/getprobo/probo/pkg/coredata.MitigationImportancePreferred"
     )
   ADVANCED
     @goEnum(
-      value: "github.com/getprobo/probo/pkg/coredata.ControlImportanceAdvanced"
+      value: "github.com/getprobo/probo/pkg/coredata.MitigationImportanceAdvanced"
     )
 }
 
@@ -187,8 +189,10 @@ enum FrameworkOrderField
   NAME
 }
 
-enum ControlOrderField
-  @goModel(model: "github.com/getprobo/probo/pkg/coredata.ControlOrderField") {
+enum MitigationOrderField
+  @goModel(
+    model: "github.com/getprobo/probo/pkg/coredata.MitigationOrderField"
+  ) {
   NAME
 }
 
@@ -231,12 +235,12 @@ input FrameworkOrder
   field: FrameworkOrderField!
 }
 
-input ControlOrder
+input MitigationOrder
   @goModel(
-    model: "github.com/getprobo/probo/pkg/server/api/console/v1/types.ControlOrderBy"
+    model: "github.com/getprobo/probo/pkg/server/api/console/v1/types.MitigationOrderBy"
   ) {
   direction: OrderDirection!
-  field: ControlOrderField!
+  field: MitigationOrderField!
 }
 
 input TaskOrder
@@ -327,36 +331,36 @@ type Framework implements Node {
   name: String!
   description: String!
 
-  controls(
+  mitigations(
     first: Int
     after: CursorKey
     last: Int
     before: CursorKey
-    orderBy: ControlOrder
-  ): ControlConnection! @goField(forceResolver: true)
+    orderBy: MitigationOrder
+  ): MitigationConnection! @goField(forceResolver: true)
 
   createdAt: Datetime!
   updatedAt: Datetime!
 }
 
-type ControlConnection {
-  edges: [ControlEdge!]!
+type MitigationConnection {
+  edges: [MitigationEdge!]!
   pageInfo: PageInfo!
 }
 
-type ControlEdge {
+type MitigationEdge {
   cursor: CursorKey!
-  node: Control!
+  node: Mitigation!
 }
 
-type Control implements Node {
+type Mitigation implements Node {
   id: ID!
   version: Int!
   category: String!
   name: String!
   description: String!
-  state: ControlState!
-  importance: ControlImportance!
+  state: MitigationState!
+  importance: MitigationImportance!
 
   tasks(
     first: Int
@@ -503,8 +507,8 @@ type Mutation {
   updateFramework(input: UpdateFrameworkInput!): UpdateFrameworkPayload!
   importFramework(input: ImportFrameworkInput!): ImportFrameworkPayload!
 
-  createControl(input: CreateControlInput!): CreateControlPayload!
-  updateControl(input: UpdateControlInput!): UpdateControlPayload!
+  createMitigation(input: CreateMitigationInput!): CreateMitigationPayload!
+  updateMitigation(input: UpdateMitigationInput!): UpdateMitigationPayload!
 
   uploadEvidence(input: UploadEvidenceInput!): UploadEvidencePayload!
   deleteEvidence(input: DeleteEvidenceInput!): DeleteEvidencePayload!
@@ -639,7 +643,7 @@ type DeleteOrganizationPayload {
 }
 
 input CreateTaskInput {
-  controlId: ID!
+  mitigationId: ID!
   name: String!
   description: String!
   timeEstimate: Duration
@@ -675,16 +679,16 @@ type CreateFrameworkPayload {
   frameworkEdge: FrameworkEdge!
 }
 
-input CreateControlInput {
+input CreateMitigationInput {
   frameworkId: ID!
   name: String!
   description: String!
   category: String!
-  importance: ControlImportance!
+  importance: MitigationImportance!
 }
 
-type CreateControlPayload {
-  controlEdge: ControlEdge!
+type CreateMitigationPayload {
+  mitigationEdge: MitigationEdge!
 }
 
 type UpdateFrameworkPayload {
@@ -699,18 +703,18 @@ type UpdatePeoplePayload {
   people: People!
 }
 
