Refactor SOA

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/coredata/applicability_statement.go

@@ -29,7 +29,7 @@ import (
 )
 
 type (
-	StateOfApplicabilityControl struct {
+	ApplicabilityStatement struct {
 		ID                     gid.GID   `db:"id"`
 		StateOfApplicabilityID gid.GID   `db:"state_of_applicability_id"`
 		ControlID              gid.GID   `db:"control_id"`
@@ -41,53 +41,80 @@ type (
 		UpdatedAt              time.Time `db:"updated_at"`
 	}
 
-	StateOfApplicabilityControls []*StateOfApplicabilityControl
-
-	AvailableStateOfApplicabilityControl struct {
-		ControlID              gid.GID  `db:"control_id"`
-		SectionTitle           string   `db:"section_title"`
-		Name                   string   `db:"name"`
-		FrameworkID            gid.GID  `db:"framework_id"`
-		FrameworkName          string   `db:"framework_name"`
-		OrganizationID         gid.GID  `db:"organization_id"`
-		StateOfApplicabilityID *gid.GID `db:"state_of_applicability_id"`
-		Applicability          *bool    `db:"applicability"`
-		Justification          *string  `db:"justification"`
-		BestPractice           bool     `db:"best_practice"`
-		Regulatory             bool     `db:"regulatory"`
-		Contractual            bool     `db:"contractual"`
-		RiskAssessment         bool     `db:"risk_assessment"`
-	}
-
-	AvailableStateOfApplicabilityControls []*AvailableStateOfApplicabilityControl
+	ApplicabilityStatements []*ApplicabilityStatement
 )
 
-func (s StateOfApplicabilityControl) CursorKey(orderBy StateOfApplicabilityOrderField) page.CursorKey {
+func (s ApplicabilityStatement) CursorKey(orderBy ApplicabilityStatementOrderField) page.CursorKey {
 	switch orderBy {
-	case StateOfApplicabilityOrderFieldName:
-		return page.NewCursorKey(s.ID, s.StateOfApplicabilityID)
-	case StateOfApplicabilityOrderFieldCreatedAt:
+	case ApplicabilityStatementOrderFieldCreatedAt:
 		return page.NewCursorKey(s.ID, s.CreatedAt)
 	}
 
 	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
 }
 
-func (s *StateOfApplicabilityControl) AuthorizationAttributes(ctx context.Context, conn pg.Conn) (map[string]string, error) {
-	q := `SELECT organization_id FROM states_of_applicability_controls WHERE id = $1 LIMIT 1;`
+func (s *ApplicabilityStatement) AuthorizationAttributes(ctx context.Context, conn pg.Conn) (map[string]string, error) {
+	q := `SELECT organization_id FROM applicability_statements WHERE id = $1 LIMIT 1;`
 
 	var organizationID gid.GID
 	if err := conn.QueryRow(ctx, q, s.ID).Scan(&organizationID); err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return nil, ErrResourceNotFound
 		}
-		return nil, fmt.Errorf("cannot query state of applicability control authorization attributes: %w", err)
+		return nil, fmt.Errorf("cannot query applicability statement authorization attributes: %w", err)
 	}
 
 	return map[string]string{"organization_id": organizationID.String()}, nil
 }
 
-func (sac *StateOfApplicabilityControl) LoadByStateOfApplicabilityIDAndControlID(
+func (sac *ApplicabilityStatement) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	id gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    state_of_applicability_id,
+    control_id,
+    organization_id,
+    snapshot_id,
+    applicability,
+    justification,
+    created_at,
+    updated_at
+FROM
+    applicability_statements
+WHERE
+    %s
+    AND id = @id
+LIMIT 1;
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": id}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query applicability_statements: %w", err)
+	}
+
+	applicabilityStatement, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ApplicabilityStatement])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+		return fmt.Errorf("cannot collect applicability statement: %w", err)
+	}
+
+	*sac = applicabilityStatement
+
+	return nil
+}
+
+func (sac *ApplicabilityStatement) LoadByStateOfApplicabilityIDAndControlID(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
@@ -114,7 +141,7 @@ SELECT
     soac.created_at,
     soac.updated_at
 FROM
-    states_of_applicability_controls soac
+    applicability_statements soac
 INNER JOIN
     current_soa ON soac.state_of_applicability_id = current_soa.id
 WHERE
@@ -131,29 +158,29 @@ LIMIT 1;
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query states_of_applicability_controls: %w", err)
+		return fmt.Errorf("cannot query applicability_statements: %w", err)
 	}
 
-	control, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[StateOfApplicabilityControl])
+	control, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ApplicabilityStatement])
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return ErrResourceNotFound
 		}
-		return fmt.Errorf("cannot collect state of applicability control: %w", err)
+		return fmt.Errorf("cannot collect applicability statement: %w", err)
 	}
 
 	*sac = control
 	return nil
 }
 
-func (sac *StateOfApplicabilityControl) Insert(
+func (sac *ApplicabilityStatement) Insert(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
 ) error {
 	q := `
 INSERT INTO
-    states_of_applicability_controls (
+    applicability_statements (
         id,
         state_of_applicability_id,
         control_id,
@@ -201,19 +228,19 @@ VALUES (
 			}
 		}
 
-		return fmt.Errorf("cannot insert state_of_applicability_control: %w", err)
+		return fmt.Errorf("cannot insert applicability_statement: %w", err)
 	}
 
 	return nil
 }
 
-func (sac *StateOfApplicabilityControl) Update(
+func (sac *ApplicabilityStatement) Update(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
 ) error {
 	q := `
-UPDATE states_of_applicability_controls
+UPDATE applicability_statements
 SET
     applicability = @applicability,
     justification = @justification,
@@ -236,70 +263,50 @@ WHERE
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot update state_of_applicability_control: %w", err)
+		return fmt.Errorf("cannot update applicability_statement: %w", err)
 	}
 
 	return nil
 }
 
-func (sac *StateOfApplicabilityControl) Upsert(
+func (sac *ApplicabilityStatement) UpdateByID(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
 ) error {
 	q := `
-INSERT INTO
-    states_of_applicability_controls (
-        id,
-        state_of_applicability_id,
-        control_id,
-        organization_id,
-        tenant_id,
-        snapshot_id,
-        applicability,
-        justification,
-        created_at,
-        updated_at
-    )
-VALUES (
-    @id,
-    @state_of_applicability_id,
-    @control_id,
-    @organization_id,
-    @tenant_id,
-    @snapshot_id,
-    @applicability,
-    @justification,
-    @created_at,
-    @updated_at
-)
-ON CONFLICT (state_of_applicability_id, control_id) DO UPDATE SET
-    applicability = EXCLUDED.applicability,
-    justification = EXCLUDED.justification,
-    updated_at = EXCLUDED.updated_at
+UPDATE applicability_statements
+SET
+    applicability = @applicability,
+    justification = @justification,
+    updated_at = @updated_at
+WHERE
+    %s
+    AND id = @id
 `
+	q = fmt.Sprintf(q, scope.SQLFragment())
 
 	args := pgx.StrictNamedArgs{
-		"id":                        sac.ID,
-		"state_of_applicability_id": sac.StateOfApplicabilityID,
-		"control_id":                sac.ControlID,
-		"organization_id":           sac.OrganizationID,
-		"tenant_id":                 scope.GetTenantID(),
-		"snapshot_id":               sac.SnapshotID,
-		"applicability":             sac.Applicability,
-		"justification":             sac.Justification,
-		"created_at":                sac.CreatedAt,
-		"updated_at":                sac.UpdatedAt,
+		"id":            sac.ID,
+		"applicability": sac.Applicability,
+		"justification": sac.Justification,
+		"updated_at":    sac.UpdatedAt,
 	}
-	_, err := conn.Exec(ctx, q, args)
+	maps.Copy(args, scope.SQLArguments())
+
+	result, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot upsert state_of_applicability_control: %w", err)
+		return fmt.Errorf("cannot update applicability_statement: %w", err)
+	}
+
+	if result.RowsAffected() == 0 {
+		return ErrResourceNotFound
 	}
 
 	return nil
 }
 
-func (sac *StateOfApplicabilityControl) Delete(
+func (sac *ApplicabilityStatement) Delete(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
@@ -313,7 +320,7 @@ WITH current_soa AS (
         AND id = @state_of_applicability_id
         AND snapshot_id IS NULL
 )
-DELETE FROM states_of_applicability_controls
+DELETE FROM applicability_statements
 WHERE state_of_applicability_id IN (SELECT id FROM current_soa)
     AND control_id = @control_id;
 `
@@ -329,11 +336,41 @@ WHERE state_of_applicability_id IN (SELECT id FROM current_soa)
 	return err
 }
 
-func (sacs *StateOfApplicabilityControls) LoadByStateOfApplicabilityID(
+func (sac *ApplicabilityStatement) DeleteByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	applicabilityStatementID gid.GID,
+) error {
+	q := `
+DELETE FROM applicability_statements
+WHERE
+    %s
+    AND id = @id;
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": applicabilityStatementID}
+	maps.Copy(args, scope.SQLArguments())
+
+	result, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete applicability statement: %w", err)
+	}
+
+	if result.RowsAffected() == 0 {
+		return ErrResourceNotFound
+	}
+
+	return nil
+}
+
+func (sacs *ApplicabilityStatements) LoadByStateOfApplicabilityID(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
 	stateOfApplicabilityID gid.GID,
+	cursor *page.Cursor[ApplicabilityStatementOrderField],
 ) error {
 	q := `
 SELECT
@@ -347,39 +384,68 @@ SELECT
     created_at,
     updated_at
 FROM
-    states_of_applicability_controls
+    applicability_statements
 WHERE
-    %s
+    %[1]s
     AND state_of_applicability_id = @state_of_applicability_id
-ORDER BY created_at ASC
+    AND %[2]s
 `
-	q = fmt.Sprintf(q, scope.SQLFragment())
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
 
-	args := pgx.StrictNamedArgs{
+	args := pgx.NamedArgs{
 		"state_of_applicability_id": stateOfApplicabilityID,
 	}
 	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query states_of_applicability_controls: %w", err)
+		return fmt.Errorf("cannot query applicability_statements: %w", err)
 	}
 
-	controls, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[StateOfApplicabilityControl])
+	controls, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ApplicabilityStatement])
 	if err != nil {
-		return fmt.Errorf("cannot collect states_of_applicability_controls: %w", err)
+		return fmt.Errorf("cannot collect applicability_statements: %w", err)
 	}
 
 	*sacs = controls
 	return nil
 }
 
-func (sacs *StateOfApplicabilityControls) LoadByControlID(
+func (sacs *ApplicabilityStatements) CountByStateOfApplicabilityID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	stateOfApplicabilityID gid.GID,
+) (int, error) {
+	q := `
+SELECT
+    COUNT(id)
+FROM
+    applicability_statements
+WHERE
+    %s
+    AND state_of_applicability_id = @state_of_applicability_id;
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.NamedArgs{"state_of_applicability_id": stateOfApplicabilityID}
+	maps.Copy(args, scope.SQLArguments())
+
+	var count int
+	if err := conn.QueryRow(ctx, q, args).Scan(&count); err != nil {
+		return 0, fmt.Errorf("cannot count applicability_statements: %w", err)
+	}
+
+	return count, nil
+}
+
+func (sacs *ApplicabilityStatements) LoadByControlID(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
 	controlID gid.GID,
-	cursor *page.Cursor[StateOfApplicabilityOrderField],
+	cursor *page.Cursor[ApplicabilityStatementOrderField],
 ) error {
 	q := `
 WITH soac_ctrl AS (
@@ -395,7 +461,7 @@ WITH soac_ctrl AS (
         soac.updated_at,
         soac.tenant_id
     FROM
-        states_of_applicability_controls soac
+        applicability_statements soac
     INNER JOIN
         states_of_applicability soa ON soac.state_of_applicability_id = soa.id
     WHERE
@@ -427,19 +493,19 @@ WHERE
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query state_of_applicability_controls: %w", err)
+		return fmt.Errorf("cannot query applicability_statements: %w", err)
 	}
 
