Add first risk assememnt implementation

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/coredata/business_impact.go

@@ -0,0 +1,60 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+func (bi BusinessImpact) MarshalText() ([]byte, error) {
+	return []byte(bi.String()), nil
+}
+
+func (bi *BusinessImpact) UnmarshalText(data []byte) error {
+	val := string(data)
+
+	switch val {
+	case BusinessImpactLow.String():
+		*bi = BusinessImpactLow
+	case BusinessImpactMedium.String():
+		*bi = BusinessImpactMedium
+	case BusinessImpactHigh.String():
+		*bi = BusinessImpactHigh
+	case BusinessImpactCritical.String():
+		*bi = BusinessImpactCritical
+	default:
+		return fmt.Errorf("invalid BusinessImpact value: %q", val)
+	}
+
+	return nil
+}
+
+func (bi BusinessImpact) String() string {
+	return string(bi)
+}
+
+func (bi *BusinessImpact) Scan(value any) error {
+	val, ok := value.(string)
+	if !ok {
+		return fmt.Errorf("invalid scan source for BusinessImpact, expected string got %T", value)
+	}
+
+	return bi.UnmarshalText([]byte(val))
+}
+
+func (bi BusinessImpact) Value() (driver.Value, error) {
+	return bi.String(), nil
+}

pkg/coredata/data_sensitivity.go

@@ -0,0 +1,62 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+func (ds DataSensitivity) MarshalText() ([]byte, error) {
+	return []byte(ds.String()), nil
+}
+
+func (ds *DataSensitivity) UnmarshalText(data []byte) error {
+	val := string(data)
+
+	switch val {
+	case DataSensitivityNone.String():
+		*ds = DataSensitivityNone
+	case DataSensitivityLow.String():
+		*ds = DataSensitivityLow
+	case DataSensitivityMedium.String():
+		*ds = DataSensitivityMedium
+	case DataSensitivityHigh.String():
+		*ds = DataSensitivityHigh
+	case DataSensitivityCritical.String():
+		*ds = DataSensitivityCritical
+	default:
+		return fmt.Errorf("invalid DataSensitivity value: %q", val)
+	}
+
+	return nil
+}
+
+func (ds DataSensitivity) String() string {
+	return string(ds)
+}
+
+func (ds *DataSensitivity) Scan(value any) error {
+	val, ok := value.(string)
+	if !ok {
+		return fmt.Errorf("invalid scan source for DataSensitivity, expected string got %T", value)
+	}
+
+	return ds.UnmarshalText([]byte(val))
+}
+
+func (ds DataSensitivity) Value() (driver.Value, error) {
+	return ds.String(), nil
+}

pkg/coredata/entity_type_reg.go

@@ -21,7 +21,7 @@ const (
 	TaskEntityType
 	EvidenceEntityType
 	ConnectorEntityType
-	_TaskStateTransitionEntityType // UNUSED
+	VendorRiskAssessmentEntityType
 	VendorEntityType
 	PeopleEntityType
 	VendorComplianceReportEntityType

pkg/coredata/migrations/20240421T032700Z.sql

@@ -0,0 +1 @@
+ALTER TABLE peoples DROP COLUMN version;