-input UpdateControlInput {
+input UpdateMitigationInput {
   id: ID!
   expectedVersion: Int!
   name: String
   description: String
   category: String
-  state: ControlState
-  importance: ControlImportance
+  state: MitigationState
+  importance: MitigationImportance
 }
 
-type UpdateControlPayload {
-  control: Control!
+type UpdateMitigationPayload {
+  mitigation: Mitigation!
 }
 
 input UploadEvidenceInput {

pkg/server/api/console/v1/types/mitigation.go

@@ -20,31 +20,31 @@ import (
 )
 
 type (
-	ControlOrderBy OrderBy[coredata.ControlOrderField]
+	MitigationOrderBy OrderBy[coredata.MitigationOrderField]
 )
 
-func NewControlConnection(p *page.Page[*coredata.Control, coredata.ControlOrderField]) *ControlConnection {
-	var edges = make([]*ControlEdge, len(p.Data))
+func NewMitigationConnection(p *page.Page[*coredata.Mitigation, coredata.MitigationOrderField]) *MitigationConnection {
+	var edges = make([]*MitigationEdge, len(p.Data))
 
 	for i := range edges {
-		edges[i] = NewControlEdge(p.Data[i], p.Cursor.OrderBy.Field)
+		edges[i] = NewMitigationEdge(p.Data[i], p.Cursor.OrderBy.Field)
 	}
 
-	return &ControlConnection{
+	return &MitigationConnection{
 		Edges:    edges,
 		PageInfo: NewPageInfo(p),
 	}
 }
 
-func NewControlEdge(c *coredata.Control, orderBy coredata.ControlOrderField) *ControlEdge {
-	return &ControlEdge{
+func NewMitigationEdge(c *coredata.Mitigation, orderBy coredata.MitigationOrderField) *MitigationEdge {
+	return &MitigationEdge{
 		Cursor: c.CursorKey(orderBy),
-		Node:   NewControl(c),
+		Node:   NewMitigation(c),
 	}
 }
 
-func NewControl(c *coredata.Control) *Control {
-	return &Control{
+func NewMitigation(c *coredata.Mitigation) *Mitigation {
+	return &Mitigation{
 		ID:          c.ID,
 		Version:     c.Version,
 		Category:    c.Category,

pkg/server/api/console/v1/types/types.go

@@ -36,44 +36,6 @@ type ConfirmEmailPayload struct {
 	Success bool `json:"success"`
 }
 
-type Control struct {
-	ID          gid.GID                    `json:"id"`
-	Version     int                        `json:"version"`
-	Category    string                     `json:"category"`
-	Name        string                     `json:"name"`
-	Description string                     `json:"description"`
-	State       coredata.ControlState      `json:"state"`
-	Importance  coredata.ControlImportance `json:"importance"`
-	Tasks       *TaskConnection            `json:"tasks"`
-	CreatedAt   time.Time                  `json:"createdAt"`
-	UpdatedAt   time.Time                  `json:"updatedAt"`
-}
-
-func (Control) IsNode()             {}
-func (this Control) GetID() gid.GID { return this.ID }
-
-type ControlConnection struct {
-	Edges    []*ControlEdge `json:"edges"`
-	PageInfo *PageInfo      `json:"pageInfo"`
-}
-
-type ControlEdge struct {
-	Cursor page.CursorKey `json:"cursor"`
-	Node   *Control       `json:"node"`
-}
-
-type CreateControlInput struct {
-	FrameworkID gid.GID                    `json:"frameworkId"`
-	Name        string                     `json:"name"`
-	Description string                     `json:"description"`
-	Category    string                     `json:"category"`
-	Importance  coredata.ControlImportance `json:"importance"`
-}
-
-type CreateControlPayload struct {
-	ControlEdge *ControlEdge `json:"controlEdge"`
-}
-
 type CreateFrameworkInput struct {
 	OrganizationID gid.GID `json:"organizationId"`
 	Name           string  `json:"name"`
@@ -84,6 +46,18 @@ type CreateFrameworkPayload struct {
 	FrameworkEdge *FrameworkEdge `json:"frameworkEdge"`
 }
 