-	controls, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[StateOfApplicabilityControl])
+	controls, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ApplicabilityStatement])
 	if err != nil {
-		return fmt.Errorf("cannot collect state_of_applicability_controls: %w", err)
+		return fmt.Errorf("cannot collect applicability_statements: %w", err)
 	}
 
 	*sacs = controls
 	return nil
 }
 
-func (sacs *StateOfApplicabilityControls) CountByControlID(
+func (sacs *ApplicabilityStatements) CountByControlID(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
@@ -452,7 +518,7 @@ WITH soac_ctrl AS (
         soac.organization_id,
         soac.tenant_id
     FROM
-        states_of_applicability_controls soac
+        applicability_statements soac
     INNER JOIN
         states_of_applicability soa ON soac.state_of_applicability_id = soa.id
     WHERE
@@ -482,126 +548,3 @@ WHERE
 
 	return count, nil
 }
-
-func (acfs *AvailableStateOfApplicabilityControls) LoadAvailableByStateOfApplicabilityID(
-	ctx context.Context,
-	conn pg.Conn,
-	scope Scoper,
-	stateOfApplicabilityID gid.GID,
-) error {
-	q := `
-WITH soa_info AS (
-    SELECT
-        soa.organization_id,
-        soa.tenant_id AS soa_tenant_id
-    FROM states_of_applicability soa
-    WHERE soa.tenant_id = @tenant_id
-        AND soa.id = @state_of_applicability_id
-),
-filtered_controls AS (
-    SELECT
-        c.id AS control_id,
-        c.section_title,
-        c.name,
-        c.framework_id,
-        c.organization_id,
-        c.tenant_id,
-        c.best_practice
-    FROM controls c
-    WHERE
-        %s
-),
-all_controls AS (
-    SELECT
-        fc.control_id,
-        fc.section_title,
-        fc.name,
-        fc.framework_id,
-        fc.organization_id,
-        fc.tenant_id,
-        f.name AS framework_name,
-        fc.best_practice
-    FROM filtered_controls fc
-    INNER JOIN frameworks f ON fc.framework_id = f.id
-    CROSS JOIN soa_info si
-    WHERE fc.organization_id = si.organization_id
-),
-existing_links AS (
-    SELECT
-        soac.control_id,
-        soac.state_of_applicability_id,
-        soac.applicability,
-        soac.justification
-    FROM states_of_applicability_controls soac
-    CROSS JOIN soa_info si
-    WHERE soac.tenant_id = si.soa_tenant_id
-        AND soac.state_of_applicability_id = @state_of_applicability_id
-),
-regulatory_controls AS (
-    SELECT DISTINCT co.control_id
-    FROM controls_obligations co
-    INNER JOIN obligations o ON o.id = co.obligation_id
-    CROSS JOIN soa_info si
-    WHERE co.tenant_id = si.soa_tenant_id
-        AND o.tenant_id = si.soa_tenant_id
-        AND o.type = 'LEGAL'
-),
-contractual_controls AS (
-    SELECT DISTINCT co.control_id
-    FROM controls_obligations co
-    INNER JOIN obligations o ON o.id = co.obligation_id
-    CROSS JOIN soa_info si
-    WHERE co.tenant_id = si.soa_tenant_id
-        AND o.tenant_id = si.soa_tenant_id
-        AND o.type = 'CONTRACTUAL'
-),
-risk_controls AS (
-    SELECT DISTINCT cm.control_id
-    FROM controls_measures cm
-    INNER JOIN risks_measures rm ON rm.measure_id = cm.measure_id
-    CROSS JOIN soa_info si
-    WHERE cm.tenant_id = si.soa_tenant_id
-        AND rm.tenant_id = si.soa_tenant_id
-)
-SELECT
-    ac.control_id,
-    ac.section_title,
-    ac.name,
-    ac.framework_id,
-    ac.organization_id,
-    ac.framework_name,
-    el.state_of_applicability_id,
-    el.applicability,
-    el.justification,
-    ac.best_practice,
-    CASE WHEN reg.control_id IS NOT NULL THEN TRUE ELSE FALSE END AS regulatory,
-    CASE WHEN cont.control_id IS NOT NULL THEN TRUE ELSE FALSE END AS contractual,
-    CASE WHEN risk.control_id IS NOT NULL THEN TRUE ELSE FALSE END AS risk_assessment
-FROM all_controls ac
-LEFT JOIN existing_links el ON ac.control_id = el.control_id
-LEFT JOIN regulatory_controls reg ON reg.control_id = ac.control_id
-LEFT JOIN contractual_controls cont ON cont.control_id = ac.control_id
-LEFT JOIN risk_controls risk ON risk.control_id = ac.control_id
-ORDER BY ac.framework_name, ac.section_title, ac.name
-`
-
-	q = fmt.Sprintf(q, scope.SQLFragment())
-
-	args := pgx.StrictNamedArgs{
-		"state_of_applicability_id": stateOfApplicabilityID,
-	}
-	maps.Copy(args, scope.SQLArguments())
-
-	rows, err := conn.Query(ctx, q, args)
-	if err != nil {
-		return fmt.Errorf("cannot query available controls: %w", err)
-	}
-
-	controls, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[AvailableStateOfApplicabilityControl])
-	if err != nil {
-		return fmt.Errorf("cannot collect available controls: %w", err)
-	}
-
-	*acfs = controls
-	return nil
-}

pkg/coredata/applicability_statement_order_field.go

@@ -0,0 +1,52 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"fmt"
+)
+
+type ApplicabilityStatementOrderField string
+
+const (
+	ApplicabilityStatementOrderFieldCreatedAt ApplicabilityStatementOrderField = "CREATED_AT"
+)
+
+func (p ApplicabilityStatementOrderField) Column() string {
+	switch p {
+	case ApplicabilityStatementOrderFieldCreatedAt:
+		return "created_at"
+	}
+
+	panic("unknown ApplicabilityStatementOrderField")
+}
+
+func (p ApplicabilityStatementOrderField) String() string {
+	return string(p)
+}
+
+func (p ApplicabilityStatementOrderField) MarshalText() ([]byte, error) {
+	return []byte(p.String()), nil
+}
+
+func (p *ApplicabilityStatementOrderField) UnmarshalText(text []byte) error {
+	val := string(text)
+	switch val {
+	case string(ApplicabilityStatementOrderFieldCreatedAt):
+		*p = ApplicabilityStatementOrderField(val)
+		return nil
+	}
+	return fmt.Errorf("invalid ApplicabilityStatementOrderField value: %q", val)
+}

pkg/coredata/control.go

@@ -720,6 +720,54 @@ LIMIT 1;
 	return nil
 }
 
+func (c *Controls) LoadByIDs(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	controlIDs []gid.GID,
+) error {
+	if len(controlIDs) == 0 {
+		*c = Controls{}
+		return nil
+	}
+
+	q := `
+SELECT
+    id,
+    section_title,
+    framework_id,
+    organization_id,
+    name,
+    description,
+    status,
+    exclusion_justification,
+    best_practice,
+    created_at,
+    updated_at
+FROM
+    controls
+WHERE
+    %s
+    AND id = ANY(@control_ids)
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"control_ids": controlIDs}
+	maps.Copy(args, scope.SQLArguments())
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query controls: %w", err)
+	}
+
+	controls, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Control])
+	if err != nil {
+		return fmt.Errorf("cannot collect controls: %w", err)
+	}
+
+	*c = controls
+	return nil
+}
+
 func (c Control) Insert(
 	ctx context.Context,
 	conn pg.Conn,
@@ -1098,7 +1146,7 @@ WITH ctrl AS (
 	FROM
 		controls c
 	INNER JOIN
-		states_of_applicability_controls soac ON c.id = soac.control_id
+		applicability_statements soac ON c.id = soac.control_id
 	WHERE
 		soac.state_of_applicability_id = @state_of_applicability_id
 )
@@ -1124,74 +1172,3 @@ WHERE %s
 
 	return count, nil
 }
-
-func (c *Controls) LoadByStateOfApplicabilityID(
-	ctx context.Context,
-	conn pg.Conn,
-	scope Scoper,
-	stateOfApplicabilityID gid.GID,
-	cursor *page.Cursor[ControlOrderField],
-	filter *ControlFilter,
-) error {
-	q := `
-WITH ctrl AS (
-	SELECT
-		c.id,
-		c.section_title,
-		c.framework_id,
-		c.organization_id,
-		c.tenant_id,
-		c.name,
-		c.description,
-		c.status,
-		c.exclusion_justification,
-		c.best_practice,
-		c.created_at,
-		c.updated_at,
-		c.search_vector
-	FROM
-		controls c
-	INNER JOIN
-		states_of_applicability_controls soac ON c.id = soac.control_id
-	WHERE
-		soac.state_of_applicability_id = @state_of_applicability_id
-)
-SELECT
-	id,
-	section_title,
-	framework_id,
-	organization_id,
-	name,
-	description,
-	status,
-	exclusion_justification,
-	best_practice,
-	created_at,
-	updated_at
-FROM
-	ctrl
-WHERE %s
-	AND %s
-	AND %s
-`
-	q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment(), cursor.SQLFragment())
-
-	args := pgx.NamedArgs{"state_of_applicability_id": stateOfApplicabilityID}
-	maps.Copy(args, scope.SQLArguments())
-	maps.Copy(args, filter.SQLArguments())
-	maps.Copy(args, cursor.SQLArguments())
-
-	rows, err := conn.Query(ctx, q, args)
-	if err != nil {
-		return fmt.Errorf("cannot query controls: %w", err)
-	}
-
-	controls, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Control])
-	if err != nil {
-		return fmt.Errorf("cannot collect controls: %w", err)
-	}
-
-	*c = controls
-
-	return nil
-}

pkg/coredata/control_obligation.go

@@ -167,19 +167,13 @@ WHERE
 	return nil
 }
 
-type ControlObligationType struct {
-	ControlID gid.GID        `db:"control_id"`
-	Type      ObligationType `db:"type"`
-}
-
-type ControlObligationTypes []*ControlObligationType
-
-func (cots *ControlObligationTypes) LoadTypesByControlIDs(
+func (cos *ControlObligations) CountByControlID(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
-	controlIDs []gid.GID,
-) error {
+	controlID gid.GID,
+	filter *ControlObligationFilter,
+) (int, error) {
 	q := `
 WITH control_obls AS (
 	SELECT
@@ -191,31 +185,27 @@ WITH control_obls AS (
 	INNER JOIN
 		obligations o ON co.obligation_id = o.id
 	WHERE
-		co.control_id = ANY(@control_ids)
+		co.control_id = @control_id
 )
-SELECT DISTINCT
-	control_id,
-	type
+SELECT
+	COUNT(*)
 FROM
 	control_obls
-WHERE
-	%s
+WHERE %s
+	AND %s
 `
-	q = fmt.Sprintf(q, scope.SQLFragment())
+	q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment())
 
-	args := pgx.NamedArgs{"control_ids": controlIDs}
+	args := pgx.StrictNamedArgs{"control_id": controlID}
 	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, filter.SQLArguments())
 
-	rows, err := conn.Query(ctx, q, args)
-	if err != nil {
-		return fmt.Errorf("cannot query control obligations: %w", err)
+	row := conn.QueryRow(ctx, q, args)
+
+	var count int
+	if err := row.Scan(&count); err != nil {
+		return 0, fmt.Errorf("cannot count control obligations: %w", err)
 	}
 