pkg/coredata/migrations/20250420T120000Z.sql

@@ -0,0 +1,305 @@
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+
+-- PostgreSQL implementation of the GID generation system
+
+-- 1. First, create functions for TenantID generation
+CREATE OR REPLACE FUNCTION generate_machine_id()
+RETURNS bytea AS $func$
+DECLARE
+    machine_id bytea;
+BEGIN
+    -- Generate 3 random bytes for machine ID
+    machine_id := decode(encode(gen_random_bytes(3), 'hex'), 'hex');
+    RETURN machine_id;
+END;
+$func$ LANGUAGE plpgsql STABLE;
+
+-- Store machine ID as a database-wide setting (run once)
+DO $block$
+BEGIN
+    -- Check if the setting exists
+    IF NOT EXISTS (SELECT 1 FROM pg_settings WHERE name = 'app.machine_id') THEN
+        -- Create custom parameter in postgresql.conf or via ALTER SYSTEM
+        PERFORM set_config('app.machine_id', encode(generate_machine_id(), 'hex'), false);
+    END IF;
+END $block$;
+
+-- Counter for tenant ID generation (used atomically)
+CREATE SEQUENCE IF NOT EXISTS tenant_id_counter_seq;
+
+-- Function to generate a TenantID
+CREATE OR REPLACE FUNCTION generate_tenant_id()
+RETURNS bytea AS $func$
+DECLARE
+    id bytea;
+    machine_id bytea;
+    timestamp_bytes bytea;
+    counter_bytes bytea;
+    counter_val int;
+BEGIN
+    -- 1. Get machine ID (3 bytes)
+    machine_id := decode(current_setting('app.machine_id'), 'hex');
+    
+    -- 2. Get timestamp bytes (3 bytes - Unix time in seconds)
+    timestamp_bytes := substring(int8send(extract(epoch from now())::bigint) from 6 for 3);
+    
+    -- 3. Get counter (2 bytes)
+    counter_val := nextval('tenant_id_counter_seq') % 65536; -- 2^16
+    counter_bytes := substring(int4send(counter_val) from 3 for 2);
+    
+    -- 4. Combine all parts
+    id := machine_id || timestamp_bytes || counter_bytes;
+    
+    RETURN id;
+END;
+$func$ LANGUAGE plpgsql VOLATILE;
+
+-- Function to convert TenantID to string
+CREATE OR REPLACE FUNCTION tenant_id_to_string(tenant_id bytea)
+RETURNS text AS $func$
+BEGIN
+    -- Make sure to handle padding properly - remove trailing '=' characters
+    RETURN rtrim(translate(encode(tenant_id, 'base64'), '+/', '-_'), '=');
+END;
+$func$ LANGUAGE plpgsql IMMUTABLE;
+
+-- Function to parse tenant ID from string
+CREATE OR REPLACE FUNCTION parse_tenant_id(encoded text)
+RETURNS bytea AS $func$
+DECLARE
+    decoded bytea;
+    padded_input text;
+    padding_needed int;
+BEGIN
+    -- Add proper padding for base64 decoding
+    padding_needed := (4 - (length(encoded) % 4)) % 4;
+    padded_input := encoded || repeat('=', padding_needed);
+    
+    -- Replace URL-safe chars and decode
+    BEGIN
+        decoded := decode(translate(padded_input, '-_', '+/'), 'base64');
+    EXCEPTION WHEN OTHERS THEN
+        RAISE EXCEPTION 'Invalid base64 encoding in tenant ID';
+    END;
+    
+    -- Validate length
+    IF octet_length(decoded) != 8 THEN
+        RAISE EXCEPTION 'Invalid tenant ID length: got %, want 8', octet_length(decoded);
+    END IF;
+    
+    RETURN decoded;
+END;
+$func$ LANGUAGE plpgsql IMMUTABLE;
+
+-- 2. Now create functions for full GID generation
+
+-- Function to generate a GID
+CREATE OR REPLACE FUNCTION generate_gid(tenant_id bytea, entity_type int)
+RETURNS bytea AS $func$
+DECLARE
+    id bytea;
+    timestamp_ms_bytes bytea;
+    entity_type_bytes bytea;
+    random_bytes bytea;
+BEGIN
+    -- Validate tenant_id
+    IF tenant_id IS NULL OR octet_length(tenant_id) != 8 THEN
+        RAISE EXCEPTION 'Invalid tenant ID: must be 8 bytes';
+    END IF;
+
+    -- 1. Start with tenant ID (8 bytes)
+    id := tenant_id;
+    
+    -- 2. Add entity type (2 bytes)
+    entity_type_bytes := substring(int4send(entity_type) from 3 for 2);
+    id := id || entity_type_bytes;
+    
+    -- 3. Add timestamp in milliseconds (8 bytes)
+    -- Extract milliseconds since epoch
+    timestamp_ms_bytes := int8send(
+        (extract(epoch from now()) * 1000)::bigint
+    );
+    id := id || timestamp_ms_bytes;
+    
+    -- 4. Add random bytes for uniqueness (6 bytes)
+    random_bytes := gen_random_bytes(6);
+    id := id || random_bytes;
+    
+    RETURN id;
+END;
+$func$ LANGUAGE plpgsql VOLATILE;
+
+-- Note: removed the single-parameter overload - tenant_id must be explicitly provided
+
+-- Function to convert GID to string
+CREATE OR REPLACE FUNCTION gid_to_string(gid bytea)
+RETURNS text AS $func$
+BEGIN
+    -- Make sure to handle padding properly - remove trailing '=' characters
+    RETURN rtrim(translate(encode(gid, 'base64'), '+/', '-_'), '=');
+END;
+$func$ LANGUAGE plpgsql IMMUTABLE;
+
+-- Function to parse GID from string
+CREATE OR REPLACE FUNCTION parse_gid(encoded text)
+RETURNS bytea AS $func$
+DECLARE
+    decoded bytea;
+    padded_input text;
+    padding_needed int;
+BEGIN
+    -- Add proper padding for base64 decoding
+    padding_needed := (4 - (length(encoded) % 4)) % 4;
+    padded_input := encoded || repeat('=', padding_needed);
+    
+    -- Replace URL-safe chars and decode
+    BEGIN
+        decoded := decode(translate(padded_input, '-_', '+/'), 'base64');
+    EXCEPTION WHEN OTHERS THEN
+        RAISE EXCEPTION 'Invalid base64 encoding in GID';
+    END;
+    
+    -- Validate length
+    IF octet_length(decoded) != 24 THEN
+        RAISE EXCEPTION 'Invalid GID length: got %, want 24', octet_length(decoded);
+    END IF;
+    
+    RETURN decoded;
+END;
+$func$ LANGUAGE plpgsql IMMUTABLE;
+
+-- Extract tenant ID from GID
+CREATE OR REPLACE FUNCTION extract_tenant_id(gid bytea)
+RETURNS bytea AS $func$
+BEGIN
+    RETURN substring(gid from 1 for 8);
+END;
+$func$ LANGUAGE plpgsql IMMUTABLE;
+
+-- Extract entity type from GID
+CREATE OR REPLACE FUNCTION extract_entity_type(gid bytea)
+RETURNS int AS $func$
+BEGIN
+    RETURN get_byte(gid, 8) * 256 + get_byte(gid, 9);
+END;
+$func$ LANGUAGE plpgsql IMMUTABLE;
+
+-- Extract timestamp from GID
+CREATE OR REPLACE FUNCTION extract_timestamp(gid bytea)
+RETURNS timestamp AS $func$
+DECLARE
+    ms bigint;
+BEGIN
+    ms := (get_byte(gid, 10)::bigint << 56) |
+          (get_byte(gid, 11)::bigint << 48) |
+          (get_byte(gid, 12)::bigint << 40) |
+          (get_byte(gid, 13)::bigint << 32) |
+          (get_byte(gid, 14)::bigint << 24) |
+          (get_byte(gid, 15)::bigint << 16) |
+          (get_byte(gid, 16)::bigint << 8) |
+          get_byte(gid, 17)::bigint;
+          
+    RETURN to_timestamp(ms / 1000.0);
+END;
+$func$ LANGUAGE plpgsql IMMUTABLE;
+
+-- Example usage:
+-- Generate a new GID for entity type 42 with a specific tenant ID
+-- SELECT gid_to_string(generate_gid(generate_tenant_id(), 42));
+
+-- Parse a GID from string
+-- SELECT parse_gid('your-base64-encoded-gid-here');
+
+-- Extract components
+-- SELECT 
+--   gid_to_string(gid) as gid_string,
+--   tenant_id_to_string(extract_tenant_id(gid)) as tenant_id,
+--   extract_entity_type(gid) as entity_type,
+--   extract_timestamp(gid) as created_at
+-- FROM (SELECT generate_gid(generate_tenant_id(), 42) as gid) t;
+
+CREATE OR REPLACE FUNCTION decode_base64_unpadded(input_text text) 
+RETURNS bytea AS $$
+DECLARE
+    padded_text text;
+    mod_length integer;
+BEGIN
+    -- Calculate how many padding characters we need to add
+    mod_length := length(input_text) % 4;
+    
+    -- Add the required padding
+    IF mod_length = 0 THEN
+        padded_text := input_text;
+    ELSIF mod_length = 1 THEN
+        -- Invalid base64 - length mod 4 can't be 1
+        RAISE EXCEPTION 'Invalid base64 length';
+    ELSIF mod_length = 2 THEN
+        padded_text := input_text || '==';
+    ELSIF mod_length = 3 THEN
+        padded_text := input_text || '=';
+    END IF;
+    
+    -- Decode the padded base64
+    RETURN decode(padded_text, 'base64');
+END;
+$$ LANGUAGE plpgsql;
+
+
+
+CREATE TYPE data_sensitivity AS ENUM ('NONE', 'LOW', 'MEDIUM', 'HIGH', 'CRITICAL');
+CREATE TYPE business_impact AS ENUM ('LOW', 'MEDIUM', 'HIGH', 'CRITICAL');
+
+CREATE TABLE risk_assessments (
+    tenant_id TEXT NOT NULL,
+    id TEXT PRIMARY KEY,
+    vendor_id TEXT NOT NULL REFERENCES vendors(id) ON DELETE CASCADE,
+    accessed_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    accessed_by TEXT NOT NULL REFERENCES peoples(id) ON DELETE SET NULL,
+    approved_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    approved_by TEXT NOT NULL REFERENCES peoples(id) ON DELETE SET NULL,
+    expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    data_sensitivity data_sensitivity NOT NULL,
+    business_impact business_impact NOT NULL,
+    notes TEXT,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL
+);
+
+ALTER TABLE peoples ADD COLUMN user_id TEXT NOT NULL REFERENCES users(id) ON DELETE SET NULL;
+
+UPDATE peoples p
+SET user_id = u.id 
+FROM users u
+WHERE u.email_address = p.primary_email_address;
+
+INSERT INTO peoples (
+    tenant_id,
+    id,
+    organization_id,
+    full_name,
+    primary_email_address,
+    kind,
+    user_id,
+    additional_email_addresses,
+    created_at,
+    updated_at,
+    version
+)
+SELECT 
+    o.tenant_id,
+    encode(generate_gid(decode_base64_unpadded(o.tenant_id), 8), 'base64'),
+    o.id,
+    u.fullname,
+    u.email_address,
+    'CONTRACTOR',
+    u.id,
+    ARRAY[]::TEXT[],
+    NOW(),
+    NOW(),
+    1
+FROM users u
+JOIN users_organizations uo ON u.id = uo.user_id
+JOIN organizations o ON uo.organization_id = o.id
+LEFT JOIN peoples p ON u.email_address = p.primary_email_address
+WHERE p.id IS NULL;
+

pkg/coredata/migrations/20250420T120001Z.sql

@@ -0,0 +1,3 @@
+ALTER TABLE vendors
+    DROP COLUMN service_criticality,
+    DROP COLUMN risk_tier; 

pkg/coredata/migrations/20250421T032000Z.sql

@@ -0,0 +1 @@
+ALTER TABLE peoples ALTER COLUMN user_id DROP NOT NULL;

pkg/coredata/people.go

@@ -31,23 +31,15 @@ type (
 		ID                       gid.GID    `db:"id"`
 		OrganizationID           gid.GID    `db:"organization_id"`
 		Kind                     PeopleKind `db:"kind"`
+		UserID                   *gid.GID   `db:"user_id"`
 		FullName                 string     `db:"full_name"`
 		PrimaryEmailAddress      string     `db:"primary_email_address"`
 		AdditionalEmailAddresses []string   `db:"additional_email_addresses"`
 		CreatedAt                time.Time  `db:"created_at"`
 		UpdatedAt                time.Time  `db:"updated_at"`
-		Version                  int        `db:"version"`
 	}
 
 	Peoples []*People
-
-	UpdatePeopleParams struct {
-		ExpectedVersion          int
-		FullName                 *string
-		PrimaryEmailAddress      *string
-		AdditionalEmailAddresses *[]string
-		Kind                     *PeopleKind
-	}
 )
 
 func (p People) CursorKey(orderBy PeopleOrderField) page.CursorKey {
@@ -72,12 +64,12 @@ SELECT
     id,
     organization_id,
     kind,
+    user_id,
     full_name,
     primary_email_address,
     additional_email_addresses,
     created_at,
-    updated_at,
+    updated_at
-    version
 FROM
     peoples
 WHERE
@@ -117,25 +109,25 @@ INSERT INTO
         tenant_id,
         id,
         organization_id,
+        user_id,
         kind,
         full_name,
         primary_email_address,
         additional_email_addresses,
         created_at,
-        updated_at,
+        updated_at
-        version
     )
 VALUES (
     @tenant_id,
     @people_id,
     @organization_id,
+    @user_id,
     @kind,
     @full_name,
     @primary_email_address,
     @additional_email_addresses,
     @created_at,
-    @updated_at,
+    @updated_at
-    @version
 )
 `
 