+type CreateMitigationInput struct {
+	FrameworkID gid.GID                       `json:"frameworkId"`
+	Name        string                        `json:"name"`
+	Description string                        `json:"description"`
+	Category    string                        `json:"category"`
+	Importance  coredata.MitigationImportance `json:"importance"`
+}
+
+type CreateMitigationPayload struct {
+	MitigationEdge *MitigationEdge `json:"mitigationEdge"`
+}
+
 type CreateOrganizationInput struct {
 	Name string `json:"name"`
 }
@@ -118,7 +92,7 @@ type CreatePolicyPayload struct {
 }
 
 type CreateTaskInput struct {
-	ControlID    gid.GID        `json:"controlId"`
+	MitigationID gid.GID        `json:"mitigationId"`
 	Name         string         `json:"name"`
 	Description  string         `json:"description"`
 	TimeEstimate *time.Duration `json:"timeEstimate,omitempty"`
@@ -222,13 +196,13 @@ type EvidenceEdge struct {
 }
 
 type Framework struct {
-	ID          gid.GID            `json:"id"`
-	Version     int                `json:"version"`
-	Name        string             `json:"name"`
-	Description string             `json:"description"`
-	Controls    *ControlConnection `json:"controls"`
-	CreatedAt   time.Time          `json:"createdAt"`
-	UpdatedAt   time.Time          `json:"updatedAt"`
+	ID          gid.GID               `json:"id"`
+	Version     int                   `json:"version"`
+	Name        string                `json:"name"`
+	Description string                `json:"description"`
+	Mitigations *MitigationConnection `json:"mitigations"`
+	CreatedAt   time.Time             `json:"createdAt"`
+	UpdatedAt   time.Time             `json:"updatedAt"`
 }
 
 func (Framework) IsNode()             {}
@@ -263,6 +237,32 @@ type InviteUserPayload struct {
 	Success bool `json:"success"`
 }
 
+type Mitigation struct {
+	ID          gid.GID                       `json:"id"`
+	Version     int                           `json:"version"`
+	Category    string                        `json:"category"`
+	Name        string                        `json:"name"`
+	Description string                        `json:"description"`
+	State       coredata.MitigationState      `json:"state"`
+	Importance  coredata.MitigationImportance `json:"importance"`
+	Tasks       *TaskConnection               `json:"tasks"`
+	CreatedAt   time.Time                     `json:"createdAt"`
+	UpdatedAt   time.Time                     `json:"updatedAt"`
+}
+
+func (Mitigation) IsNode()             {}
+func (this Mitigation) GetID() gid.GID { return this.ID }
+
+type MitigationConnection struct {
+	Edges    []*MitigationEdge `json:"edges"`
+	PageInfo *PageInfo         `json:"pageInfo"`
+}
+
+type MitigationEdge struct {
+	Cursor page.CursorKey `json:"cursor"`
+	Node   *Mitigation    `json:"node"`
+}
+
 type Mutation struct {
 }
 
@@ -404,20 +404,6 @@ type UnassignTaskPayload struct {
 	Task *Task `json:"task"`
 }
 
-type UpdateControlInput struct {
-	ID              gid.GID                     `json:"id"`
-	ExpectedVersion int                         `json:"expectedVersion"`
-	Name            *string                     `json:"name,omitempty"`
-	Description     *string                     `json:"description,omitempty"`
-	Category        *string                     `json:"category,omitempty"`
-	State           *coredata.ControlState      `json:"state,omitempty"`
-	Importance      *coredata.ControlImportance `json:"importance,omitempty"`
-}
-
-type UpdateControlPayload struct {
-	Control *Control `json:"control"`
-}
-
 type UpdateFrameworkInput struct {
 	ID              gid.GID `json:"id"`
 	ExpectedVersion int     `json:"expectedVersion"`
@@ -429,6 +415,20 @@ type UpdateFrameworkPayload struct {
 	Framework *Framework `json:"framework"`
 }
 