-	controlObligationTypes, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ControlObligationType])
-	if err != nil {
-		return fmt.Errorf("cannot collect control obligations: %w", err)
-	}
-
-	*cots = controlObligationTypes
-	return nil
+	return count, nil
 }

pkg/coredata/control_obligation_filter.go

@@ -0,0 +1,45 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"github.com/jackc/pgx/v5"
+)
+
+type ControlObligationFilter struct {
+	obligationType *ObligationType
+}
+
+func NewControlObligationFilter(obligationType *ObligationType) *ControlObligationFilter {
+	return &ControlObligationFilter{
+		obligationType: obligationType,
+	}
+}
+
+func (f *ControlObligationFilter) SQLArguments() pgx.NamedArgs {
+	args := pgx.NamedArgs{
+		"filter_obligation_type": nil,
+	}
+
+	if f.obligationType != nil {
+		args["filter_obligation_type"] = *f.obligationType
+	}
+
+	return args
+}
+
+func (f *ControlObligationFilter) SQLFragment() string {
+	return "(@filter_obligation_type::obligation_type IS NULL OR type = @filter_obligation_type)"
+}

pkg/coredata/entity_type_reg.go

@@ -73,7 +73,7 @@ const (
 	TransferImpactAssessmentEntityType         uint16 = 47
 	RightsRequestEntityType                    uint16 = 48
 	StateOfApplicabilityEntityType             uint16 = 49
-	StateOfApplicabilityControlEntityType      uint16 = 50
+	ApplicabilityStatementEntityType           uint16 = 50
 	MembershipProfileEntityType                uint16 = 51
 	SCIMConfigurationEntityType                uint16 = 52
 	SCIMEventEntityType                        uint16 = 53
@@ -180,8 +180,8 @@ func NewEntityFromID(id gid.GID) (any, bool) {
 		return &RightsRequest{ID: id}, true
 	case StateOfApplicabilityEntityType:
 		return &StateOfApplicability{ID: id}, true
-	case StateOfApplicabilityControlEntityType:
-		return &StateOfApplicabilityControl{ID: id}, true
+	case ApplicabilityStatementEntityType:
+		return &ApplicabilityStatement{ID: id}, true
 	case MembershipProfileEntityType:
 		return &MembershipProfile{ID: id}, true
 	case SCIMConfigurationEntityType:

pkg/coredata/framework.go

@@ -241,6 +241,53 @@ LIMIT 1;
 	return nil
 }
 
+func (f *Frameworks) LoadByIDs(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	frameworkIDs []gid.GID,
+) error {
+	if len(frameworkIDs) == 0 {
+		*f = Frameworks{}
+		return nil
+	}
+
+	q := `
+SELECT
+    id,
+    organization_id,
+    reference_id,
+    name,
+    description,
+    light_logo_file_id,
+    dark_logo_file_id,
+    created_at,
+    updated_at
+FROM
+    frameworks
+WHERE
+    %s
+    AND id = ANY(@framework_ids)
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"framework_ids": frameworkIDs}
+	maps.Copy(args, scope.SQLArguments())
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query frameworks: %w", err)
+	}
+
+	frameworks, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Framework])
+	if err != nil {
+		return fmt.Errorf("cannot collect frameworks: %w", err)
+	}
+
+	*f = frameworks
+	return nil
+}
+
 func (f Framework) Insert(
 	ctx context.Context,
 	conn pg.Conn,

pkg/coredata/migrations/20260102T134633Z.sql

@@ -109,20 +109,24 @@ WHERE NOT EXISTS (
     SELECT 1
     FROM states_of_applicability soa
     WHERE soa.name = f.name
+    AND soa.tenant_id = f.tenant_id
     AND soa.snapshot_id IS NULL
 )
 AND EXISTS (
     SELECT 1 FROM peoples WHERE tenant_id = f.tenant_id
 )
+-- We only use exclude with ISO 27001 FIXME
 AND EXISTS (
     SELECT 1
     FROM controls c
     WHERE c.framework_id = f.id
+    AND c.tenant_id = f.tenant_id
     AND (
         c.status = 'EXCLUDED'
         OR (c.exclusion_justification IS NOT NULL AND c.exclusion_justification != '')
     )
-);
+)
+AND organization_id = 'e5IaD7ibAAEAAAAAAZZ9aR_Oq_Npymhg';
 
 INSERT INTO states_of_applicability_controls (
     id,
@@ -151,11 +155,23 @@ SELECT
     NOW() as created_at,
     NOW() as updated_at
 FROM frameworks f
-JOIN states_of_applicability soa ON soa.name = f.name AND soa.snapshot_id IS NULL
+JOIN states_of_applicability soa ON soa.name = f.name AND soa.snapshot_id IS NULL AND soa.tenant_id = f.tenant_id
 JOIN controls c ON c.framework_id = f.id
 WHERE NOT EXISTS (
     SELECT 1
     FROM states_of_applicability_controls soac
     WHERE soac.state_of_applicability_id = soa.id
     AND soac.control_id = c.id
-);
+)
+AND f.id = 'e5IaD7ibAAEAAQAAAZsNt6Js2dJrgpJG'
+AND f.organization_id = 'e5IaD7ibAAEAAAAAAZZ9aR_Oq_Npymhg';
+
+
+
+WITH todelete AS (
+SELECT soac.id
+FROM states_of_applicability soa
+JOIN states_of_applicability_controls soac ON soac.state_of_applicability_id = soa.id
+WHERE soa.tenant_id != soac.tenant_id
+) 
+DELETE FROM states_of_applicability_controls WHERE id IN (SELECT id FROM todelete)

pkg/coredata/migrations/20260121T150000Z.sql

@@ -0,0 +1,11 @@
+ALTER TABLE states_of_applicability_controls RENAME TO applicability_statements;
+
+ALTER TABLE applicability_statements 
+    RENAME CONSTRAINT states_of_applicability_controls_organization_id_fkey 
+    TO applicability_statements_organization_id_fkey;
+
+ALTER TABLE applicability_statements 
+    RENAME CONSTRAINT states_of_applicability_controls_snapshot_id_fkey 
+    TO applicability_statements_snapshot_id_fkey;
+
+ALTER INDEX states_of_applicability_controls_pkey RENAME TO applicability_statements_pkey;

pkg/coredata/state_of_applicability.go

@@ -414,7 +414,7 @@ snapshot_soa AS (
     FROM states_of_applicability
     WHERE snapshot_id = @snapshot_id
 )
-INSERT INTO states_of_applicability_controls (
+INSERT INTO applicability_statements (
     id,
     state_of_applicability_id,
     control_id,
@@ -427,7 +427,7 @@ INSERT INTO states_of_applicability_controls (
     updated_at
 )
 SELECT
-    generate_gid(decode_base64_unpadded(@tenant_id), @state_of_applicability_control_entity_type),
+    generate_gid(decode_base64_unpadded(@tenant_id), @applicability_statement_entity_type),
     snapshot_soa.id,
     soac.control_id,
     soac.organization_id,
@@ -437,7 +437,7 @@ SELECT
     soac.justification,
     soac.created_at,
     soac.updated_at
-FROM states_of_applicability_controls soac
+FROM applicability_statements soac
 INNER JOIN source_soa
     ON soac.state_of_applicability_id = source_soa.id
 INNER JOIN snapshot_soa
@@ -448,10 +448,10 @@ WHERE soac.snapshot_id IS NULL
 	query = fmt.Sprintf(query, scope.SQLFragment())
 
 	args := pgx.StrictNamedArgs{
-		"tenant_id":       scope.GetTenantID(),
-		"snapshot_id":     snapshotID,
-		"organization_id": organizationID,
-		"state_of_applicability_control_entity_type": StateOfApplicabilityControlEntityType,
+		"tenant_id":                           scope.GetTenantID(),
+		"snapshot_id":                         snapshotID,
+		"organization_id":                     organizationID,
+		"applicability_statement_entity_type": ApplicabilityStatementEntityType,
 	}
 	maps.Copy(args, scope.SQLArguments())
 

pkg/probo/actions.go

@@ -312,9 +312,11 @@ const (
 	ActionStateOfApplicabilityDelete = "core:state-of-applicability:delete"
 	ActionStateOfApplicabilityExport = "core:state-of-applicability:export"
 
-	ActionStateOfApplicabilityControlMappingList   = "core:state-of-applicability-control-mapping:list"
-	ActionStateOfApplicabilityControlMappingCreate = "core:state-of-applicability-control-mapping:create"
-	ActionStateOfApplicabilityControlMappingDelete = "core:state-of-applicability-control-mapping:delete"
+	ActionApplicabilityStatementGet    = "core:applicability-statement:get"
+	ActionApplicabilityStatementList   = "core:applicability-statement:list"
+	ActionApplicabilityStatementCreate = "core:applicability-statement:create"
+	ActionApplicabilityStatementUpdate = "core:applicability-statement:update"
+	ActionApplicabilityStatementDelete = "core:applicability-statement:delete"
 
 	ActionControlObligationMappingList   = "core:control-obligation-mapping:list"
 	ActionControlObligationMappingCreate = "core:control-obligation-mapping:create"

pkg/probo/control_service.go

@@ -827,36 +827,6 @@ func (s ControlService) CountForStateOfApplicabilityID(
 	return count, nil
 }
 
-func (s ControlService) ListForStateOfApplicabilityID(
-	ctx context.Context,
-	stateOfApplicabilityID gid.GID,
-	cursor *page.Cursor[coredata.ControlOrderField],
-	filter *coredata.ControlFilter,
-) (*page.Page[*coredata.Control, coredata.ControlOrderField], error) {
-	var controls coredata.Controls
-	stateOfApplicability := &coredata.StateOfApplicability{}
-
-	err := s.svc.pg.WithConn(
-		ctx,
-		func(conn pg.Conn) error {
-			if err := stateOfApplicability.LoadByID(ctx, conn, s.svc.scope, stateOfApplicabilityID); err != nil {
-				return fmt.Errorf("cannot load state of applicability: %w", err)
-			}
-			if err := controls.LoadByStateOfApplicabilityID(ctx, conn, s.svc.scope, stateOfApplicabilityID, cursor, filter); err != nil {
-				return fmt.Errorf("cannot load controls: %w", err)
-			}
-
-			return nil
-		},
-	)
-
-	if err != nil {
-		return nil, err
-	}
-
-	return page.NewPage([]*coredata.Control(controls), cursor), nil
-}
-
 func (s ControlService) Create(
 	ctx context.Context,
 	req CreateControlRequest,
@@ -932,39 +902,42 @@ func (s ControlService) Update(
 
 	control := &coredata.Control{ID: req.ID}
 
-	err := s.svc.pg.WithTx(ctx, func(conn pg.Conn) error {
-		if err := control.LoadByID(ctx, conn, s.svc.scope, req.ID); err != nil {
-			return fmt.Errorf("cannot load control: %w", err)
-		}
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := control.LoadByID(ctx, conn, s.svc.scope, req.ID); err != nil {
+				return fmt.Errorf("cannot load control: %w", err)
+			}
 
-		if req.Name != nil {
-			control.Name = *req.Name
-		}
+			if req.Name != nil {
+				control.Name = *req.Name
+			}
 
-		if req.Description != nil {
-			control.Description = *req.Description
-		}
+			if req.Description != nil {
+				control.Description = *req.Description
+			}
 
-		if req.SectionTitle != nil {
-			control.SectionTitle = *req.SectionTitle
-		}
+			if req.SectionTitle != nil {
+				control.SectionTitle = *req.SectionTitle
+			}
 
-		if req.Status != nil {
-			control.Status = *req.Status
-		}
+			if req.Status != nil {
+				control.Status = *req.Status
+			}
 
-		if req.ExclusionJustification != nil {
-			control.ExclusionJustification = req.ExclusionJustification
-		}
+			if req.ExclusionJustification != nil {
+				control.ExclusionJustification = req.ExclusionJustification
+			}
 
-		if req.BestPractice != nil {
-			control.BestPractice = *req.BestPractice
-		}
+			if req.BestPractice != nil {
+				control.BestPractice = *req.BestPractice
+			}
 
-		control.UpdatedAt = time.Now()
+			control.UpdatedAt = time.Now()
 