@@ -143,13 +135,13 @@ VALUES (
 		"tenant_id":                  scope.GetTenantID(),
 		"people_id":                  p.ID,
 		"organization_id":            p.OrganizationID,
+		"user_id":                    p.UserID,
 		"kind":                       p.Kind,
 		"full_name":                  p.FullName,
 		"primary_email_address":      p.PrimaryEmailAddress,
 		"additional_email_addresses": p.AdditionalEmailAddresses,
 		"created_at":                 p.CreatedAt,
 		"updated_at":                 p.UpdatedAt,
-		"version":                    p.Version,
 	}
 	_, err := conn.Exec(ctx, q, args)
 	return err
@@ -180,18 +172,17 @@ func (p *Peoples) LoadByOrganizationID(
 	organizationID gid.GID,
 	cursor *page.Cursor[PeopleOrderField],
 ) error {
-	// Base query
 	q := `
 SELECT
     id,
     organization_id,
     kind,
+    user_id,
     full_name,
     primary_email_address,
     additional_email_addresses,
     created_at,
-    updated_at,
+    updated_at
-    version
 FROM
     peoples
 WHERE
@@ -225,64 +216,35 @@ func (p *People) Update(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
-	params UpdatePeopleParams,
 ) error {
 	q := `
 UPDATE peoples SET
-    full_name = COALESCE(@full_name, full_name),
+	user_id = @user_id,
-    primary_email_address = COALESCE(@primary_email_address, primary_email_address),
+	full_name = @full_name,
-    additional_email_addresses = COALESCE(@additional_email_addresses, additional_email_addresses),
+	primary_email_address = @primary_email_address,
-    kind = COALESCE(@kind, kind),
+	additional_email_addresses = @additional_email_addresses,
-    updated_at = @updated_at,
+	kind = @kind,
-    version = version + 1
+	updated_at = @updated_at
 WHERE %s
     AND id = @people_id
-    AND version = @expected_version
-RETURNING 
-   	id,
-	organization_id,
-	kind,
-	full_name,
-	primary_email_address,
-	additional_email_addresses,
-	created_at,
-	updated_at,
-	version
 `
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
 	args := pgx.StrictNamedArgs{
-		"people_id":        p.ID,
+		"people_id":                  p.ID,
-		"expected_version": params.ExpectedVersion,
+		"user_id":                    p.UserID,
-		"updated_at":       time.Now(),
+		"full_name":                  p.FullName,
+		"primary_email_address":      p.PrimaryEmailAddress,
+		"additional_email_addresses": p.AdditionalEmailAddresses,
+		"kind":                       p.Kind,
+		"updated_at":                 p.UpdatedAt,
 	}
-
-	if params.FullName != nil {
-		args["full_name"] = *params.FullName
-	}
-	if params.PrimaryEmailAddress != nil {
-		args["primary_email_address"] = *params.PrimaryEmailAddress
-	}
-	if params.AdditionalEmailAddresses != nil {
-		args["additional_email_addresses"] = *params.AdditionalEmailAddresses
-	}
-	if params.Kind != nil {
-		args["kind"] = *params.Kind
-	}
-
 	maps.Copy(args, scope.SQLArguments())
 
-	rows, err := conn.Query(ctx, q, args)
+	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query people: %w", err)
+		return fmt.Errorf("cannot update people: %w", err)
 	}
 
-	people, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[People])
-	if err != nil {
-		return fmt.Errorf("cannot collect people: %w", err)
-	}
-
-	*p = people
-
 	return nil
 }

pkg/coredata/risk_tier.go

@@ -1,66 +0,0 @@
-// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
-//
-// Permission to use, copy, modify, and/or distribute this software for any
-// purpose with or without fee is hereby granted, provided that the above
-// copyright notice and this permission notice appear in all copies.
-//
-// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-// PERFORMANCE OF THIS SOFTWARE.
-
-package coredata
-
-import (
-	"database/sql/driver"
-	"fmt"
-)
-
-type RiskTier string
-
-const (
-	RiskTierCritical    RiskTier = "CRITICAL"    // Handles sensitive data, critical for platform operation
-	RiskTierSignificant RiskTier = "SIGNIFICANT" // No user data access, but important for platform management
-	RiskTierGeneral     RiskTier = "GENERAL"     // General vendor with minimal risk
-)
-
-func (rt RiskTier) MarshalText() ([]byte, error) {
-	return []byte(rt.String()), nil
-}
-
-func (rt *RiskTier) UnmarshalText(data []byte) error {
-	val := string(data)
-
-	switch val {
-	case RiskTierCritical.String():
-		*rt = RiskTierCritical
-	case RiskTierSignificant.String():
-		*rt = RiskTierSignificant
-	case RiskTierGeneral.String():
-		*rt = RiskTierGeneral
-	default:
-		return fmt.Errorf("invalid RiskTier value: %q", val)
-	}
-
-	return nil
-}
-
-func (rt RiskTier) String() string {
-	return string(rt)
-}
-
-func (rt *RiskTier) Scan(value any) error {
-	val, ok := value.(string)
-	if !ok {
-		return fmt.Errorf("invalid scan source for RiskTier, expected string got %T", value)
-	}
-
-	return rt.UnmarshalText([]byte(val))
-}
-
-func (rt RiskTier) Value() (driver.Value, error) {
-	return rt.String(), nil
-}

pkg/coredata/service_criticality.go

@@ -1,66 +0,0 @@
-// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
-//
-// Permission to use, copy, modify, and/or distribute this software for any
-// purpose with or without fee is hereby granted, provided that the above
-// copyright notice and this permission notice appear in all copies.
-//
-// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-// PERFORMANCE OF THIS SOFTWARE.
-
-package coredata
-
-import (
-	"database/sql/driver"
-	"fmt"
-)
-
-type ServiceCriticality string
-
-const (
-	ServiceCriticalityLow    ServiceCriticality = "LOW"
-	ServiceCriticalityMedium ServiceCriticality = "MEDIUM"
-	ServiceCriticalityHigh   ServiceCriticality = "HIGH"
-)
-
-func (sc ServiceCriticality) MarshalText() ([]byte, error) {
-	return []byte(sc.String()), nil
-}
-
-func (sc *ServiceCriticality) UnmarshalText(data []byte) error {
-	val := string(data)
-
-	switch val {
-	case ServiceCriticalityLow.String():
-		*sc = ServiceCriticalityLow
-	case ServiceCriticalityMedium.String():
-		*sc = ServiceCriticalityMedium
-	case ServiceCriticalityHigh.String():
-		*sc = ServiceCriticalityHigh
-	default:
-		return fmt.Errorf("invalid ServiceCriticality value: %q", val)
-	}
-
-	return nil
-}
-
-func (sc ServiceCriticality) String() string {
-	return string(sc)
-}
-
-func (sc *ServiceCriticality) Scan(value any) error {
-	val, ok := value.(string)
-	if !ok {
-		return fmt.Errorf("invalid scan source for ServiceCriticality, expected string got %T", value)
-	}
-
-	return sc.UnmarshalText([]byte(val))
-}
-
-func (sc ServiceCriticality) Value() (driver.Value, error) {
-	return sc.String(), nil
-}

pkg/coredata/vendor.go

@@ -16,7 +16,6 @@ package coredata
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -27,34 +26,30 @@ import (
 	"go.gearno.de/kit/pg"
 )
 
-var ErrConcurrentModification = errors.New("concurrent modification")
-
 type (
 	Vendor struct {
-		ID                         gid.GID            `db:"id"`
+		ID                         gid.GID    `db:"id"`
-		OrganizationID             gid.GID            `db:"organization_id"`
+		OrganizationID             gid.GID    `db:"organization_id"`
-		Name                       string             `db:"name"`
+		Name                       string     `db:"name"`
-		Description                *string            `db:"description"`
+		Description                *string    `db:"description"`
-		Category                   string             `db:"category"`
+		Category                   string     `db:"category"`
-		ServiceStartAt             time.Time          `db:"service_start_at"`
+		ServiceStartAt             time.Time  `db:"service_start_at"`
-		ServiceTerminationAt       *time.Time         `db:"service_termination_at"`
+		ServiceTerminationAt       *time.Time `db:"service_termination_at"`
-		HeadquarterAddress         *string            `db:"headquarter_address"`
+		HeadquarterAddress         *string    `db:"headquarter_address"`
-		LegalName                  *string            `db:"legal_name"`
+		LegalName                  *string    `db:"legal_name"`
-		WebsiteURL                 *string            `db:"website_url"`
+		WebsiteURL                 *string    `db:"website_url"`
-		PrivacyPolicyURL           *string            `db:"privacy_policy_url"`
+		PrivacyPolicyURL           *string    `db:"privacy_policy_url"`
-		ServiceLevelAgreementURL   *string            `db:"service_level_agreement_url"`
+		ServiceLevelAgreementURL   *string    `db:"service_level_agreement_url"`
-		DataProcessingAgreementURL *string            `db:"data_processing_agreement_url"`
+		DataProcessingAgreementURL *string    `db:"data_processing_agreement_url"`
-		Certifications             []string           `db:"certifications"`
+		Certifications             []string   `db:"certifications"`
-		ServiceCriticality         ServiceCriticality `db:"service_criticality"`
+		BusinessOwnerID            *gid.GID   `db:"business_owner_id"`
-		RiskTier                   RiskTier           `db:"risk_tier"`
+		SecurityOwnerID            *gid.GID   `db:"security_owner_id"`
-		BusinessOwnerID            *gid.GID           `db:"business_owner_id"`
+		StatusPageURL              *string    `db:"status_page_url"`
-		SecurityOwnerID            *gid.GID           `db:"security_owner_id"`
+		TermsOfServiceURL          *string    `db:"terms_of_service_url"`
-		StatusPageURL              *string            `db:"status_page_url"`
+		SecurityPageURL            *string    `db:"security_page_url"`
-		TermsOfServiceURL          *string            `db:"terms_of_service_url"`
+		TrustPageURL               *string    `db:"trust_page_url"`
-		SecurityPageURL            *string            `db:"security_page_url"`
+		CreatedAt                  time.Time  `db:"created_at"`
-		TrustPageURL               *string            `db:"trust_page_url"`
+		UpdatedAt                  time.Time  `db:"updated_at"`
-		CreatedAt                  time.Time          `db:"created_at"`
-		UpdatedAt                  time.Time          `db:"updated_at"`
 	}
 