+type UpdateMitigationInput struct {
+	ID              gid.GID                        `json:"id"`
+	ExpectedVersion int                            `json:"expectedVersion"`
+	Name            *string                        `json:"name,omitempty"`
+	Description     *string                        `json:"description,omitempty"`
+	Category        *string                        `json:"category,omitempty"`
+	State           *coredata.MitigationState      `json:"state,omitempty"`
+	Importance      *coredata.MitigationImportance `json:"importance,omitempty"`
+}
+
+type UpdateMitigationPayload struct {
+	Mitigation *Mitigation `json:"mitigation"`
+}
+
 type UpdateOrganizationInput struct {
 	OrganizationID gid.GID         `json:"organizationId"`
 	Name           *string         `json:"name,omitempty"`

pkg/server/api/console/v1/v1_resolver.go

@@ -19,31 +19,6 @@ import (
 	"github.com/vektah/gqlparser/v2/gqlerror"
 )
 
-// Tasks is the resolver for the tasks field.
-func (r *controlResolver) Tasks(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.TaskOrderBy) (*types.TaskConnection, error) {
-	svc := r.GetTenantServiceIfAuthorized(ctx, obj.ID.TenantID())
-
-	pageOrderBy := page.OrderBy[coredata.TaskOrderField]{
-		Field:     coredata.TaskOrderFieldCreatedAt,
-		Direction: page.OrderDirectionDesc,
-	}
-	if orderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.TaskOrderField]{
-			Field:     orderBy.Field,
-			Direction: orderBy.Direction,
-		}
-	}
-
-	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
-
-	page, err := svc.Tasks.ListForControlID(ctx, obj.ID, cursor)
-	if err != nil {
-		return nil, fmt.Errorf("cannot list control tasks: %w", err)
-	}
-
-	return types.NewTaskConnection(page), nil
-}
-
 // FileURL is the resolver for the fileUrl field.
 func (r *evidenceResolver) FileURL(ctx context.Context, obj *types.Evidence) (*string, error) {
 	svc := r.GetTenantServiceIfAuthorized(ctx, obj.ID.TenantID())
@@ -61,16 +36,40 @@ func (r *evidenceResolver) FileURL(ctx context.Context, obj *types.Evidence) (*s
 	return &result, nil
 }
 
-// Controls is the resolver for the controls field.
-func (r *frameworkResolver) Controls(ctx context.Context, obj *types.Framework, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy) (*types.ControlConnection, error) {
+// Mitigations is the resolver for the mitigations field.
+func (r *frameworkResolver) Mitigations(ctx context.Context, obj *types.Framework, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.MitigationOrderBy) (*types.MitigationConnection, error) {
 	svc := r.GetTenantServiceIfAuthorized(ctx, obj.ID.TenantID())
 
-	pageOrderBy := page.OrderBy[coredata.ControlOrderField]{
-		Field:     coredata.ControlOrderFieldCreatedAt,
+	pageOrderBy := page.OrderBy[coredata.MitigationOrderField]{
+		Field:     coredata.MitigationOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
 	}
 	if orderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.ControlOrderField]{
+		pageOrderBy = page.OrderBy[coredata.MitigationOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+	page, err := svc.Mitigations.ListForFrameworkID(ctx, obj.ID, cursor)
+	if err != nil {
+		return nil, fmt.Errorf("cannot list framework mitigations: %w", err)
+	}
+
+	return types.NewMitigationConnection(page), nil
+}
+
+// Tasks is the resolver for the tasks field.
+func (r *mitigationResolver) Tasks(ctx context.Context, obj *types.Mitigation, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.TaskOrderBy) (*types.TaskConnection, error) {
+	svc := r.GetTenantServiceIfAuthorized(ctx, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.TaskOrderField]{
+		Field:     coredata.TaskOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.TaskOrderField]{
 			Field:     orderBy.Field,
 			Direction: orderBy.Direction,
 		}
@@ -78,12 +77,12 @@ func (r *frameworkResolver) Controls(ctx context.Context, obj *types.Framework,
 