-		return control.Update(ctx, conn, s.svc.scope)
-	})
+			return control.Update(ctx, conn, s.svc.scope)
+		},
+	)
 	if err != nil {
 		return nil, fmt.Errorf("cannot update control: %w", err)
 	}
@@ -985,3 +958,75 @@ func (s ControlService) Delete(
 		},
 	)
 }
+
+func (s ControlService) HasRegulatoryObligation(
+	ctx context.Context,
+	controlID gid.GID,
+) (bool, error) {
+	var hasRegulatory bool
+
+	obligationType := coredata.ObligationTypeLegal
+	filter := coredata.NewControlObligationFilter(&obligationType)
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			var controlObligations coredata.ControlObligations
+			count, err := controlObligations.CountByControlID(ctx, conn, s.svc.scope, controlID, filter)
+			if err != nil {
+				return fmt.Errorf("cannot count regulatory obligations: %w", err)
+			}
+			hasRegulatory = count > 0
+			return nil
+		},
+	)
+
+	return hasRegulatory, err
+}
+
+func (s ControlService) HasContractualObligation(
+	ctx context.Context,
+	controlID gid.GID,
+) (bool, error) {
+	var hasContractual bool
+
+	obligationType := coredata.ObligationTypeContractual
+	filter := coredata.NewControlObligationFilter(&obligationType)
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			var controlObligations coredata.ControlObligations
+			count, err := controlObligations.CountByControlID(ctx, conn, s.svc.scope, controlID, filter)
+			if err != nil {
+				return fmt.Errorf("cannot count contractual obligations: %w", err)
+			}
+			hasContractual = count > 0
+			return nil
+		},
+	)
+
+	return hasContractual, err
+}
+
+func (s ControlService) HasRiskAssessment(
+	ctx context.Context,
+	controlID gid.GID,
+) (bool, error) {
+	var hasRisk bool
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			var controlsWithRisk coredata.ControlsWithRisk
+			if err := controlsWithRisk.LoadByControlIDs(ctx, conn, s.svc.scope, []gid.GID{controlID}); err != nil {
+				return fmt.Errorf("cannot load controls with risk: %w", err)
+			}
+
+			hasRisk = len(controlsWithRisk) > 0
+			return nil
+		},
+	)
+
+	return hasRisk, err
+}

pkg/probo/policies.go

@@ -79,7 +79,7 @@ var ViewerPolicy = policy.NewPolicy(
 		ActionSlackConnectionList,
 		ActionRightsRequestGet, ActionRightsRequestList,
 		ActionStateOfApplicabilityGet, ActionStateOfApplicabilityList,
-		ActionStateOfApplicabilityControlMappingList,
+		ActionApplicabilityStatementGet, ActionApplicabilityStatementList,
 	).WithSID("entity-read-access").When(organizationCondition),
 
 	policy.Allow(

pkg/probo/state_of_applicability_service.go

@@ -272,17 +272,18 @@ func (s StateOfApplicabilityService) Delete(
 	return nil
 }
 
-func (s StateOfApplicabilityService) ListAvailableControls(
+func (s StateOfApplicabilityService) ListApplicabilityStatements(
 	ctx context.Context,
 	stateOfApplicabilityID gid.GID,
-) ([]*coredata.AvailableStateOfApplicabilityControl, error) {
-	var availableControls coredata.AvailableStateOfApplicabilityControls
+	cursor *page.Cursor[coredata.ApplicabilityStatementOrderField],
+) (*page.Page[*coredata.ApplicabilityStatement, coredata.ApplicabilityStatementOrderField], error) {
+	var statements coredata.ApplicabilityStatements
 
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(conn pg.Conn) error {
-			if err := availableControls.LoadAvailableByStateOfApplicabilityID(ctx, conn, s.svc.scope, stateOfApplicabilityID); err != nil {
-				return fmt.Errorf("cannot load available controls: %w", err)
+			if err := statements.LoadByStateOfApplicabilityID(ctx, conn, s.svc.scope, stateOfApplicabilityID, cursor); err != nil {
+				return fmt.Errorf("cannot load applicability statements: %w", err)
 			}
 			return nil
 		},
@@ -292,72 +293,128 @@ func (s StateOfApplicabilityService) ListAvailableControls(
 		return nil, err
 	}
 
-	return availableControls, nil
+	return page.NewPage(statements, cursor), nil
 }
 
-func (s StateOfApplicabilityService) LinkControl(
+func (s StateOfApplicabilityService) CountApplicabilityStatements(
+	ctx context.Context,
+	stateOfApplicabilityID gid.GID,
+) (int, error) {
+	var count int
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) (err error) {
+			statements := &coredata.ApplicabilityStatements{}
+			count, err = statements.CountByStateOfApplicabilityID(ctx, conn, s.svc.scope, stateOfApplicabilityID)
+			if err != nil {
+				return fmt.Errorf("cannot count applicability statements: %w", err)
+			}
+			return nil
+		},
+	)
+
+	if err != nil {
+		return 0, err
+	}
+
+	return count, nil
+}
+
+func (s StateOfApplicabilityService) CreateApplicabilityStatement(
 	ctx context.Context,
 	stateOfApplicabilityID gid.GID,
 	controlID gid.GID,
 	applicability bool,
 	justification *string,
-) (*coredata.StateOfApplicabilityControl, error) {
-	stateOfApplicability := &coredata.StateOfApplicability{}
-	err := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
-		return stateOfApplicability.LoadByID(ctx, conn, s.svc.scope, stateOfApplicabilityID)
-	})
-	if err != nil {
-		return nil, fmt.Errorf("cannot load state of applicability: %w", err)
-	}
+) (*coredata.ApplicabilityStatement, error) {
+	var (
+		stateOfApplicability   = &coredata.StateOfApplicability{}
+		applicabilityStatement = &coredata.ApplicabilityStatement{}
+		now                    = time.Now()
+	)
 
-	now := time.Now()
-	control := &coredata.StateOfApplicabilityControl{
-		ID:                     gid.New(s.svc.scope.GetTenantID(), coredata.StateOfApplicabilityControlEntityType),
-		StateOfApplicabilityID: stateOfApplicabilityID,
-		ControlID:              controlID,
-		OrganizationID:         stateOfApplicability.OrganizationID,
-		Applicability:          applicability,
-		Justification:          justification,
-		CreatedAt:              now,
-		UpdatedAt:              now,
-	}
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := stateOfApplicability.LoadByID(ctx, conn, s.svc.scope, stateOfApplicabilityID); err != nil {
+				return fmt.Errorf("cannot load state of applicability: %w", err)
+			}
 
-	err = s.svc.pg.WithTx(ctx, func(conn pg.Conn) error {
-		return control.Upsert(ctx, conn, s.svc.scope)
-	})
+			applicabilityStatement = &coredata.ApplicabilityStatement{
+				ID:                     gid.New(s.svc.scope.GetTenantID(), coredata.ApplicabilityStatementEntityType),
+				StateOfApplicabilityID: stateOfApplicabilityID,
+				ControlID:              controlID,
+				OrganizationID:         stateOfApplicability.OrganizationID,
+				Applicability:          applicability,
+				Justification:          justification,
+				CreatedAt:              now,
+				UpdatedAt:              now,
+			}
+
+			if err := applicabilityStatement.Insert(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot insert applicability statement: %w", err)
+			}
+
+			return nil
+		},
+	)
 	if err != nil {
 		return nil, err
 	}
 
-	return control, nil
+	return applicabilityStatement, nil
 }
 
-func (s StateOfApplicabilityService) DeleteControlLink(
+func (s StateOfApplicabilityService) UpdateApplicabilityStatement(
 	ctx context.Context,
-	stateOfApplicabilityID gid.GID,
-	controlID gid.GID,
-) (gid.GID, error) {
-	control := &coredata.StateOfApplicabilityControl{}
+	applicabilityStatementID gid.GID,
+	applicability bool,
+	justification *string,
+) (*coredata.ApplicabilityStatement, error) {
+	applicabilityStatement := &coredata.ApplicabilityStatement{}
 
-	err := s.svc.pg.WithTx(ctx, func(conn pg.Conn) error {
-		if err := control.LoadByStateOfApplicabilityIDAndControlID(ctx, conn, s.svc.scope, stateOfApplicabilityID, controlID); err != nil {
-			return err
-		}
-		return control.Delete(ctx, conn, s.svc.scope)
-	})
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := applicabilityStatement.LoadByID(ctx, conn, s.svc.scope, applicabilityStatementID); err != nil {
+				return err
+			}
+
+			applicabilityStatement.Applicability = applicability
+			applicabilityStatement.Justification = justification
+			applicabilityStatement.UpdatedAt = time.Now()
+
+			return applicabilityStatement.UpdateByID(ctx, conn, s.svc.scope)
+		},
+	)
 	if err != nil {
-		return gid.GID{}, err
+		return nil, err
 	}
 
-	return control.ID, nil
+	return applicabilityStatement, nil
+}
+
+func (s StateOfApplicabilityService) DeleteApplicabilityStatement(
+	ctx context.Context,
+	applicabilityStatementID gid.GID,
+) error {
+	applicabilityStatement := &coredata.ApplicabilityStatement{}
+
+	return s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			return applicabilityStatement.DeleteByID(ctx, conn, s.svc.scope, applicabilityStatementID)
+		},
+	)
 }
 
 func (s StateOfApplicabilityService) ListControlLinks(
 	ctx context.Context,
 	controlID gid.GID,
-	cursor *page.Cursor[coredata.StateOfApplicabilityOrderField],
-) (*page.Page[*coredata.StateOfApplicabilityControl, coredata.StateOfApplicabilityOrderField], error) {
-	var controls coredata.StateOfApplicabilityControls
+	cursor *page.Cursor[coredata.ApplicabilityStatementOrderField],
+) (*page.Page[*coredata.ApplicabilityStatement, coredata.ApplicabilityStatementOrderField], error) {
+	var controls coredata.ApplicabilityStatements
 
 	err := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
 		return controls.LoadByControlID(ctx, conn, s.svc.scope, controlID, cursor)
@@ -393,66 +450,83 @@ func (s StateOfApplicabilityService) ExportPDF(
 				return fmt.Errorf("cannot load owner: %w", err)
 			}
 
-			var availableControls coredata.AvailableStateOfApplicabilityControls
-			if err := availableControls.LoadAvailableByStateOfApplicabilityID(ctx, conn, s.svc.scope, stateOfApplicabilityID); err != nil {
-				return fmt.Errorf("cannot load available controls: %w", err)
+			// Load applicability statements
+			var applicabilityStatements coredata.ApplicabilityStatements
+			cursor := page.NewCursor(
+				10000,
+				nil,
+				page.Head,
+				page.OrderBy[coredata.ApplicabilityStatementOrderField]{
+					Field:     coredata.ApplicabilityStatementOrderFieldCreatedAt,
+					Direction: page.OrderDirectionAsc,
+				},
+			)
+			if err := applicabilityStatements.LoadByStateOfApplicabilityID(ctx, conn, s.svc.scope, stateOfApplicabilityID, cursor); err != nil {
+				return fmt.Errorf("cannot load applicability statements: %w", err)
 			}
 
-			linkedControls := make([]*coredata.AvailableStateOfApplicabilityControl, 0)
-			for _, ctrl := range availableControls {
-				if ctrl.StateOfApplicabilityID != nil {
-					linkedControls = append(linkedControls, ctrl)
-				}
-			}
-
-			obligationsByControl := make(map[gid.GID][]coredata.ObligationType)
-			if len(linkedControls) > 0 {
-				controlIDs := make([]gid.GID, len(linkedControls))
-				for i, ctrl := range linkedControls {
-					controlIDs[i] = ctrl.ControlID
-				}
-
-				var controlObligationTypes coredata.ControlObligationTypes
-				if err := controlObligationTypes.LoadTypesByControlIDs(ctx, conn, s.svc.scope, controlIDs); err != nil {
-					return fmt.Errorf("cannot load control obligations: %w", err)
-				}
-
-				for _, cot := range controlObligationTypes {
-					obligationsByControl[cot.ControlID] = append(obligationsByControl[cot.ControlID], cot.Type)
-				}
-			}
-
-			controlsWithRisks := make(map[gid.GID]bool)
-			if len(linkedControls) > 0 {
-				controlIDs := make([]gid.GID, len(linkedControls))
-				for i, ctrl := range linkedControls {
-					controlIDs[i] = ctrl.ControlID
-				}
-
-				var controlsWithRisk coredata.ControlsWithRisk
-				if err := controlsWithRisk.LoadByControlIDs(ctx, conn, s.svc.scope, controlIDs); err != nil {
-					return fmt.Errorf("cannot load controls with risks: %w", err)
-				}
-
-				for _, cwr := range controlsWithRisk {
-					controlsWithRisks[cwr.ControlID] = true
+			if len(applicabilityStatements) == 0 {
+				// No linked controls, skip loading additional data
+				documentData = docgen.StateOfApplicabilityData{
+					Title:            stateOfApplicability.Name,
+					OrganizationName: organization.Name,
+					CreatedAt:        stateOfApplicability.CreatedAt,
+					TotalControls:    0,
+					FrameworkGroups:  []docgen.FrameworkControlGroup{},
 				}
+				return nil
 			}
 
 			frameworkControlsMap := make(map[string][]docgen.ControlData)
 			frameworkOrder := []string{}
 