 	Vendors []*Vendor
@@ -93,10 +88,8 @@ SELECT
     service_level_agreement_url,
     data_processing_agreement_url,
     certifications,
-    service_criticality,
+    business_owner_id,
-    risk_tier,
+    security_owner_id,
-	business_owner_id,
-	security_owner_id,
     status_page_url,
     terms_of_service_url,
     security_page_url,
@@ -155,10 +148,8 @@ INSERT INTO
         certifications,
         service_start_at,
         service_termination_at,
-        service_criticality,
-        risk_tier,
         business_owner_id,
-		security_owner_id,
+        security_owner_id,
         status_page_url,
         terms_of_service_url,
         security_page_url,
@@ -182,10 +173,8 @@ VALUES (
     @certifications,
     @service_start_at,
     @service_termination_at,
-    @service_criticality,
-    @risk_tier,
     @business_owner_id,
-	@security_owner_id,
+    @security_owner_id,
     @status_page_url,
     @terms_of_service_url,
     @security_page_url,
@@ -211,8 +200,6 @@ VALUES (
 		"certifications":                v.Certifications,
 		"service_start_at":              v.ServiceStartAt,
 		"service_termination_at":        v.ServiceTerminationAt,
-		"service_criticality":           v.ServiceCriticality,
-		"risk_tier":                     v.RiskTier,
 		"business_owner_id":             v.BusinessOwnerID,
 		"security_owner_id":             v.SecurityOwnerID,
 		"status_page_url":               v.StatusPageURL,
@@ -267,10 +254,8 @@ SELECT
     certifications,
     service_start_at,
     service_termination_at,
-    service_criticality,
+    business_owner_id,
-    risk_tier,
+    security_owner_id,
-	business_owner_id,
-	security_owner_id,
     status_page_url,
     terms_of_service_url,
     security_page_url,
@@ -317,8 +302,6 @@ SET
 	description = @description,
 	service_start_at = @service_start_at,
 	service_termination_at = @service_termination_at,
-	service_criticality = @service_criticality,
-	risk_tier = @risk_tier,
 	category = @category,
 	headquarter_address = @headquarter_address,
 	legal_name = @legal_name,
@@ -346,8 +329,6 @@ WHERE %s
 		"description":                   v.Description,
 		"service_start_at":              v.ServiceStartAt,
 		"service_termination_at":        v.ServiceTerminationAt,
-		"service_criticality":           v.ServiceCriticality,
-		"risk_tier":                     v.RiskTier,
 		"category":                      v.Category,
 		"headquarter_address":           v.HeadquarterAddress,
 		"legal_name":                    v.LegalName,

pkg/coredata/vendor_risk_assessment.go

@@ -0,0 +1,299 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	// RiskAssessment represents a point-in-time risk assessment for a vendor
+	VendorRiskAssessment struct {
+		ID              gid.GID         `db:"id"`
+		VendorID        gid.GID         `db:"vendor_id"`
+		AssessedAt      time.Time       `db:"assessed_at"`
+		AssessedBy      gid.GID         `db:"assessed_by"`
+		AccessedAt      time.Time       `db:"accessed_at"`
+		ApprovedBy      gid.GID         `db:"approved_by"`
+		ApprovedAt      time.Time       `db:"approved_at"`
+		ExpiresAt       time.Time       `db:"expires_at"`
+		DataSensitivity DataSensitivity `db:"data_sensitivity"`
+		BusinessImpact  BusinessImpact  `db:"business_impact"`
+		Notes           *string         `db:"notes"`
+		CreatedAt       time.Time       `db:"created_at"`
+		UpdatedAt       time.Time       `db:"updated_at"`
+	}
+
+	// DataSensitivity represents the level of data sensitivity handled by a vendor
+	DataSensitivity string
+
+	// BusinessImpact represents the impact level the vendor has on business operations
+	BusinessImpact string
+
+	// RiskAssessments is a collection of RiskAssessment objects
+	VendorRiskAssessments []*VendorRiskAssessment
+)
+
+// Constants for DataSensitivity
+const (
+	DataSensitivityNone     DataSensitivity = "NONE"     // No sensitive data
+	DataSensitivityLow      DataSensitivity = "LOW"      // Public or non-sensitive data
+	DataSensitivityMedium   DataSensitivity = "MEDIUM"   // Internal/restricted data
+	DataSensitivityHigh     DataSensitivity = "HIGH"     // Confidential data
+	DataSensitivityCritical DataSensitivity = "CRITICAL" // Regulated/PII/financial data
+)
+
+// Constants for BusinessImpact
+const (
+	BusinessImpactLow      BusinessImpact = "LOW"      // Minimal impact on business
+	BusinessImpactMedium   BusinessImpact = "MEDIUM"   // Moderate impact on business
+	BusinessImpactHigh     BusinessImpact = "HIGH"     // Significant business impact
+	BusinessImpactCritical BusinessImpact = "CRITICAL" // Critical to business operations
+)
+
+func (v VendorRiskAssessment) CursorKey(orderBy VendorRiskAssessmentOrderField) page.CursorKey {
+	switch orderBy {
+	case VendorRiskAssessmentOrderFieldCreatedAt:
+		return page.NewCursorKey(v.ID, v.CreatedAt)
+	case VendorRiskAssessmentOrderFieldExpiresAt:
+		return page.NewCursorKey(v.ID, v.ExpiresAt)
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
+}
+
+// Insert adds a new risk assessment to the database
+func (r VendorRiskAssessment) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO
+    risk_assessments (
+        tenant_id,
+        id,
+        vendor_id,
+        assessed_at,
+        assessed_by,
+        accessed_at,
+        approved_by,
+        approved_at,
+        expires_at,
+        data_sensitivity,
+        business_impact,
+        notes,
+        created_at,
+        updated_at
+    )
+VALUES (
+    @tenant_id,
+    @id,
+    @vendor_id,
+    @assessed_at,
+    @assessed_by,
+    @expires_at,
+    @data_sensitivity,
+    @business_impact,
+    @notes,
+    @attachments,
+    @created_at,
+    @updated_at
+)
+`
+
+	args := pgx.StrictNamedArgs{
+		"tenant_id":        scope.GetTenantID(),
+		"id":               r.ID,
+		"vendor_id":        r.VendorID,
+		"assessed_at":      r.AssessedAt,
+		"assessed_by":      r.AssessedBy,
+		"accessed_at":      r.AccessedAt,
+		"approved_by":      r.ApprovedBy,
+		"approved_at":      r.ApprovedAt,
+		"expires_at":       r.ExpiresAt,
+		"data_sensitivity": r.DataSensitivity,
+		"business_impact":  r.BusinessImpact,
+		"notes":            r.Notes,
+		"created_at":       r.CreatedAt,
+		"updated_at":       r.UpdatedAt,
+	}
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+// LoadByID loads a risk assessment by its ID
+func (r *VendorRiskAssessment) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	id gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    vendor_id,
+    assessed_at,
+    assessed_by,
+    accessed_at,
+    approved_by,
+    approved_at,
+    expires_at,
+    data_sensitivity,
+    business_impact,
+    notes,
+    created_at,
+    updated_at
+FROM
+    risk_assessments
+WHERE
+    %s
+    AND id = @id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": id}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query risk assessment: %w", err)
+	}
+	defer rows.Close()
+
+	assessment, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorRiskAssessment])
+	if err != nil {
+		return fmt.Errorf("cannot collect risk assessment: %w", err)
+	}
+
+	*r = assessment
+
+	return nil
+}
+
+// LoadLatestByVendorID loads the most recent risk assessment for a vendor
+func (r *VendorRiskAssessment) LoadLatestByVendorID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	vendorID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    vendor_id,
+    assessed_at,
+    assessed_by,
+    accessed_at,
+    approved_by,
+    approved_at,
+    expires_at,
+    data_sensitivity,
+    business_impact,
+    notes,
+    created_at,
+    updated_at
+FROM
+    risk_assessments
+WHERE
+    %s
+    AND vendor_id = @vendor_id
+ORDER BY
+    assessed_at DESC
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"vendor_id": vendorID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query risk assessment: %w", err)
+	}
+	defer rows.Close()
+
+	assessment, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorRiskAssessment])
+	if err != nil {
+		return fmt.Errorf("cannot collect risk assessment: %w", err)
+	}
+
+	*r = assessment
+
+	return nil
+}
+
+// LoadByVendorID loads all risk assessments for a vendor, ordered by assessment date
+func (r *VendorRiskAssessments) LoadByVendorID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	vendorID gid.GID,
+	cursor *page.Cursor[VendorRiskAssessmentOrderField],
+) error {
+	q := `
+SELECT
+    id,
+    vendor_id,
+    assessed_at,
+    assessed_by,
+    accessed_at,
+    approved_by,
+    approved_at,
+    expires_at,
+    data_sensitivity,
+    business_impact,
+    notes,
+    created_at,
+    updated_at
+FROM
+    risk_assessments
+WHERE
+    %s
+    AND vendor_id = @vendor_id
+	AND %s
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"vendor_id": vendorID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query risk assessments: %w", err)
+	}
+
+	assessments, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorRiskAssessment])
+	if err != nil {
+		return fmt.Errorf("cannot collect risk assessments: %w", err)
+	}
+
+	*r = assessments
+
+	return nil
+}