 	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
 
-	page, err := svc.Controls.ListForFrameworkID(ctx, obj.ID, cursor)
+	page, err := svc.Tasks.ListForMitigationID(ctx, obj.ID, cursor)
 	if err != nil {
-		return nil, fmt.Errorf("cannot list framework controls: %w", err)
+		return nil, fmt.Errorf("cannot list mitigation tasks: %w", err)
 	}
 
-	return types.NewControlConnection(page), nil
+	return types.NewTaskConnection(page), nil
 }
 
 // CreateVendor is the resolver for the createVendor field.
@@ -260,10 +259,10 @@ func (r *mutationResolver) DeleteOrganization(ctx context.Context, input types.D
 
 // CreateTask is the resolver for the createTask field.
 func (r *mutationResolver) CreateTask(ctx context.Context, input types.CreateTaskInput) (*types.CreateTaskPayload, error) {
-	svc := r.GetTenantServiceIfAuthorized(ctx, input.ControlID.TenantID())
+	svc := r.GetTenantServiceIfAuthorized(ctx, input.MitigationID.TenantID())
 
 	task, err := svc.Tasks.Create(ctx, probo.CreateTaskRequest{
-		ControlID:    input.ControlID,
+		MitigationID: input.MitigationID,
 		Name:         input.Name,
 		Description:  input.Description,
 		TimeEstimate: input.TimeEstimate,
@@ -282,7 +281,7 @@ func (r *mutationResolver) UpdateTask(ctx context.Context, input types.UpdateTas
 	svc := r.GetTenantServiceIfAuthorized(ctx, input.TaskID.TenantID())
 
 	task, err := svc.Tasks.Update(ctx, probo.UpdateTaskRequest{
-		ID:              input.TaskID,
+		TaskID:          input.TaskID,
 		ExpectedVersion: input.ExpectedVersion,
 		Name:            input.Name,
 		Description:     input.Description,
@@ -396,11 +395,11 @@ func (r *mutationResolver) ImportFramework(ctx context.Context, input types.Impo
 	}, nil
 }
 
-// CreateControl is the resolver for the createControl field.
-func (r *mutationResolver) CreateControl(ctx context.Context, input types.CreateControlInput) (*types.CreateControlPayload, error) {
+// CreateMitigation is the resolver for the createMitigation field.
+func (r *mutationResolver) CreateMitigation(ctx context.Context, input types.CreateMitigationInput) (*types.CreateMitigationPayload, error) {
 	svc := r.GetTenantServiceIfAuthorized(ctx, input.FrameworkID.TenantID())
 
-	control, err := svc.Controls.Create(ctx, probo.CreateControlRequest{
+	mitigation, err := svc.Mitigations.Create(ctx, probo.CreateMitigationRequest{
 		FrameworkID: input.FrameworkID,
 		Name:        input.Name,
 		Description: input.Description,
@@ -408,33 +407,33 @@ func (r *mutationResolver) CreateControl(ctx context.Context, input types.Create
 		Importance:  input.Importance,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("cannot create control: %w", err)
+		panic(fmt.Errorf("cannot create mitigation: %w", err))
 	}
 
-	return &types.CreateControlPayload{
-		ControlEdge: types.NewControlEdge(control, coredata.ControlOrderFieldCreatedAt),
+	return &types.CreateMitigationPayload{
+		MitigationEdge: types.NewMitigationEdge(mitigation, coredata.MitigationOrderFieldCreatedAt),
 	}, nil
 }
 