-			for _, ctrl := range linkedControls {
-				if _, exists := frameworkControlsMap[ctrl.FrameworkName]; !exists {
-					frameworkOrder = append(frameworkOrder, ctrl.FrameworkName)
-					frameworkControlsMap[ctrl.FrameworkName] = []docgen.ControlData{}
+			for _, stmt := range applicabilityStatements {
+				// Load control
+				control := &coredata.Control{}
+				if err := control.LoadByID(ctx, conn, s.svc.scope, stmt.ControlID); err != nil {
+					return fmt.Errorf("cannot load control: %w", err)
+				}
+
+				// Load framework
+				framework := &coredata.Framework{}
+				if err := framework.LoadByID(ctx, conn, s.svc.scope, control.FrameworkID); err != nil {
+					return fmt.Errorf("cannot load framework: %w", err)
+				}
+
+				// Count legal obligations
+				var controlObligations coredata.ControlObligations
+				legalType := coredata.ObligationTypeLegal
+				legalFilter := coredata.NewControlObligationFilter(&legalType)
+				legalCount, err := controlObligations.CountByControlID(ctx, conn, s.svc.scope, stmt.ControlID, legalFilter)
+				if err != nil {
+					return fmt.Errorf("cannot count legal obligations: %w", err)
+				}
+
+				// Count contractual obligations
+				contractualType := coredata.ObligationTypeContractual
+				contractualFilter := coredata.NewControlObligationFilter(&contractualType)
+				contractualCount, err := controlObligations.CountByControlID(ctx, conn, s.svc.scope, stmt.ControlID, contractualFilter)
+				if err != nil {
+					return fmt.Errorf("cannot count contractual obligations: %w", err)
+				}
+
+				// Check if control has risk
+				var controlsWithRisk coredata.ControlsWithRisk
+				if err := controlsWithRisk.LoadByControlIDs(ctx, conn, s.svc.scope, []gid.GID{stmt.ControlID}); err != nil {
+					return fmt.Errorf("cannot load controls with risks: %w", err)
+				}
+				hasRisk := len(controlsWithRisk) > 0
+
+				if _, exists := frameworkControlsMap[framework.Name]; !exists {
+					frameworkOrder = append(frameworkOrder, framework.Name)
+					frameworkControlsMap[framework.Name] = []docgen.ControlData{}
 				}
 
 				var regulatory *bool
 				var contractual *bool
 				var riskAssessment *bool
 
-				if ctrl.Applicability != nil && *ctrl.Applicability {
+				if stmt.Applicability {
 					falseVal := false
 					trueVal := true
 
@@ -460,30 +534,28 @@ func (s StateOfApplicabilityService) ExportPDF(
 					contractual = &falseVal
 					riskAssessment = &falseVal
 
-					obligations := obligationsByControl[ctrl.ControlID]
-					for _, obligationType := range obligations {
-						if obligationType == coredata.ObligationTypeLegal {
-							regulatory = &trueVal
-						}
-						if obligationType == coredata.ObligationTypeContractual {
-							contractual = &trueVal
-						}
+					if legalCount > 0 {
+						regulatory = &trueVal
 					}
-
-					if controlsWithRisks[ctrl.ControlID] {
+					if contractualCount > 0 {
+						contractual = &trueVal
+					}
+					if hasRisk {
 						riskAssessment = &trueVal
 					}
 				}
 
-				frameworkControlsMap[ctrl.FrameworkName] = append(
-					frameworkControlsMap[ctrl.FrameworkName],
+				applicability := stmt.Applicability
+
+				frameworkControlsMap[framework.Name] = append(
+					frameworkControlsMap[framework.Name],
 					docgen.ControlData{
-						FrameworkName:  ctrl.FrameworkName,
-						SectionTitle:   ctrl.SectionTitle,
-						Name:           ctrl.Name,
-						Applicability:  ctrl.Applicability,
-						Justification:  ctrl.Justification,
-						BestPractice:   ctrl.BestPractice,
+						FrameworkName:  framework.Name,
+						SectionTitle:   control.SectionTitle,
+						Name:           control.Name,
+						Applicability:  &applicability,
+						Justification:  stmt.Justification,
+						BestPractice:   control.BestPractice,
 						Regulatory:     regulatory,
 						Contractual:    contractual,
 						RiskAssessment: riskAssessment,
@@ -543,7 +615,7 @@ func (s StateOfApplicabilityService) ExportPDF(
 				Title:                       stateOfApplicability.Name,
 				OrganizationName:            organization.Name,
 				CreatedAt:                   stateOfApplicability.CreatedAt,
-				TotalControls:               len(linkedControls),
+				TotalControls:               len(applicabilityStatements),
 				FrameworkGroups:             frameworkGroups,
 				CompanyHorizontalLogoBase64: horizontalLogoBase64,
 				Version:                     version,

pkg/server/api/console/v1/schema.graphql

@@ -599,6 +599,14 @@ enum DocumentVersionOrderField
         )
 }
 
+enum ApplicabilityStatementOrderField
+    @goModel(model: "go.probo.inc/probo/pkg/coredata.ApplicabilityStatementOrderField") {
+    CREATED_AT
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ApplicabilityStatementOrderFieldCreatedAt"
+        )
+}
+
 enum CountryCode
     @goModel(model: "go.probo.inc/probo/pkg/coredata.CountryCode") {
     AD @goEnum(value: "go.probo.inc/probo/pkg/coredata.CountryCodeAD")
@@ -1475,6 +1483,14 @@ input SnapshotOrder
     field: SnapshotOrderField!
 }
 
+input ApplicabilityStatementOrder
+    @goModel(
+        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.ApplicabilityStatementOrderBy"
+    ) {
+    direction: OrderDirection!
+    field: ApplicabilityStatementOrderField!
+}
+
 input DocumentVersionFilter {
     status: DocumentStatus
 }
@@ -1992,6 +2008,9 @@ type Control implements Node {
     status: ControlStatus!
     exclusionJustification: String
     bestPractice: Boolean!
+    regulatory: Boolean! @goField(forceResolver: true)
+    contractual: Boolean! @goField(forceResolver: true)
+    riskAssessment: Boolean! @goField(forceResolver: true)
 
     framework: Framework! @goField(forceResolver: true)
 
@@ -2038,14 +2057,6 @@ type Control implements Node {
         orderBy: SnapshotOrder
     ): SnapshotConnection! @goField(forceResolver: true)
 
-    stateOfApplicabilityControls(
-        first: Int
-        after: CursorKey
-        last: Int
-        before: CursorKey
-        orderBy: StateOfApplicabilityOrder
-    ): StateOfApplicabilityControlConnection! @goField(forceResolver: true)
-
     createdAt: Datetime!
     updatedAt: Datetime!
 
@@ -2225,17 +2236,39 @@ type StateOfApplicability implements Node {
     createdAt: Datetime!
     updatedAt: Datetime!
 
-    controls(
+    applicabilityStatements(
         first: Int
         after: CursorKey
         last: Int
         before: CursorKey
-        orderBy: ControlOrder
-        filter: ControlFilter
-    ): ControlConnection! @goField(forceResolver: true)
+        orderBy: ApplicabilityStatementOrder
+    ): ApplicabilityStatementConnection! @goField(forceResolver: true)
 
-    availableControls: [AvailableStateOfApplicabilityControl!]!
-        @goField(forceResolver: true)
+    permission(action: String!): Boolean! @goField(forceResolver: true)
+}
+
+type ApplicabilityStatementConnection
+    @goModel(
+        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.ApplicabilityStatementConnection"
+    ) {
+    totalCount: Int! @goField(forceResolver: true)
+    edges: [ApplicabilityStatementEdge!]!
+    pageInfo: PageInfo!
+}
+
+type ApplicabilityStatementEdge {
+    cursor: CursorKey!
+    node: ApplicabilityStatement!
+}
+
+type ApplicabilityStatement implements Node {
+    id: ID!
+    stateOfApplicability: StateOfApplicability! @goField(forceResolver: true)
+    control: Control! @goField(forceResolver: true)
+    applicability: Boolean!
+    justification: String!
+    createdAt: Datetime!
+    updatedAt: Datetime!
 
     permission(action: String!): Boolean! @goField(forceResolver: true)
 }
@@ -2801,6 +2834,7 @@ type StateOfApplicabilityEdge {
     node: StateOfApplicability!
 }
 
+
 type RiskConnection
     @goModel(
         model: "go.probo.inc/probo/pkg/server/api/console/v1/types.RiskConnection"
@@ -3124,12 +3158,15 @@ type Mutation {
     deleteControlDocumentMapping(
         input: DeleteControlDocumentMappingInput!
     ): DeleteControlDocumentMappingPayload!
-    createStateOfApplicabilityControlMapping(
-        input: CreateStateOfApplicabilityControlMappingInput!
-    ): CreateStateOfApplicabilityControlMappingPayload!
-    deleteStateOfApplicabilityControlMapping(
-        input: DeleteStateOfApplicabilityControlMappingInput!
-    ): DeleteStateOfApplicabilityControlMappingPayload!
+    createApplicabilityStatement(
+        input: CreateApplicabilityStatementInput!
+    ): CreateApplicabilityStatementPayload!
+    updateApplicabilityStatement(
+        input: UpdateApplicabilityStatementInput!
+    ): UpdateApplicabilityStatementPayload!
+    deleteApplicabilityStatement(
+        input: DeleteApplicabilityStatementInput!
+    ): DeleteApplicabilityStatementPayload!
     createControlAuditMapping(
         input: CreateControlAuditMappingInput!
     ): CreateControlAuditMappingPayload!
@@ -3678,16 +3715,21 @@ input DeleteControlDocumentMappingInput {
     documentId: ID!
 }
 
-input CreateStateOfApplicabilityControlMappingInput {
+input CreateApplicabilityStatementInput {
     stateOfApplicabilityId: ID!
     controlId: ID!
     applicability: Boolean!
     justification: String
 }
 
-input DeleteStateOfApplicabilityControlMappingInput {
-    stateOfApplicabilityId: ID!
-    controlId: ID!
+input UpdateApplicabilityStatementInput {
+    applicabilityStatementId: ID!
+    applicability: Boolean!
+    justification: String
+}
+
+input DeleteApplicabilityStatementInput {
+    applicabilityStatementId: ID!
 }
 
 input CreateControlAuditMappingInput {
@@ -3916,58 +3958,16 @@ input UpdateStateOfApplicabilityInput {
     ownerId: ID
 }
 
-input StateOfApplicabilityControlInput {
+input ApplicabilityStatementInput {
     controlId: ID!
     applicability: Boolean!
     justification: String
 }
 
-type AvailableStateOfApplicabilityControl {
-    controlId: ID!
-    sectionTitle: String!
-    name: String!
-    frameworkId: ID!
-    frameworkName: String!
-    organizationId: ID!
-    stateOfApplicabilityId: ID
-    applicability: Boolean
-    justification: String
-    bestPractice: Boolean!
-    regulatory: Boolean!
-    contractual: Boolean!
-    riskAssessment: Boolean!
-}
-
 input DeleteStateOfApplicabilityInput {
     stateOfApplicabilityId: ID!
 }
 
