California mapping

The California mapping, and its limits

Alignment notice. Aligned to, not approved or endorsed by, the State of California. Running these gates does not make a system compliant with SIMM 5305-F, SAM 4986.9, or any other requirement. The State of California, the California Department of Technology, and the Department of General Services have not reviewed, approved, endorsed, or certified this harness or any result it produces. See docs/california-mapping.md for the gate-to-framework mapping and its limits.

What it is for

Its purpose is narrow. A vendor making the written contractor disclosure that SAM 4986.9 requires can attach a Gauntlet run as the testing evidence behind that disclosure. A state entity filling in the SIMM 5305-F safeguards items can point at gate outcomes instead of prose assurances.

'Informs' means the gate produces runnable, repeatable evidence a state entity or vendor can attach when answering that item. It never means the gate satisfies the item by itself, and it never means the item has been reviewed by anyone.

Its limits, enforced rather than promised

"Informs" is not "satisfies." A gate produces evidence a reviewer can attach when answering an item. It never answers the item.
Only identifiers that were read are cited. Every citation was read against its source on the date recorded below. The identifiers that could not be verified are listed here and in every evidence pack, so their absence is visibly a choice rather than an oversight. A test fails if an unverified identifier appears in the mapping.
A gate that maps to nothing verified says so. No link is invented to make the table look complete.
Nothing here is approval. A completed SIMM 5305-F is confidential under the Government Code section cited in its own footer; this mapping is built from the blank template that CDT publishes.
If a source revises, the mapping is re-read. Old citations are not silently carried forward.

The mapping

Each row maps one gate to the items its results inform and to the disclosure content it supports. The last row is a harness property rather than a gate. The same table lives in the repository as a machine-readable module, and it is what the evidence pack cites, so the prose and the code cannot drift apart.

Gate outcomes and the framework items they inform. Informing an item is not satisfying it.
Gate	Items the results inform	Disclosure content supported
`adversarial`	SIMM 5305-F, Section V, Chatbots and Resident (Public) Facing. The row 'Crafty inputs can train the back end LLM', whose mitigation is to create a test plan including various crafty prompts that try to get the LLM to respond in an unintended manner. This suite is that test plan, made regression-tested instead of one-time. SIMM 5305-F, Section V, Generative AI Platforms and Code Analysis. The rows on insufficient scrutiny of LLM output leading to unintended code execution, on segregating external content from user prompts, and on content safety filters for prompt inputs and responses. SIMM 5305-F, Risk Assessment Part 2, Mandatory Minimum Safeguards. The row on not engaging in manipulation of other GenAI systems. SIMM 5305-F, Risk Assessment Part 2, Details of Transparency, item (b). Mechanisms to audit the system: the case files are the audit procedure, and a reviewer can run them. SIMM 5305-F, Section V, GenAI Use Cases and Safeguard Samples, common safeguards. The common safeguard 'Provide support for multiple languages or dialects, depending on the demographic it serves'. Bilingual counts in this pack are counted from executed cases.	The disclosure can state, with counts emitted by the harness, which injection classes are exercised in which languages on every merge, rather than describing red-teaming as a one-time event.
`false_positive`	SIMM 5305-F, Section I, Introduction. The statement that GenAI systems are to augment and improve workflows, 'not to replace or impair the services received by the public'. SIMM 5305-F, Risk Assessment Part 2, Mandatory Minimum Safeguards. The row that the system 'will not have the potential to degrade public services'. SIMM 5305-F, Section V, Network Analysis Tools and Spam and Malware Detection. Models the same failure mode: false positives that block legitimate activity undermine the service they are meant to protect.	Lets the disclosure claim safety thresholds without hiding an over-blocking regression: the same run that proves refusals proves legitimate requests still succeed, with counts for both.
`golden`	SIMM 5305-F, Risk Assessment Part 2, Human Oversight and Monitoring, item (c). How system owners test, evaluate, and verify that the designated GenAI Risk Level has not changed. SIMM 5305-F, Risk Assessment Part 1, signature block. The requirement that a new assessment be submitted if additional GenAI features are enabled beyond those documented. Drift detection is the tripwire that notices behavior change between assessments. SIMM 5305-F, Section V, GenAI Use Cases and Safeguard Samples, common safeguards. Regular audits of GenAI-generated data and curated sets of validated responses. SIMM 5305-F, Section V, Generative AI Platforms and Code Analysis. Continuous benchmarking to identify unexpected drops in accuracy or changes in behavior.	Disclosure of change over time: each run is comparable to the last, so 'the system still behaves as assessed' is a diffable artifact rather than an assertion.
`grounding`	SIMM 5305-F, Section III, GenAI Risk Table Assessment Scale. The line separating Moderate 'Decision Related, Non-Confidential/Non-PII Related, Not Validated' from Low 'Decision Related, Non-Confidential/Non-PII Related, Validated' turns on whether output is verified against the original data source. Grounding results are mechanical evidence for the 'Validated' side. SIMM 5305-F, Risk Assessment Part 1, Questionnaire item (h). Safeguards deployed, evidenced per release rather than described. SIMM 5305-F, Risk Assessment Part 2, Mandatory Minimum Safeguards. The rows on human verification of accuracy and factuality, and on citing GenAI output from credible sources when statements of fact are published for consumer use. SIMM 5305-F, Risk Assessment Part 2, Human Oversight and Monitoring, item (a). Identifying and mitigating hallucinations: an uncited or context-absent identifier fails the build. SIMM 5305-F, Section V, GenAI Use Cases and Safeguard Samples, common safeguards. The common safeguard 'Configure the tools to provide links back to the source material'.	The SAM 4986.9 written disclosure gains substance: instead of asserting that outputs are verified, the vendor attaches per-release grounding results that a reviewer can rerun.
`refusal`	SIMM 5305-F, Section V, GenAI Use Cases and Safeguard Samples, common safeguards. The row 'GenAI might fail to identify when an issue or interaction requires escalation to a human representative' and its mitigations on clear escalation rules. SIMM 5305-F, Risk Assessment Part 2, Mandatory Minimum Safeguards. The row on being designed to avoid generating illicit content. SIMM 5305-F, Risk Assessment Part 2, Human Oversight and Monitoring, item (b). Intended audience and impact on specific groups, for resident-facing crisis routing.	Evidence that refusal and crisis-routing behavior is enforced at release time at a 100% threshold, attachable to the Part 1 safeguards narrative and the Part 2 checklist answers.
`self_test_doctrine`	SIMM 5305-F, Risk Assessment Part 1, Safeguard Level scale. The scale runs from Not Identified to Fully Identified. The difference between an identified safeguard and a working one is demonstrability, which is what the failure demonstrations provide. SIMM 5305-F, Risk Assessment Part 2, Details of Transparency, item (b). Auditability of the system: a reviewer can break the toy and watch each gate catch it, rather than trusting that the gates work.	Makes the evidence pack inspectable by a skeptical reviewer: the disclosure can invite the reviewer to run the failure demonstrations themselves.