-// UpdateControl is the resolver for the updateControl field.
-func (r *mutationResolver) UpdateControl(ctx context.Context, input types.UpdateControlInput) (*types.UpdateControlPayload, error) {
+// UpdateMitigation is the resolver for the updateMitigation field.
+func (r *mutationResolver) UpdateMitigation(ctx context.Context, input types.UpdateMitigationInput) (*types.UpdateMitigationPayload, error) {
 	svc := r.GetTenantServiceIfAuthorized(ctx, input.ID.TenantID())
 
-	control, err := svc.Controls.Update(ctx, probo.UpdateControlRequest{
+	mitigation, err := svc.Mitigations.Update(ctx, probo.UpdateMitigationRequest{
 		ID:              input.ID,
 		ExpectedVersion: input.ExpectedVersion,
 		Name:            input.Name,
 		Description:     input.Description,
 		Category:        input.Category,
-		State:           input.State,
 		Importance:      input.Importance,
+		State:           input.State,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("cannot update control: %w", err)
+		panic(fmt.Errorf("cannot update mitigation: %w", err))
 	}
 
-	return &types.UpdateControlPayload{
-		Control: types.NewControl(control),
+	return &types.UpdateMitigationPayload{
+		Mitigation: types.NewMitigation(mitigation),
 	}, nil
 }
 
@@ -785,13 +784,13 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 		}
 
 		return types.NewFramework(framework), nil
-	case coredata.ControlEntityType:
-		control, err := svc.Controls.Get(ctx, id)
+	case coredata.MitigationEntityType:
+		mitigation, err := svc.Mitigations.Get(ctx, id)
 		if err != nil {
 			return nil, err
 		}
 
-		return types.NewControl(control), nil
+		return types.NewMitigation(mitigation), nil
 	case coredata.TaskEntityType:
 		task, err := svc.Tasks.Get(ctx, id)
 		if err != nil {
@@ -838,11 +837,11 @@ func (r *taskResolver) AssignedTo(ctx context.Context, obj *types.Task) (*types.
 		return nil, fmt.Errorf("cannot get task: %w", err)
 	}
 
-	if task.AssignedTo == nil {
+	if task.AssignedToID == nil {
 		return nil, nil
 	}
 
-	people, err := svc.Peoples.Get(ctx, *task.AssignedTo)
+	people, err := svc.Peoples.Get(ctx, *task.AssignedToID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot get assigned to: %w", err)
 	}
@@ -899,15 +898,15 @@ func (r *viewerResolver) Organizations(ctx context.Context, obj *types.Viewer, f
 	}, nil
 }
 
-// Control returns schema.ControlResolver implementation.
-func (r *Resolver) Control() schema.ControlResolver { return &controlResolver{r} }
-
 // Evidence returns schema.EvidenceResolver implementation.
 func (r *Resolver) Evidence() schema.EvidenceResolver { return &evidenceResolver{r} }
 
 // Framework returns schema.FrameworkResolver implementation.
 func (r *Resolver) Framework() schema.FrameworkResolver { return &frameworkResolver{r} }
 
+// Mitigation returns schema.MitigationResolver implementation.
+func (r *Resolver) Mitigation() schema.MitigationResolver { return &mitigationResolver{r} }
+
 // Mutation returns schema.MutationResolver implementation.
 func (r *Resolver) Mutation() schema.MutationResolver { return &mutationResolver{r} }
 
@@ -926,9 +925,9 @@ func (r *Resolver) Task() schema.TaskResolver { return &taskResolver{r} }
 // Viewer returns schema.ViewerResolver implementation.
 func (r *Resolver) Viewer() schema.ViewerResolver { return &viewerResolver{r} }
 
-type controlResolver struct{ *Resolver }
 type evidenceResolver struct{ *Resolver }
 type frameworkResolver struct{ *Resolver }
+type mitigationResolver struct{ *Resolver }
 type mutationResolver struct{ *Resolver }
 type organizationResolver struct{ *Resolver }
 type policyResolver struct{ *Resolver }