-type StateOfApplicabilityControl {
-    id: ID!
-    stateOfApplicabilityId: ID!
-    controlId: ID!
-    stateOfApplicability: StateOfApplicability! @goField(forceResolver: true)
-    applicability: Boolean!
-    justification: String
-}
-
-type StateOfApplicabilityControlConnection
-    @goModel(
-        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.StateOfApplicabilityControlConnection"
-    ) {
-    totalCount: Int!
-    edges: [StateOfApplicabilityControlEdge!]!
-    pageInfo: PageInfo!
-}
-
-type StateOfApplicabilityControlEdge
-    @goModel(
-        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.StateOfApplicabilityControlEdge"
-    ) {
-    cursor: CursorKey!
-    node: StateOfApplicabilityControl!
-}
-
 input ExportStateOfApplicabilityPDFInput {
     stateOfApplicabilityId: ID!
 }
@@ -4466,14 +4466,16 @@ type DeleteControlDocumentMappingPayload {
     deletedDocumentId: ID!
 }
 
-type CreateStateOfApplicabilityControlMappingPayload {
-    stateOfApplicabilityControlEdge: StateOfApplicabilityControlEdge!
+type CreateApplicabilityStatementPayload {
+    applicabilityStatementEdge: ApplicabilityStatementEdge!
 }
 
-type DeleteStateOfApplicabilityControlMappingPayload {
-    deletedStateOfApplicabilityId: ID!
-    deletedControlId: ID!
-    deletedStateOfApplicabilityControlId: ID!
+type UpdateApplicabilityStatementPayload {
+    applicabilityStatement: ApplicabilityStatement!
+}
+
+type DeleteApplicabilityStatementPayload {
+    deletedApplicabilityStatementId: ID!
 }
 
 type CreateControlAuditMappingPayload {

pkg/server/api/console/v1/types/applicability_statement_connection.go

@@ -0,0 +1,84 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type (
+	ApplicabilityStatementOrderBy OrderBy[coredata.ApplicabilityStatementOrderField]
+
+	ApplicabilityStatementConnection struct {
+		TotalCount int
+		Edges      []*ApplicabilityStatementEdge
+		PageInfo   PageInfo
+
+		Resolver any
+		ParentID gid.GID
+	}
+)
+
+func NewApplicabilityStatementConnection(
+	p *page.Page[*coredata.ApplicabilityStatement, coredata.ApplicabilityStatementOrderField],
+	parentType any,
+	parentID gid.GID,
+) *ApplicabilityStatementConnection {
+	edges := make([]*ApplicabilityStatementEdge, len(p.Data))
+	for i, statement := range p.Data {
+		edges[i] = NewApplicabilityStatementEdge(statement, p.Cursor.OrderBy.Field)
+	}
+
+	return &ApplicabilityStatementConnection{
+		Edges:    edges,
+		PageInfo: *NewPageInfo(p),
+
+		Resolver: parentType,
+		ParentID: parentID,
+	}
+}
+
+func NewApplicabilityStatementEdge(
+	statement *coredata.ApplicabilityStatement,
+	orderBy coredata.ApplicabilityStatementOrderField,
+) *ApplicabilityStatementEdge {
+	return &ApplicabilityStatementEdge{
+		Cursor: statement.CursorKey(orderBy),
+		Node:   NewApplicabilityStatement(statement),
+	}
+}
+
+func NewApplicabilityStatement(as *coredata.ApplicabilityStatement) *ApplicabilityStatement {
+	justification := ""
+	if as.Justification != nil {
+		justification = *as.Justification
+	}
+
+	return &ApplicabilityStatement{
+		ID: as.ID,
+		StateOfApplicability: &StateOfApplicability{
+			ID: as.StateOfApplicabilityID,
+		},
+		Control: &Control{
+			ID: as.ControlID,
+		},
+		Applicability: as.Applicability,
+		Justification: justification,
+		CreatedAt:     as.CreatedAt,
+		UpdatedAt:     as.UpdatedAt,
+	}
+}

pkg/server/api/console/v1/types/state_of_applicability_control_connection.go

@@ -1,76 +0,0 @@
-// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
-//
-// Permission to use, copy, modify, and/or distribute this software for any
-// purpose with or without fee is hereby granted, provided that the above
-// copyright notice and this permission notice appear in all copies.
-//
-// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-// PERFORMANCE OF THIS SOFTWARE.
-
-package types
-
-import (
-	"go.probo.inc/probo/pkg/coredata"
-	"go.probo.inc/probo/pkg/gid"
-	"go.probo.inc/probo/pkg/page"
-)
-
-type (
-	StateOfApplicabilityControlConnection struct {
-		TotalCount int
-		Edges      []*StateOfApplicabilityControlEdge
-		PageInfo   PageInfo
-
-		Resolver any
-		ParentID gid.GID
-	}
-
-	StateOfApplicabilityControlEdge struct {
-		Cursor page.CursorKey
-		Node   *StateOfApplicabilityControl
-	}
-)
-
-func NewStateOfApplicabilityControlConnection(
-	p *page.Page[*coredata.StateOfApplicabilityControl, coredata.StateOfApplicabilityOrderField],
-	parentType any,
-	parentID gid.GID,
-) *StateOfApplicabilityControlConnection {
-	edges := make([]*StateOfApplicabilityControlEdge, len(p.Data))
-	for i, control := range p.Data {
-		edges[i] = NewStateOfApplicabilityControlEdge(control, p.Cursor.OrderBy.Field)
-	}
-
-	return &StateOfApplicabilityControlConnection{
-		Edges:    edges,
-		PageInfo: *NewPageInfo(p),
-
-		Resolver: parentType,
-		ParentID: parentID,
-	}
-}
-
-func NewStateOfApplicabilityControlEdge(
-	control *coredata.StateOfApplicabilityControl,
-	orderBy coredata.StateOfApplicabilityOrderField,
-) *StateOfApplicabilityControlEdge {
-	return &StateOfApplicabilityControlEdge{
-		Cursor: control.CursorKey(orderBy),
-		Node:   NewStateOfApplicabilityControl(control),
-	}
-}
-
-func NewStateOfApplicabilityControl(control *coredata.StateOfApplicabilityControl) *StateOfApplicabilityControl {
-	return &StateOfApplicabilityControl{
-		ID:                     control.ID,
-		StateOfApplicabilityID: control.StateOfApplicabilityID,
-		ControlID:              control.ControlID,
-		Applicability:          control.Applicability,
-		Justification:          control.Justification,
-	}
-}

pkg/server/api/console/v1/types/types.go

@@ -17,6 +17,31 @@ type Node interface {
 	GetID() gid.GID
 }
 
+type ApplicabilityStatement struct {
+	ID                   gid.GID               `json:"id"`
+	StateOfApplicability *StateOfApplicability `json:"stateOfApplicability"`
+	Control              *Control              `json:"control"`
+	Applicability        bool                  `json:"applicability"`
+	Justification        string                `json:"justification"`
+	CreatedAt            time.Time             `json:"createdAt"`
+	UpdatedAt            time.Time             `json:"updatedAt"`
+	Permission           bool                  `json:"permission"`
+}
+
+func (ApplicabilityStatement) IsNode()             {}
+func (this ApplicabilityStatement) GetID() gid.GID { return this.ID }
+
+type ApplicabilityStatementEdge struct {
+	Cursor page.CursorKey          `json:"cursor"`
+	Node   *ApplicabilityStatement `json:"node"`
+}
+
+type ApplicabilityStatementInput struct {
+	ControlID     gid.GID `json:"controlId"`
+	Applicability bool    `json:"applicability"`
+	Justification *string `json:"justification,omitempty"`
+}
+
 type AssessVendorInput struct {
 	ID         gid.GID `json:"id"`
 	WebsiteURL string  `json:"websiteUrl"`
@@ -78,22 +103,6 @@ type AuditEdge struct {
 	Node   *Audit         `json:"node"`
 }
 
-type AvailableStateOfApplicabilityControl struct {
-	ControlID              gid.GID  `json:"controlId"`
-	SectionTitle           string   `json:"sectionTitle"`
-	Name                   string   `json:"name"`
-	FrameworkID            gid.GID  `json:"frameworkId"`
-	FrameworkName          string   `json:"frameworkName"`
-	OrganizationID         gid.GID  `json:"organizationId"`
-	StateOfApplicabilityID *gid.GID `json:"stateOfApplicabilityId,omitempty"`
-	Applicability          *bool    `json:"applicability,omitempty"`
-	Justification          *string  `json:"justification,omitempty"`
-	BestPractice           bool     `json:"bestPractice"`
-	Regulatory             bool     `json:"regulatory"`
-	Contractual            bool     `json:"contractual"`
-	RiskAssessment         bool     `json:"riskAssessment"`
-}
-
 type BulkDeleteDocumentsInput struct {
 	DocumentIds []gid.GID `json:"documentIds"`
 }
@@ -170,24 +179,26 @@ type ContinualImprovementFilter struct {
 }
 
 type Control struct {
-	ID                           gid.GID                                `json:"id"`
-	Organization                 *Organization                          `json:"organization,omitempty"`
-	SectionTitle                 string                                 `json:"sectionTitle"`
-	Name                         string                                 `json:"name"`
-	Description                  *string                                `json:"description,omitempty"`
-	Status                       coredata.ControlStatus                 `json:"status"`
-	ExclusionJustification       *string                                `json:"exclusionJustification,omitempty"`
-	BestPractice                 bool                                   `json:"bestPractice"`
-	Framework                    *Framework                             `json:"framework"`
-	Measures                     *MeasureConnection                     `json:"measures"`
-	Documents                    *DocumentConnection                    `json:"documents"`
-	Audits                       *AuditConnection                       `json:"audits"`
-	Obligations                  *ObligationConnection                  `json:"obligations"`
-	Snapshots                    *SnapshotConnection                    `json:"snapshots"`
-	StateOfApplicabilityControls *StateOfApplicabilityControlConnection `json:"stateOfApplicabilityControls"`
-	CreatedAt                    time.Time                              `json:"createdAt"`
-	UpdatedAt                    time.Time                              `json:"updatedAt"`
-	Permission                   bool                                   `json:"permission"`
+	ID                     gid.GID                `json:"id"`
+	Organization           *Organization          `json:"organization,omitempty"`
+	SectionTitle           string                 `json:"sectionTitle"`
+	Name                   string                 `json:"name"`
+	Description            *string                `json:"description,omitempty"`
+	Status                 coredata.ControlStatus `json:"status"`
+	ExclusionJustification *string                `json:"exclusionJustification,omitempty"`
+	BestPractice           bool                   `json:"bestPractice"`
+	Regulatory             bool                   `json:"regulatory"`
+	Contractual            bool                   `json:"contractual"`
+	RiskAssessment         bool                   `json:"riskAssessment"`
+	Framework              *Framework             `json:"framework"`
+	Measures               *MeasureConnection     `json:"measures"`
+	Documents              *DocumentConnection    `json:"documents"`
+	Audits                 *AuditConnection       `json:"audits"`
+	Obligations            *ObligationConnection  `json:"obligations"`
+	Snapshots              *SnapshotConnection    `json:"snapshots"`
+	CreatedAt              time.Time              `json:"createdAt"`
+	UpdatedAt              time.Time              `json:"updatedAt"`
+	Permission             bool                   `json:"permission"`
 }
 
 func (Control) IsNode()             {}
@@ -202,6 +213,17 @@ type ControlFilter struct {
 	Query *string `json:"query,omitempty"`
 }
 
+type CreateApplicabilityStatementInput struct {
+	StateOfApplicabilityID gid.GID `json:"stateOfApplicabilityId"`
+	ControlID              gid.GID `json:"controlId"`
+	Applicability          bool    `json:"applicability"`
+	Justification          *string `json:"justification,omitempty"`
+}
+
+type CreateApplicabilityStatementPayload struct {
+	ApplicabilityStatementEdge *ApplicabilityStatementEdge `json:"applicabilityStatementEdge"`
+}
+
 type CreateAssetInput struct {
 	OrganizationID  gid.GID            `json:"organizationId"`
 	Name            string             `json:"name"`
@@ -552,17 +574,6 @@ type CreateSnapshotPayload struct {
 	SnapshotEdge *SnapshotEdge `json:"snapshotEdge"`
 }
 