pkg/coredata/vendor_risk_assessment_order_field.go

@@ -0,0 +1,41 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+type (
+	VendorRiskAssessmentOrderField string
+)
+
+const (
+	VendorRiskAssessmentOrderFieldCreatedAt VendorRiskAssessmentOrderField = "CREATED_AT"
+	VendorRiskAssessmentOrderFieldExpiresAt VendorRiskAssessmentOrderField = "EXPIRES_AT"
+)
+
+func (p VendorRiskAssessmentOrderField) Column() string {
+	return string(p)
+}
+
+func (p VendorRiskAssessmentOrderField) String() string {
+	return string(p)
+}
+
+func (p VendorRiskAssessmentOrderField) MarshalText() ([]byte, error) {
+	return []byte(p.String()), nil
+}
+
+func (p *VendorRiskAssessmentOrderField) UnmarshalText(text []byte) error {
+	*p = VendorRiskAssessmentOrderField(text)
+	return nil
+}

pkg/probo/organization_service.go

@@ -64,8 +64,8 @@ func (s OrganizationService) Create(
 
 	err = s.svc.pg.WithConn(
 		ctx,
-		func(conn pg.Conn) error {
+		func(tx pg.Conn) error {
-			if err := organization.Insert(ctx, conn); err != nil {
+			if err := organization.Insert(ctx, tx); err != nil {
 				return fmt.Errorf("cannot insert organization: %w", err)
 			}
 

pkg/probo/people_service.go

@@ -32,7 +32,7 @@ type (
 
 	UpdatePeopleRequest struct {
 		ID                       gid.GID
-		ExpectedVersion          int
+		UserID                   *gid.GID
 		Kind                     *coredata.PeopleKind
 		FullName                 *string
 		PrimaryEmailAddress      *string
@@ -41,6 +41,7 @@ type (
 
 	CreatePeopleRequest struct {
 		OrganizationID           gid.GID
+		UserID                   *gid.GID
 		FullName                 string
 		PrimaryEmailAddress      string
 		AdditionalEmailAddresses []string
@@ -99,20 +100,38 @@ func (s PeopleService) Update(
 	ctx context.Context,
 	req UpdatePeopleRequest,
 ) (*coredata.People, error) {
-	params := coredata.UpdatePeopleParams{
+	people := &coredata.People{}
-		ExpectedVersion:          req.ExpectedVersion,
-		Kind:                     req.Kind,
-		FullName:                 req.FullName,
-		PrimaryEmailAddress:      req.PrimaryEmailAddress,
-		AdditionalEmailAddresses: req.AdditionalEmailAddresses,
-	}
-
-	people := &coredata.People{ID: req.ID}
 
 	err := s.svc.pg.WithTx(
 		ctx,
 		func(conn pg.Conn) error {
-			return people.Update(ctx, conn, s.svc.scope, params)
+			if err := people.LoadByID(ctx, conn, s.svc.scope, req.ID); err != nil {
+				return fmt.Errorf("cannot load people: %w", err)
+			}
+
+			if req.UserID != nil {
+				people.UserID = req.UserID
+			}
+
+			if req.Kind != nil {
+				people.Kind = *req.Kind
+			}
+
+			if req.FullName != nil {
+				people.FullName = *req.FullName
+			}
+
+			if req.PrimaryEmailAddress != nil {
+				people.PrimaryEmailAddress = *req.PrimaryEmailAddress
+			}
+
+			if req.AdditionalEmailAddresses != nil {
+				people.AdditionalEmailAddresses = *req.AdditionalEmailAddresses
+			}
+
+			people.UpdatedAt = time.Now()
+
+			return people.Update(ctx, conn, s.svc.scope)
 		})
 	if err != nil {
 		return nil, err

pkg/probo/vendor_service.go

@@ -48,8 +48,6 @@ type (
 		StatusPageURL              *string
 		ServiceStartAt             time.Time
 		ServiceTerminationAt       *time.Time
-		ServiceCriticality         coredata.ServiceCriticality
-		RiskTier                   coredata.RiskTier
 		BusinessOwnerID            *gid.GID
 		SecurityOwnerID            *gid.GID
 	}
@@ -72,11 +70,18 @@ type (
 		StatusPageURL              *string
 		ServiceStartAt             *time.Time
 		ServiceTerminationAt       *time.Time
-		ServiceCriticality         *coredata.ServiceCriticality
-		RiskTier                   *coredata.RiskTier
 		BusinessOwnerID            *gid.GID
 		SecurityOwnerID            *gid.GID
 	}
+
+	CreateVendorRiskAssessmentRequest struct {
+		VendorID        gid.GID
+		AssessedByID    gid.GID
+		ExpiresAt       time.Time
+		DataSensitivity coredata.DataSensitivity
+		BusinessImpact  coredata.BusinessImpact
+		Notes           *string
+	}
 )
 
 func (s VendorService) ListForOrganizationID(
@@ -135,14 +140,6 @@ func (s VendorService) Update(
 				vendor.ServiceTerminationAt = req.ServiceTerminationAt
 			}
 
-			if req.ServiceCriticality != nil {
-				vendor.ServiceCriticality = *req.ServiceCriticality
-			}
-
-			if req.RiskTier != nil {
-				vendor.RiskTier = *req.RiskTier
-			}
-
 			if req.StatusPageURL != nil {
 				vendor.StatusPageURL = req.StatusPageURL
 			}
@@ -296,8 +293,6 @@ func (s VendorService) Create(
 		TrustPageURL:               req.TrustPageURL,
 		StatusPageURL:              req.StatusPageURL,
 		TermsOfServiceURL:          req.TermsOfServiceURL,
-		ServiceCriticality:         req.ServiceCriticality,
-		RiskTier:                   req.RiskTier,
 	}
 
 	if req.Category != nil {
@@ -327,3 +322,65 @@ func (s VendorService) Create(
 
 	return vendor, nil
 }
+
+func (s VendorService) ListRiskAssessments(
+	ctx context.Context,
+	vendorID gid.GID,
+	cursor *page.Cursor[coredata.VendorRiskAssessmentOrderField],
+) (*page.Page[*coredata.VendorRiskAssessment, coredata.VendorRiskAssessmentOrderField], error) {
+	var vendorRiskAssessments coredata.VendorRiskAssessments
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return vendorRiskAssessments.LoadByVendorID(ctx, conn, s.svc.scope, vendorID, cursor)
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(vendorRiskAssessments, cursor), nil
+}
+
+func (s VendorService) CreateRiskAssessment(
+	ctx context.Context,
+	req CreateVendorRiskAssessmentRequest,
+) (*coredata.VendorRiskAssessment, error) {
+	vendorRiskAssessmentID, err := gid.NewGID(s.svc.scope.GetTenantID(), coredata.VendorRiskAssessmentEntityType)
+	if err != nil {
+		return nil, fmt.Errorf("cannot create vendor risk assessment global id: %w", err)
+	}
+
+	now := time.Now()
+
+	vendorRiskAssessment := &coredata.VendorRiskAssessment{
+		ID:              vendorRiskAssessmentID,
+		VendorID:        req.VendorID,
+		AssessedBy:      req.AssessedByID,
+		ExpiresAt:       req.ExpiresAt,
+		DataSensitivity: req.DataSensitivity,
+		BusinessImpact:  req.BusinessImpact,
+		Notes:           req.Notes,
+		CreatedAt:       now,
+		UpdatedAt:       now,
+	}
+
+	err = s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := vendorRiskAssessment.Insert(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot insert vendor risk assessment: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return vendorRiskAssessment, nil
+}

pkg/server/api/console/v1/schema.graphql

@@ -107,32 +107,6 @@ enum MesureImportance
     )
 }
 
-enum ServiceCriticality
-  @goModel(model: "github.com/getprobo/probo/pkg/coredata.ServiceCriticality") {
-  LOW
-    @goEnum(
-      value: "github.com/getprobo/probo/pkg/coredata.ServiceCriticalityLow"
-    )
-  MEDIUM
-    @goEnum(
-      value: "github.com/getprobo/probo/pkg/coredata.ServiceCriticalityMedium"
-    )
-  HIGH
-    @goEnum(
-      value: "github.com/getprobo/probo/pkg/coredata.ServiceCriticalityHigh"
-    )
-}
-
-enum RiskTier
-  @goModel(model: "github.com/getprobo/probo/pkg/coredata.RiskTier") {
-  CRITICAL
-    @goEnum(value: "github.com/getprobo/probo/pkg/coredata.RiskTierCritical")
-  SIGNIFICANT
-    @goEnum(value: "github.com/getprobo/probo/pkg/coredata.RiskTierSignificant")
-  GENERAL
-    @goEnum(value: "github.com/getprobo/probo/pkg/coredata.RiskTierGeneral")
-}
-
 enum PolicyStatus
   @goModel(model: "github.com/getprobo/probo/pkg/coredata.PolicyStatus") {
   DRAFT
@@ -276,6 +250,32 @@ enum ConnectorOrderField
     )
 }
 
+enum DataSensitivity
+  @goModel(model: "github.com/getprobo/probo/pkg/coredata.DataSensitivity") {
+  NONE
+    @goEnum(value: "github.com/getprobo/probo/pkg/coredata.DataSensitivityNone")
+  LOW
+    @goEnum(value: "github.com/getprobo/probo/pkg/coredata.DataSensitivityLow")
+  MEDIUM
+    @goEnum(value: "github.com/getprobo/probo/pkg/coredata.DataSensitivityMedium")
+  HIGH
+    @goEnum(value: "github.com/getprobo/probo/pkg/coredata.DataSensitivityHigh")
+  CRITICAL
+    @goEnum(value: "github.com/getprobo/probo/pkg/coredata.DataSensitivityCritical")
+}
+
+enum BusinessImpact
+  @goModel(model: "github.com/getprobo/probo/pkg/coredata.BusinessImpact") {
+  LOW
+    @goEnum(value: "github.com/getprobo/probo/pkg/coredata.BusinessImpactLow")
+  MEDIUM
+    @goEnum(value: "github.com/getprobo/probo/pkg/coredata.BusinessImpactMedium")
+  HIGH
+    @goEnum(value: "github.com/getprobo/probo/pkg/coredata.BusinessImpactHigh")
+  CRITICAL
+    @goEnum(value: "github.com/getprobo/probo/pkg/coredata.BusinessImpactCritical")
+}
+
 # Order Input Types
 input UserOrder
   @goModel(
@@ -488,13 +488,19 @@ type Vendor implements Node {
     orderBy: VendorComplianceReportOrder
   ): VendorComplianceReportConnection! @goField(forceResolver: true)
 
+  riskAssessments(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: VendorRiskAssessmentOrder
+  ): VendorRiskAssessmentConnection! @goField(forceResolver: true)
+
   businessOwner: People @goField(forceResolver: true)
   securityOwner: People @goField(forceResolver: true)
 
   serviceStartAt: Datetime!
   serviceTerminationAt: Datetime
-  serviceCriticality: ServiceCriticality!
-  riskTier: RiskTier!
   statusPageUrl: String
   termsOfServiceUrl: String
   privacyPolicyUrl: String
@@ -850,6 +856,16 @@ type ConnectorEdge {
   node: Connector!
 }
 
+type VendorRiskAssessmentConnection {
+  edges: [VendorRiskAssessmentEdge!]!
+  pageInfo: PageInfo!
+}
+
+type VendorRiskAssessmentEdge {
+  cursor: CursorKey!
+  node: VendorRiskAssessment!
+}
+
 # Root Types
 type Query {
   node(id: ID!): Node!
@@ -951,6 +967,8 @@ type Mutation {
   createPolicy(input: CreatePolicyInput!): CreatePolicyPayload!
   updatePolicy(input: UpdatePolicyInput!): UpdatePolicyPayload!
   deletePolicy(input: DeletePolicyInput!): DeletePolicyPayload!
+
+  createVendorRiskAssessment(input: CreateVendorRiskAssessmentInput!): CreateVendorRiskAssessmentPayload!
 }
 
 # Input Types
@@ -986,8 +1004,6 @@ input CreateVendorInput {
   termsOfServiceUrl: String
   serviceStartAt: Datetime!
   serviceTerminationAt: Datetime
-  serviceCriticality: ServiceCriticality!
-  riskTier: RiskTier!
   businessOwnerId: ID
   securityOwnerId: ID
 }
@@ -998,8 +1014,6 @@ input UpdateVendorInput {
   description: String
   serviceStartAt: Datetime
   serviceTerminationAt: Datetime
-  serviceCriticality: ServiceCriticality
-  riskTier: RiskTier
   statusPageUrl: String
   termsOfServiceUrl: String
   privacyPolicyUrl: String
@@ -1434,3 +1448,48 @@ type InviteUserPayload {
 type RemoveUserPayload {
   success: Boolean!
 }
+
+input VendorRiskAssessmentOrder {
+  field: VendorRiskAssessmentOrderField!
+  direction: OrderDirection!
+}
+
+type VendorRiskAssessment implements Node {
+  id: ID!
+  vendor: Vendor! @goField(forceResolver: true)
+  assessedAt: Datetime!
+  assessedBy: People! @goField(forceResolver: true)
+  expiresAt: Datetime!
+  dataSensitivity: DataSensitivity!
+  businessImpact: BusinessImpact!
+  notes: String
+  attachments: [String!]!
+  createdAt: Datetime!
+  updatedAt: Datetime!
+}
+
+enum VendorRiskAssessmentOrderField
+  @goModel(model: "github.com/getprobo/probo/pkg/coredata.VendorRiskAssessmentOrderField") {
+  CREATED_AT
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.VendorRiskAssessmentOrderFieldCreatedAt"
+    )
+  EXPIRES_AT
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.VendorRiskAssessmentOrderFieldExpiresAt"
+    )
+}
+
+input CreateVendorRiskAssessmentInput {
+  vendorId: ID!
+  assessedBy: ID!
+  expiresAt: Datetime!
+  dataSensitivity: DataSensitivity!
+  businessImpact: BusinessImpact!
+  notes: String
+  attachments: [String!]
+}
+
+type CreateVendorRiskAssessmentPayload {
+  vendorRiskAssessmentEdge: VendorRiskAssessmentEdge!
+}

pkg/server/api/console/v1/types/types.go

@@ -220,33 +220,45 @@ type CreateTaskPayload struct {
 }
 
 type CreateVendorInput struct {
-	OrganizationID             gid.GID                     `json:"organizationId"`
+	OrganizationID             gid.GID    `json:"organizationId"`
-	Name                       string                      `json:"name"`
+	Name                       string     `json:"name"`
-	Description                *string                     `json:"description,omitempty"`
+	Description                *string    `json:"description,omitempty"`
-	HeadquarterAddress         *string                     `json:"headquarterAddress,omitempty"`
+	HeadquarterAddress         *string    `json:"headquarterAddress,omitempty"`
-	LegalName                  *string                     `json:"legalName,omitempty"`
+	LegalName                  *string    `json:"legalName,omitempty"`
-	WebsiteURL                 *string                     `json:"websiteUrl,omitempty"`
+	WebsiteURL                 *string    `json:"websiteUrl,omitempty"`
-	PrivacyPolicyURL           *string                     `json:"privacyPolicyUrl,omitempty"`
+	PrivacyPolicyURL           *string    `json:"privacyPolicyUrl,omitempty"`
-	Category                   *string                     `json:"category,omitempty"`
+	Category                   *string    `json:"category,omitempty"`
-	ServiceLevelAgreementURL   *string                     `json:"serviceLevelAgreementUrl,omitempty"`
+	ServiceLevelAgreementURL   *string    `json:"serviceLevelAgreementUrl,omitempty"`
-	DataProcessingAgreementURL *string                     `json:"dataProcessingAgreementUrl,omitempty"`
+	DataProcessingAgreementURL *string    `json:"dataProcessingAgreementUrl,omitempty"`
-	Certifications             []string                    `json:"certifications,omitempty"`
+	Certifications             []string   `json:"certifications,omitempty"`
-	SecurityPageURL            *string                     `json:"securityPageUrl,omitempty"`
+	SecurityPageURL            *string    `json:"securityPageUrl,omitempty"`
-	TrustPageURL               *string                     `json:"trustPageUrl,omitempty"`
+	TrustPageURL               *string    `json:"trustPageUrl,omitempty"`
-	StatusPageURL              *string                     `json:"statusPageUrl,omitempty"`
+	StatusPageURL              *string    `json:"statusPageUrl,omitempty"`
-	TermsOfServiceURL          *string                     `json:"termsOfServiceUrl,omitempty"`
+	TermsOfServiceURL          *string    `json:"termsOfServiceUrl,omitempty"`
-	ServiceStartAt             time.Time                   `json:"serviceStartAt"`
+	ServiceStartAt             time.Time  `json:"serviceStartAt"`
-	ServiceTerminationAt       *time.Time                  `json:"serviceTerminationAt,omitempty"`
+	ServiceTerminationAt       *time.Time `json:"serviceTerminationAt,omitempty"`
-	ServiceCriticality         coredata.ServiceCriticality `json:"serviceCriticality"`
+	BusinessOwnerID            *gid.GID   `json:"businessOwnerId,omitempty"`
-	RiskTier                   coredata.RiskTier           `json:"riskTier"`
+	SecurityOwnerID            *gid.GID   `json:"securityOwnerId,omitempty"`
-	BusinessOwnerID            *gid.GID                    `json:"businessOwnerId,omitempty"`
-	SecurityOwnerID            *gid.GID                    `json:"securityOwnerId,omitempty"`
 }
 
 type CreateVendorPayload struct {
 	VendorEdge *VendorEdge `json:"vendorEdge"`
 }
 