-type CreateStateOfApplicabilityControlMappingInput struct {
-	StateOfApplicabilityID gid.GID `json:"stateOfApplicabilityId"`
-	ControlID              gid.GID `json:"controlId"`
-	Applicability          bool    `json:"applicability"`
-	Justification          *string `json:"justification,omitempty"`
-}
-
-type CreateStateOfApplicabilityControlMappingPayload struct {
-	StateOfApplicabilityControlEdge *StateOfApplicabilityControlEdge `json:"stateOfApplicabilityControlEdge"`
-}
-
 type CreateStateOfApplicabilityInput struct {
 	OrganizationID gid.GID `json:"organizationId"`
 	Name           string  `json:"name"`
@@ -756,6 +767,14 @@ type DatumFilter struct {
 	SnapshotID *gid.GID `json:"snapshotId,omitempty"`
 }
 
+type DeleteApplicabilityStatementInput struct {
+	ApplicabilityStatementID gid.GID `json:"applicabilityStatementId"`
+}
+
+type DeleteApplicabilityStatementPayload struct {
+	DeletedApplicabilityStatementID gid.GID `json:"deletedApplicabilityStatementId"`
+}
+
 type DeleteAssetInput struct {
 	AssetID gid.GID `json:"assetId"`
 }
@@ -1004,17 +1023,6 @@ type DeleteSnapshotPayload struct {
 	DeletedSnapshotID gid.GID `json:"deletedSnapshotId"`
 }
 
-type DeleteStateOfApplicabilityControlMappingInput struct {
-	StateOfApplicabilityID gid.GID `json:"stateOfApplicabilityId"`
-	ControlID              gid.GID `json:"controlId"`
-}
-
-type DeleteStateOfApplicabilityControlMappingPayload struct {
-	DeletedStateOfApplicabilityID        gid.GID `json:"deletedStateOfApplicabilityId"`
-	DeletedControlID                     gid.GID `json:"deletedControlId"`
-	DeletedStateOfApplicabilityControlID gid.GID `json:"deletedStateOfApplicabilityControlId"`
-}
-
 type DeleteStateOfApplicabilityInput struct {
 	StateOfApplicabilityID gid.GID `json:"stateOfApplicabilityId"`
 }
@@ -1746,37 +1754,21 @@ type SnapshotEdge struct {
 }
 
 type StateOfApplicability struct {
-	ID                gid.GID                                 `json:"id"`
-	Name              string                                  `json:"name"`
-	SourceID          *gid.GID                                `json:"sourceId,omitempty"`
-	SnapshotID        *gid.GID                                `json:"snapshotId,omitempty"`
-	Organization      *Organization                           `json:"organization,omitempty"`
-	Owner             *People                                 `json:"owner"`
-	CreatedAt         time.Time                               `json:"createdAt"`
-	UpdatedAt         time.Time                               `json:"updatedAt"`
-	Controls          *ControlConnection                      `json:"controls"`
-	AvailableControls []*AvailableStateOfApplicabilityControl `json:"availableControls"`
-	Permission        bool                                    `json:"permission"`
+	ID                      gid.GID                           `json:"id"`
+	Name                    string                            `json:"name"`
+	SourceID                *gid.GID                          `json:"sourceId,omitempty"`
+	SnapshotID              *gid.GID                          `json:"snapshotId,omitempty"`
+	Organization            *Organization                     `json:"organization,omitempty"`
+	Owner                   *People                           `json:"owner"`
+	CreatedAt               time.Time                         `json:"createdAt"`
+	UpdatedAt               time.Time                         `json:"updatedAt"`
+	ApplicabilityStatements *ApplicabilityStatementConnection `json:"applicabilityStatements"`
+	Permission              bool                              `json:"permission"`
 }
 
 func (StateOfApplicability) IsNode()             {}
 func (this StateOfApplicability) GetID() gid.GID { return this.ID }
 
-type StateOfApplicabilityControl struct {
-	ID                     gid.GID               `json:"id"`
-	StateOfApplicabilityID gid.GID               `json:"stateOfApplicabilityId"`
-	ControlID              gid.GID               `json:"controlId"`
-	StateOfApplicability   *StateOfApplicability `json:"stateOfApplicability"`
-	Applicability          bool                  `json:"applicability"`
-	Justification          *string               `json:"justification,omitempty"`
-}
-
-type StateOfApplicabilityControlInput struct {
-	ControlID     gid.GID `json:"controlId"`
-	Applicability bool    `json:"applicability"`
-	Justification *string `json:"justification,omitempty"`
-}
-
 type StateOfApplicabilityEdge struct {
 	Cursor page.CursorKey        `json:"cursor"`
 	Node   *StateOfApplicability `json:"node"`
@@ -1940,6 +1932,16 @@ type TrustCenterReferenceEdge struct {
 	Node   *TrustCenterReference `json:"node"`
 }
 
+type UpdateApplicabilityStatementInput struct {
+	ApplicabilityStatementID gid.GID `json:"applicabilityStatementId"`
+	Applicability            bool    `json:"applicability"`
+	Justification            *string `json:"justification,omitempty"`
+}
+
+type UpdateApplicabilityStatementPayload struct {
+	ApplicabilityStatement *ApplicabilityStatement `json:"applicabilityStatement"`
+}
+
 type UpdateAssetInput struct {
 	ID              gid.GID             `json:"id"`
 	Name            *string             `json:"name,omitempty"`

pkg/server/api/console/v1/v1_resolver.go

@@ -26,6 +26,63 @@ import (
 	"go.probo.inc/probo/pkg/server/gqlutils"
 )
 
+// StateOfApplicability is the resolver for the stateOfApplicability field.
+func (r *applicabilityStatementResolver) StateOfApplicability(ctx context.Context, obj *types.ApplicabilityStatement) (*types.StateOfApplicability, error) {
+	if err := r.authorize(ctx, obj.StateOfApplicability.ID, probo.ActionStateOfApplicabilityGet); err != nil {
+		return nil, err
+	}
+
+	prb := r.ProboService(ctx, obj.StateOfApplicability.ID.TenantID())
+
+	soa, err := prb.StatesOfApplicability.Get(ctx, obj.StateOfApplicability.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot get state of applicability: %w", err))
+	}
+
+	return types.NewStateOfApplicability(soa), nil
+}
+
+// Control is the resolver for the control field.
+func (r *applicabilityStatementResolver) Control(ctx context.Context, obj *types.ApplicabilityStatement) (*types.Control, error) {
+	if err := r.authorize(ctx, obj.ID, probo.ActionControlGet); err != nil {
+		return nil, err
+	}
+
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	control, err := prb.Controls.Get(ctx, obj.Control.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot get control: %w", err))
+	}
+
+	return types.NewControl(control), nil
+}
+
+// Permission is the resolver for the permission field.
+func (r *applicabilityStatementResolver) Permission(ctx context.Context, obj *types.ApplicabilityStatement, action string) (bool, error) {
+	return r.Resolver.Permission(ctx, obj, action)
+}
+
+// TotalCount is the resolver for the totalCount field.
+func (r *applicabilityStatementConnectionResolver) TotalCount(ctx context.Context, obj *types.ApplicabilityStatementConnection) (int, error) {
+	if err := r.authorize(ctx, obj.ParentID, probo.ActionApplicabilityStatementList); err != nil {
+		return 0, err
+	}
+
+	prb := r.ProboService(ctx, obj.ParentID.TenantID())
+
+	switch obj.Resolver.(type) {
+	case *stateOfApplicabilityResolver:
+		count, err := prb.StatesOfApplicability.CountApplicabilityStatements(ctx, obj.ParentID)
+		if err != nil {
+			panic(fmt.Errorf("cannot count applicability statements: %w", err))
+		}
+		return count, nil
+	}
+
+	panic(fmt.Errorf("not implemented: TotalCount for parent type %T", obj.Resolver))
+}
+
 // Owner is the resolver for the owner field.
 func (r *assetResolver) Owner(ctx context.Context, obj *types.Asset) (*types.People, error) {
 	if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil {
@@ -359,6 +416,42 @@ func (r *controlResolver) Organization(ctx context.Context, obj *types.Control)
 	return types.NewOrganization(organization), nil
 }
 
+// Regulatory is the resolver for the regulatory field.
+func (r *controlResolver) Regulatory(ctx context.Context, obj *types.Control) (bool, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	hasRegulatory, err := prb.Controls.HasRegulatoryObligation(ctx, obj.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot check regulatory obligation: %w", err))
+	}
+
+	return hasRegulatory, nil
+}
+
+// Contractual is the resolver for the contractual field.
+func (r *controlResolver) Contractual(ctx context.Context, obj *types.Control) (bool, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	hasContractual, err := prb.Controls.HasContractualObligation(ctx, obj.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot check contractual obligation: %w", err))
+	}
+
+	return hasContractual, nil
+}
+
+// RiskAssessment is the resolver for the riskAssessment field.
+func (r *controlResolver) RiskAssessment(ctx context.Context, obj *types.Control) (bool, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	hasRisk, err := prb.Controls.HasRiskAssessment(ctx, obj.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot check risk assessment: %w", err))
+	}
+
+	return hasRisk, nil
+}
+
 // Framework is the resolver for the framework field.
 func (r *controlResolver) Framework(ctx context.Context, obj *types.Control) (*types.Framework, error) {
 	if err := r.authorize(ctx, obj.ID, probo.ActionFrameworkGet); err != nil {
@@ -542,35 +635,6 @@ func (r *controlResolver) Snapshots(ctx context.Context, obj *types.Control, fir
 	return types.NewSnapshotConnection(page, r, obj.ID), nil
 }
 
-// StateOfApplicabilityControls is the resolver for the stateOfApplicabilityControls field.
-func (r *controlResolver) StateOfApplicabilityControls(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.StateOfApplicabilityOrderBy) (*types.StateOfApplicabilityControlConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionStateOfApplicabilityList); err != nil {
-		return nil, err
-	}
-
-	prb := r.ProboService(ctx, obj.ID.TenantID())
-
-	pageOrderBy := page.OrderBy[coredata.StateOfApplicabilityOrderField]{
-		Field:     coredata.StateOfApplicabilityOrderFieldCreatedAt,
-		Direction: page.OrderDirectionDesc,
-	}
-	if orderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.StateOfApplicabilityOrderField]{
-			Field:     orderBy.Field,
-			Direction: orderBy.Direction,
-		}
-	}
-
-	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
-
-	p, err := prb.StatesOfApplicability.ListControlLinks(ctx, obj.ID, cursor)
-	if err != nil {
-		panic(fmt.Errorf("cannot list state of applicability controls: %w", err))
-	}
-
-	return types.NewStateOfApplicabilityControlConnection(p, r, obj.ID), nil
-}
-
 // Permission is the resolver for the permission field.
 func (r *controlResolver) Permission(ctx context.Context, obj *types.Control, action string) (bool, error) {
 	return r.Resolver.Permission(ctx, obj, action)
@@ -2730,41 +2794,57 @@ func (r *mutationResolver) DeleteControlDocumentMapping(ctx context.Context, inp
 	}, nil
 }
 
-// CreateStateOfApplicabilityControlMapping is the resolver for the createStateOfApplicabilityControlMapping field.
-func (r *mutationResolver) CreateStateOfApplicabilityControlMapping(ctx context.Context, input types.CreateStateOfApplicabilityControlMappingInput) (*types.CreateStateOfApplicabilityControlMappingPayload, error) {
-	if err := r.authorize(ctx, input.ControlID, probo.ActionStateOfApplicabilityControlMappingCreate); err != nil {
+// CreateApplicabilityStatement is the resolver for the createApplicabilityStatement field.
+func (r *mutationResolver) CreateApplicabilityStatement(ctx context.Context, input types.CreateApplicabilityStatementInput) (*types.CreateApplicabilityStatementPayload, error) {
+	if err := r.authorize(ctx, input.ControlID, probo.ActionApplicabilityStatementCreate); err != nil {
 		return nil, err
 	}
 
 	prb := r.ProboService(ctx, input.StateOfApplicabilityID.TenantID())
 