+type CreateVendorRiskAssessmentInput struct {
+	VendorID        gid.GID                  `json:"vendorId"`
+	AssessedBy      gid.GID                  `json:"assessedBy"`
+	ExpiresAt       time.Time                `json:"expiresAt"`
+	DataSensitivity coredata.DataSensitivity `json:"dataSensitivity"`
+	BusinessImpact  coredata.BusinessImpact  `json:"businessImpact"`
+	Notes           *string                  `json:"notes,omitempty"`
+	Attachments     []string                 `json:"attachments,omitempty"`
+}
+
+type CreateVendorRiskAssessmentPayload struct {
+	VendorRiskAssessmentEdge *VendorRiskAssessmentEdge `json:"vendorRiskAssessmentEdge"`
+}
+
 type DeleteControlMesureMappingInput struct {
 	ControlID gid.GID `json:"controlId"`
 	MesureID  gid.GID `json:"mesureId"`
@@ -744,27 +756,25 @@ type UpdateTaskPayload struct {
 }
 
 type UpdateVendorInput struct {
-	ID                         gid.GID                      `json:"id"`
+	ID                         gid.GID    `json:"id"`
-	Name                       *string                      `json:"name,omitempty"`
+	Name                       *string    `json:"name,omitempty"`
-	Description                *string                      `json:"description,omitempty"`
+	Description                *string    `json:"description,omitempty"`
-	ServiceStartAt             *time.Time                   `json:"serviceStartAt,omitempty"`
+	ServiceStartAt             *time.Time `json:"serviceStartAt,omitempty"`
-	ServiceTerminationAt       *time.Time                   `json:"serviceTerminationAt,omitempty"`
+	ServiceTerminationAt       *time.Time `json:"serviceTerminationAt,omitempty"`
-	ServiceCriticality         *coredata.ServiceCriticality `json:"serviceCriticality,omitempty"`
+	StatusPageURL              *string    `json:"statusPageUrl,omitempty"`
-	RiskTier                   *coredata.RiskTier           `json:"riskTier,omitempty"`
+	TermsOfServiceURL          *string    `json:"termsOfServiceUrl,omitempty"`
-	StatusPageURL              *string                      `json:"statusPageUrl,omitempty"`
+	PrivacyPolicyURL           *string    `json:"privacyPolicyUrl,omitempty"`
-	TermsOfServiceURL          *string                      `json:"termsOfServiceUrl,omitempty"`
+	ServiceLevelAgreementURL   *string    `json:"serviceLevelAgreementUrl,omitempty"`
-	PrivacyPolicyURL           *string                      `json:"privacyPolicyUrl,omitempty"`
+	DataProcessingAgreementURL *string    `json:"dataProcessingAgreementUrl,omitempty"`
-	ServiceLevelAgreementURL   *string                      `json:"serviceLevelAgreementUrl,omitempty"`
+	WebsiteURL                 *string    `json:"websiteUrl,omitempty"`
-	DataProcessingAgreementURL *string                      `json:"dataProcessingAgreementUrl,omitempty"`
+	LegalName                  *string    `json:"legalName,omitempty"`
-	WebsiteURL                 *string                      `json:"websiteUrl,omitempty"`
+	HeadquarterAddress         *string    `json:"headquarterAddress,omitempty"`
-	LegalName                  *string                      `json:"legalName,omitempty"`
+	Category                   *string    `json:"category,omitempty"`
-	HeadquarterAddress         *string                      `json:"headquarterAddress,omitempty"`
+	Certifications             []string   `json:"certifications,omitempty"`
-	Category                   *string                      `json:"category,omitempty"`
+	SecurityPageURL            *string    `json:"securityPageUrl,omitempty"`
-	Certifications             []string                     `json:"certifications,omitempty"`
+	TrustPageURL               *string    `json:"trustPageUrl,omitempty"`
-	SecurityPageURL            *string                      `json:"securityPageUrl,omitempty"`
+	BusinessOwnerID            *gid.GID   `json:"businessOwnerId,omitempty"`
-	TrustPageURL               *string                      `json:"trustPageUrl,omitempty"`
+	SecurityOwnerID            *gid.GID   `json:"securityOwnerId,omitempty"`
-	BusinessOwnerID            *gid.GID                     `json:"businessOwnerId,omitempty"`
-	SecurityOwnerID            *gid.GID                     `json:"securityOwnerId,omitempty"`
 }
 
 type UpdateVendorPayload struct {
@@ -809,12 +819,11 @@ type Vendor struct {
 	Name                       string                            `json:"name"`
 	Description                *string                           `json:"description,omitempty"`
 	ComplianceReports          *VendorComplianceReportConnection `json:"complianceReports"`
+	RiskAssessments            *VendorRiskAssessmentConnection   `json:"riskAssessments"`
 	BusinessOwner              *People                           `json:"businessOwner,omitempty"`
 	SecurityOwner              *People                           `json:"securityOwner,omitempty"`
 	ServiceStartAt             time.Time                         `json:"serviceStartAt"`
 	ServiceTerminationAt       *time.Time                        `json:"serviceTerminationAt,omitempty"`
-	ServiceCriticality         coredata.ServiceCriticality       `json:"serviceCriticality"`
-	RiskTier                   coredata.RiskTier                 `json:"riskTier"`
 	StatusPageURL              *string                           `json:"statusPageUrl,omitempty"`
 	TermsOfServiceURL          *string                           `json:"termsOfServiceUrl,omitempty"`
 	PrivacyPolicyURL           *string                           `json:"privacyPolicyUrl,omitempty"`
@@ -868,6 +877,38 @@ type VendorEdge struct {
 	Node   *Vendor        `json:"node"`
 }
 
+type VendorRiskAssessment struct {
+	ID              gid.GID                  `json:"id"`
+	Vendor          *Vendor                  `json:"vendor"`
+	AssessedAt      time.Time                `json:"assessedAt"`
+	AssessedBy      *People                  `json:"assessedBy"`
+	ExpiresAt       time.Time                `json:"expiresAt"`
+	DataSensitivity coredata.DataSensitivity `json:"dataSensitivity"`
+	BusinessImpact  coredata.BusinessImpact  `json:"businessImpact"`
+	Notes           *string                  `json:"notes,omitempty"`
+	Attachments     []string                 `json:"attachments"`
+	CreatedAt       time.Time                `json:"createdAt"`
+	UpdatedAt       time.Time                `json:"updatedAt"`
+}
+
+func (VendorRiskAssessment) IsNode()             {}
+func (this VendorRiskAssessment) GetID() gid.GID { return this.ID }
+
+type VendorRiskAssessmentConnection struct {
+	Edges    []*VendorRiskAssessmentEdge `json:"edges"`
+	PageInfo *PageInfo                   `json:"pageInfo"`
+}
+
+type VendorRiskAssessmentEdge struct {
+	Cursor page.CursorKey        `json:"cursor"`
+	Node   *VendorRiskAssessment `json:"node"`
+}
+
+type VendorRiskAssessmentOrder struct {
+	Field     coredata.VendorRiskAssessmentOrderField `json:"field"`
+	Direction page.OrderDirection                     `json:"direction"`
+}
+
 type Viewer struct {
 	ID            gid.GID                 `json:"id"`
 	User          *User                   `json:"user"`

pkg/server/api/console/v1/types/vendor.go

@@ -52,8 +52,6 @@ func NewVendor(v *coredata.Vendor) *Vendor {
 		UpdatedAt:                  v.UpdatedAt,
 		ServiceStartAt:             v.ServiceStartAt,
 		ServiceTerminationAt:       v.ServiceTerminationAt,
-		ServiceCriticality:         v.ServiceCriticality,
-		RiskTier:                   v.RiskTier,
 		StatusPageURL:              v.StatusPageURL,
 		TermsOfServiceURL:          v.TermsOfServiceURL,
 		PrivacyPolicyURL:           v.PrivacyPolicyURL,