-	control, err := prb.StatesOfApplicability.LinkControl(ctx, input.StateOfApplicabilityID, input.ControlID, input.Applicability, input.Justification)
+	applicabilityStatement, err := prb.StatesOfApplicability.CreateApplicabilityStatement(ctx, input.StateOfApplicabilityID, input.ControlID, input.Applicability, input.Justification)
 	if err != nil {
-		panic(fmt.Errorf("cannot create state of applicability control mapping: %w", err))
+		panic(fmt.Errorf("cannot create applicability statement: %w", err))
 	}
 
-	return &types.CreateStateOfApplicabilityControlMappingPayload{
-		StateOfApplicabilityControlEdge: types.NewStateOfApplicabilityControlEdge(control, coredata.StateOfApplicabilityOrderFieldCreatedAt),
+	return &types.CreateApplicabilityStatementPayload{
+		ApplicabilityStatementEdge: types.NewApplicabilityStatementEdge(applicabilityStatement, coredata.ApplicabilityStatementOrderFieldCreatedAt),
 	}, nil
 }
 
-// DeleteStateOfApplicabilityControlMapping is the resolver for the deleteStateOfApplicabilityControlMapping field.
-func (r *mutationResolver) DeleteStateOfApplicabilityControlMapping(ctx context.Context, input types.DeleteStateOfApplicabilityControlMappingInput) (*types.DeleteStateOfApplicabilityControlMappingPayload, error) {
-	if err := r.authorize(ctx, input.StateOfApplicabilityID, probo.ActionStateOfApplicabilityControlMappingDelete); err != nil {
+// UpdateApplicabilityStatement is the resolver for the updateApplicabilityStatement field.
+func (r *mutationResolver) UpdateApplicabilityStatement(ctx context.Context, input types.UpdateApplicabilityStatementInput) (*types.UpdateApplicabilityStatementPayload, error) {
+	if err := r.authorize(ctx, input.ApplicabilityStatementID, probo.ActionApplicabilityStatementUpdate); err != nil {
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, input.StateOfApplicabilityID.TenantID())
+	prb := r.ProboService(ctx, input.ApplicabilityStatementID.TenantID())
 
-	deletedID, err := prb.StatesOfApplicability.DeleteControlLink(ctx, input.StateOfApplicabilityID, input.ControlID)
+	applicabilityStatement, err := prb.StatesOfApplicability.UpdateApplicabilityStatement(ctx, input.ApplicabilityStatementID, input.Applicability, input.Justification)
 	if err != nil {
-		panic(fmt.Errorf("cannot delete state of applicability control mapping: %w", err))
+		panic(fmt.Errorf("cannot update applicability statement: %w", err))
 	}
 
-	return &types.DeleteStateOfApplicabilityControlMappingPayload{
-		DeletedStateOfApplicabilityID:        input.StateOfApplicabilityID,
-		DeletedControlID:                     input.ControlID,
-		DeletedStateOfApplicabilityControlID: deletedID,
+	return &types.UpdateApplicabilityStatementPayload{
+		ApplicabilityStatement: types.NewApplicabilityStatement(applicabilityStatement),
+	}, nil
+}
+
+// DeleteApplicabilityStatement is the resolver for the deleteApplicabilityStatement field.
+func (r *mutationResolver) DeleteApplicabilityStatement(ctx context.Context, input types.DeleteApplicabilityStatementInput) (*types.DeleteApplicabilityStatementPayload, error) {
+	if err := r.authorize(ctx, input.ApplicabilityStatementID, probo.ActionApplicabilityStatementDelete); err != nil {
+		return nil, err
+	}
+
+	prb := r.ProboService(ctx, input.ApplicabilityStatementID.TenantID())
+
+	err := prb.StatesOfApplicability.DeleteApplicabilityStatement(ctx, input.ApplicabilityStatementID)
+	if err != nil {
+		panic(fmt.Errorf("cannot delete applicability statement: %w", err))
+	}
+
+	return &types.DeleteApplicabilityStatementPayload{
+		DeletedApplicabilityStatementID: input.ApplicabilityStatementID,
 	}, nil
 }
 
@@ -7201,73 +7281,33 @@ func (r *stateOfApplicabilityResolver) Owner(ctx context.Context, obj *types.Sta
 	return types.NewPeople(people), nil
 }
 
-// Controls is the resolver for the controls field.
-func (r *stateOfApplicabilityResolver) Controls(ctx context.Context, obj *types.StateOfApplicability, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy, filter *types.ControlFilter) (*types.ControlConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionControlList); err != nil {
+// ApplicabilityStatements is the resolver for the applicabilityStatements field.
+func (r *stateOfApplicabilityResolver) ApplicabilityStatements(ctx context.Context, obj *types.StateOfApplicability, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ApplicabilityStatementOrderBy) (*types.ApplicabilityStatementConnection, error) {
+	if err := r.authorize(ctx, obj.ID, probo.ActionApplicabilityStatementList); err != nil {
 		return nil, err
 	}
 
 	prb := r.ProboService(ctx, obj.ID.TenantID())
 
-	pageOrderBy := page.OrderBy[coredata.ControlOrderField]{
-		Field:     coredata.ControlOrderFieldCreatedAt,
-		Direction: page.OrderDirectionDesc,
+	pageOrderBy := page.OrderBy[coredata.ApplicabilityStatementOrderField]{
+		Field:     coredata.ApplicabilityStatementOrderFieldCreatedAt,
+		Direction: page.OrderDirectionAsc,
 	}
 	if orderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.ControlOrderField]{
-			Field:     orderBy.Field,
+		pageOrderBy = page.OrderBy[coredata.ApplicabilityStatementOrderField]{
+			Field:     coredata.ApplicabilityStatementOrderField(orderBy.Field),
 			Direction: orderBy.Direction,
 		}
 	}
 
 	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
 
-	var controlFilter = coredata.NewControlFilter(nil)
-	if filter != nil {
-		controlFilter = coredata.NewControlFilter(filter.Query)
-	}
-
-	page, err := prb.Controls.ListForStateOfApplicabilityID(ctx, obj.ID, cursor, controlFilter)
+	p, err := prb.StatesOfApplicability.ListApplicabilityStatements(ctx, obj.ID, cursor)
 	if err != nil {
-		panic(fmt.Errorf("cannot list state of applicability controls: %w", err))
+		panic(fmt.Errorf("cannot list applicability statements: %w", err))
 	}
 
-	return types.NewControlConnection(page, r, obj.ID, controlFilter), nil
-}
-
-// AvailableControls is the resolver for the availableControls field.
-func (r *stateOfApplicabilityResolver) AvailableControls(ctx context.Context, obj *types.StateOfApplicability) ([]*types.AvailableStateOfApplicabilityControl, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionControlList); err != nil {
-		return nil, err
-	}
-
-	prb := r.ProboService(ctx, obj.ID.TenantID())
-
-	availableControls, err := prb.StatesOfApplicability.ListAvailableControls(ctx, obj.ID)
-	if err != nil {
-		panic(fmt.Errorf("cannot list available controls: %w", err))
-	}
-
-	result := make([]*types.AvailableStateOfApplicabilityControl, 0, len(availableControls))
-	for _, ac := range availableControls {
-		result = append(result, &types.AvailableStateOfApplicabilityControl{
-			ControlID:              ac.ControlID,
-			SectionTitle:           ac.SectionTitle,
-			Name:                   ac.Name,
-			FrameworkID:            ac.FrameworkID,
-			FrameworkName:          ac.FrameworkName,
-			OrganizationID:         ac.OrganizationID,
-			StateOfApplicabilityID: ac.StateOfApplicabilityID,
-			Applicability:          ac.Applicability,
-			Justification:          ac.Justification,
-			BestPractice:           ac.BestPractice,
-			Regulatory:             ac.Regulatory,
-			Contractual:            ac.Contractual,
-			RiskAssessment:         ac.RiskAssessment,
-		})
-	}
-
-	return result, nil
+	return types.NewApplicabilityStatementConnection(p, r, obj.ID), nil
 }
 
 // Permission is the resolver for the permission field.
@@ -7291,22 +7331,6 @@ func (r *stateOfApplicabilityConnectionResolver) TotalCount(ctx context.Context,
 	panic(fmt.Errorf("unsupported resolver: %T", obj.Resolver))
 }
 
-// StateOfApplicability is the resolver for the stateOfApplicability field.
-func (r *stateOfApplicabilityControlResolver) StateOfApplicability(ctx context.Context, obj *types.StateOfApplicabilityControl) (*types.StateOfApplicability, error) {
-	if err := r.authorize(ctx, obj.StateOfApplicabilityID, probo.ActionStateOfApplicabilityGet); err != nil {
-		return nil, err
-	}
-
-	prb := r.ProboService(ctx, obj.StateOfApplicabilityID.TenantID())
-
-	soa, err := prb.StatesOfApplicability.Get(ctx, obj.StateOfApplicabilityID)
-	if err != nil {
-		panic(fmt.Errorf("cannot get state of applicability: %w", err))
-	}
-
-	return types.NewStateOfApplicability(soa), nil
-}
-
 // AssignedTo is the resolver for the assignedTo field.
 func (r *taskResolver) AssignedTo(ctx context.Context, obj *types.Task) (*types.People, error) {
 	if err := r.authorize(ctx, obj.ID, probo.ActionPeopleGet); err != nil {
@@ -8420,6 +8444,16 @@ func (r *viewerResolver) SignableDocument(ctx context.Context, obj *types.Viewer
 	}, nil
 }
 
+// ApplicabilityStatement returns schema.ApplicabilityStatementResolver implementation.
+func (r *Resolver) ApplicabilityStatement() schema.ApplicabilityStatementResolver {
+	return &applicabilityStatementResolver{r}
+}
+
+// ApplicabilityStatementConnection returns schema.ApplicabilityStatementConnectionResolver implementation.
+func (r *Resolver) ApplicabilityStatementConnection() schema.ApplicabilityStatementConnectionResolver {
+	return &applicabilityStatementConnectionResolver{r}
+}
+
 // Asset returns schema.AssetResolver implementation.
 func (r *Resolver) Asset() schema.AssetResolver { return &assetResolver{r} }
 
@@ -8611,11 +8645,6 @@ func (r *Resolver) StateOfApplicabilityConnection() schema.StateOfApplicabilityC
 	return &stateOfApplicabilityConnectionResolver{r}
 }
 
-// StateOfApplicabilityControl returns schema.StateOfApplicabilityControlResolver implementation.
-func (r *Resolver) StateOfApplicabilityControl() schema.StateOfApplicabilityControlResolver {
-	return &stateOfApplicabilityControlResolver{r}
-}
-
 // Task returns schema.TaskResolver implementation.
 func (r *Resolver) Task() schema.TaskResolver { return &taskResolver{r} }
 
@@ -8707,6 +8736,8 @@ func (r *Resolver) VendorService() schema.VendorServiceResolver { return &vendor
 // Viewer returns schema.ViewerResolver implementation.
 func (r *Resolver) Viewer() schema.ViewerResolver { return &viewerResolver{r} }
 
+type applicabilityStatementResolver struct{ *Resolver }
+type applicabilityStatementConnectionResolver struct{ *Resolver }
 type assetResolver struct{ *Resolver }
 type assetConnectionResolver struct{ *Resolver }
 type auditResolver struct{ *Resolver }
@@ -8754,7 +8785,6 @@ type snapshotResolver struct{ *Resolver }
 type snapshotConnectionResolver struct{ *Resolver }
 type stateOfApplicabilityResolver struct{ *Resolver }
 type stateOfApplicabilityConnectionResolver struct{ *Resolver }
-type stateOfApplicabilityControlResolver struct{ *Resolver }
 type taskResolver struct{ *Resolver }
 type taskConnectionResolver struct{ *Resolver }
 type transferImpactAssessmentResolver struct{ *Resolver }