pkg/server/api/console/v1/types/vendor_risk_assessment.go

@@ -0,0 +1,57 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/page"
+)
+
+type (
+	VendorRiskAssessmentOrderBy OrderBy[coredata.VendorRiskAssessmentOrderField]
+)
+
+func NewVendorRiskAssessmentConnection(p *page.Page[*coredata.VendorRiskAssessment, coredata.VendorRiskAssessmentOrderField]) *VendorRiskAssessmentConnection {
+	var edges = make([]*VendorRiskAssessmentEdge, len(p.Data))
+
+	for i := range edges {
+		edges[i] = NewVendorRiskAssessmentEdge(p.Data[i], p.Cursor.OrderBy.Field)
+	}
+
+	return &VendorRiskAssessmentConnection{
+		Edges:    edges,
+		PageInfo: NewPageInfo(p),
+	}
+}
+
+func NewVendorRiskAssessmentEdge(c *coredata.VendorRiskAssessment, orderBy coredata.VendorRiskAssessmentOrderField) *VendorRiskAssessmentEdge {
+	return &VendorRiskAssessmentEdge{
+		Cursor: c.CursorKey(orderBy),
+		Node:   NewVendorRiskAssessment(c),
+	}
+}
+
+func NewVendorRiskAssessment(c *coredata.VendorRiskAssessment) *VendorRiskAssessment {
+	return &VendorRiskAssessment{
+		ID:              c.ID,
+		AssessedAt:      c.AssessedAt,
+		ExpiresAt:       c.ExpiresAt,
+		DataSensitivity: c.DataSensitivity,
+		BusinessImpact:  c.BusinessImpact,
+		Notes:           c.Notes,
+		CreatedAt:       c.CreatedAt,
+		UpdatedAt:       c.UpdatedAt,
+	}
+}

pkg/server/api/console/v1/v1_resolver.go

@@ -206,6 +206,22 @@ func (r *mutationResolver) CreateOrganization(ctx context.Context, input types.C
 	tenantIDs, _ := ctx.Value(userTenantContextKey).(*[]gid.TenantID)
 	*tenantIDs = append(*tenantIDs, organization.ID.TenantID())
 
+	_, err = svc.Peoples.Create(
+		ctx,
+		probo.CreatePeopleRequest{
+			OrganizationID:           organization.ID,
+			UserID:                   &UserFromContext(ctx).ID,
+			FullName:                 UserFromContext(ctx).FullName,
+			PrimaryEmailAddress:      UserFromContext(ctx).EmailAddress,
+			AdditionalEmailAddresses: []string{},
+			Kind:                     coredata.PeopleKindEmployee,
+		},
+	)
+
+	if err != nil {
+		return nil, fmt.Errorf("cannot create people: %w", err)
+	}
+
 	return &types.CreateOrganizationPayload{
 		OrganizationEdge: types.NewOrganizationEdge(organization, coredata.OrganizationOrderFieldCreatedAt),
 	}, nil
@@ -363,8 +379,6 @@ func (r *mutationResolver) CreateVendor(ctx context.Context, input types.CreateV
 			Description:                input.Description,
 			ServiceStartAt:             input.ServiceStartAt,
 			ServiceTerminationAt:       input.ServiceTerminationAt,
-			ServiceCriticality:         input.ServiceCriticality,
-			RiskTier:                   input.RiskTier,
 			StatusPageURL:              input.StatusPageURL,
 			TermsOfServiceURL:          input.TermsOfServiceURL,
 			PrivacyPolicyURL:           input.PrivacyPolicyURL,
@@ -399,8 +413,6 @@ func (r *mutationResolver) UpdateVendor(ctx context.Context, input types.UpdateV
 		Description:                input.Description,
 		ServiceStartAt:             input.ServiceStartAt,
 		ServiceTerminationAt:       input.ServiceTerminationAt,
-		ServiceCriticality:         input.ServiceCriticality,
-		RiskTier:                   input.RiskTier,
 		StatusPageURL:              input.StatusPageURL,
 		TermsOfServiceURL:          input.TermsOfServiceURL,
 		PrivacyPolicyURL:           input.PrivacyPolicyURL,
@@ -1034,6 +1046,33 @@ func (r *mutationResolver) DeletePolicy(ctx context.Context, input types.DeleteP
 	}, nil
 }
 
+// CreateVendorRiskAssessment is the resolver for the createVendorRiskAssessment field.
+func (r *mutationResolver) CreateVendorRiskAssessment(ctx context.Context, input types.CreateVendorRiskAssessmentInput) (*types.CreateVendorRiskAssessmentPayload, error) {
+	svc := GetTenantService(ctx, r.proboSvc, input.VendorID.TenantID())
+	user := UserFromContext(ctx)
+
+	expiresAt := time.Now().Add(time.Hour * 24 * 365)
+
+	vendorRiskAssessment, err := svc.Vendors.CreateRiskAssessment(
+		ctx,
+		probo.CreateVendorRiskAssessmentRequest{
+			VendorID:        input.VendorID,
+			AssessedByID:    user.ID,
+			ExpiresAt:       expiresAt,
+			DataSensitivity: input.DataSensitivity,
+			BusinessImpact:  input.BusinessImpact,
+			Notes:           input.Notes,
+		},
+	)
+	if err != nil {
+		panic(fmt.Errorf("cannot create vendor risk assessment: %w", err))
+	}
+
+	return &types.CreateVendorRiskAssessmentPayload{
+		VendorRiskAssessmentEdge: types.NewVendorRiskAssessmentEdge(vendorRiskAssessment, coredata.VendorRiskAssessmentOrderFieldCreatedAt),
+	}, nil
+}
+
 // LogoURL is the resolver for the logoUrl field.
 func (r *organizationResolver) LogoURL(ctx context.Context, obj *types.Organization) (*string, error) {
 	svc := GetTenantService(ctx, r.proboSvc, obj.ID.TenantID())
@@ -1544,6 +1583,11 @@ func (r *vendorResolver) ComplianceReports(ctx context.Context, obj *types.Vendo
 	return types.NewVendorComplianceReportConnection(page), nil
 }
 
+// RiskAssessments is the resolver for the riskAssessments field.
+func (r *vendorResolver) RiskAssessments(ctx context.Context, obj *types.Vendor, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.VendorRiskAssessmentOrder) (*types.VendorRiskAssessmentConnection, error) {
+	panic(fmt.Errorf("not implemented: RiskAssessments - riskAssessments"))
+}
+
 // BusinessOwner is the resolver for the businessOwner field.
 func (r *vendorResolver) BusinessOwner(ctx context.Context, obj *types.Vendor) (*types.People, error) {
 	svc := GetTenantService(ctx, r.proboSvc, obj.ID.TenantID())
@@ -1610,6 +1654,16 @@ func (r *vendorComplianceReportResolver) FileURL(ctx context.Context, obj *types
 	return fileURL, nil
 }
 
+// Vendor is the resolver for the vendor field.
+func (r *vendorRiskAssessmentResolver) Vendor(ctx context.Context, obj *types.VendorRiskAssessment) (*types.Vendor, error) {
+	panic(fmt.Errorf("not implemented: Vendor - vendor"))
+}
+
+// AssessedBy is the resolver for the assessedBy field.
+func (r *vendorRiskAssessmentResolver) AssessedBy(ctx context.Context, obj *types.VendorRiskAssessment) (*types.People, error) {
+	panic(fmt.Errorf("not implemented: AssessedBy - assessedBy"))
+}
+
 // Organizations is the resolver for the organizations field.
 func (r *viewerResolver) Organizations(ctx context.Context, obj *types.Viewer, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrganizationOrder) (*types.OrganizationConnection, error) {
 	user := UserFromContext(ctx)
@@ -1673,6 +1727,11 @@ func (r *Resolver) VendorComplianceReport() schema.VendorComplianceReportResolve
 	return &vendorComplianceReportResolver{r}
 }
 
+// VendorRiskAssessment returns schema.VendorRiskAssessmentResolver implementation.
+func (r *Resolver) VendorRiskAssessment() schema.VendorRiskAssessmentResolver {
+	return &vendorRiskAssessmentResolver{r}
+}
+
 // Viewer returns schema.ViewerResolver implementation.
 func (r *Resolver) Viewer() schema.ViewerResolver { return &viewerResolver{r} }
 
@@ -1688,4 +1747,5 @@ type riskResolver struct{ *Resolver }
 type taskResolver struct{ *Resolver }
 type vendorResolver struct{ *Resolver }
 type vendorComplianceReportResolver struct{ *Resolver }
+type vendorRiskAssessmentResolver struct{ *Resolver }
 type viewerResolver struct{ *Resolver }