Sources read

Every section identifier cited above was read against the source. Where a source could not be read, the identifier is omitted and listed below instead of being guessed.

The sources that were read before anything was cited from them.
Source	Version read	How read	Read on
SIMM 5305-F, Generative Artificial Intelligence Risk Assessment	August 2025 revision, 28 pages	Full PDF from cdt.ca.gov, read page by page	2026-08-07
SAM 4986.2, Definitions for GenAI	Rev. 02/2025	dgs.ca.gov SAM section page	2026-08-07
SAM 4986.9, GenAI Procurement	Rev. 11/2025	dgs.ca.gov SAM section page	2026-08-07
Government Code section 11549.64	Effective 2025-01-01 (SB 896)	leginfo.legislature.ca.gov, subdivisions (a) through (d)	2026-08-07
genai.ca.gov, Disclosure and Contract Language page	As published 2026-08-07	genai.ca.gov procurement toolkit	2026-08-07

Identifiers not verified, therefore omitted

These identifiers appear in the sources above but were not themselves read. They are listed so their absence from the mapping is visibly a choice, not an oversight. A test fails if any of them appears in a mapping row.

Identifiers deliberately left out of the mapping, and why.
Identifier	Why it is omitted
SCM section 2302	Named on the genai.ca.gov disclosure page as the home of solicitation language. The State Contracting Manual volume text was not retrieved.
IT General Provisions	Named on genai.ca.gov. The provision documents were not read, so no clause numbers are cited anywhere in this mapping.
GenAI Special Provisions	Named on genai.ca.gov. The provision documents were not read, so no clause numbers are cited anywhere in this mapping.
Government Code section 11549.65(c)	Referenced by the SAM 4986.9 page. Not read.
Government Code section 7929.210	Cited inside SIMM 5305-F as a confidentiality basis for completed forms. The code section itself was not read.
Government Code section 8592.45	Cited inside SIMM 5305-F as a confidentiality basis for completed forms. The code section itself was not read.
SAM 5300 series	Named inside SIMM 5305-F rows and instructions. The referenced standards were not read.
SIMM 5300-A	Named inside SIMM 5305-F. Not read.
SIMM 5305-A	Named inside SIMM 5305-F. Not read.
SIMM 5310-C	Named inside SIMM 5305-F as the separate privacy assessment. Not read.
SIMM 5360-A	Named inside SIMM 5305-F. Not read.
SAM 4983.1	Named inside SIMM 5305-F. Not read.
SIMM 140	Named inside SIMM 5305-F. Not read.
SAM 4819.2	Named inside SIMM 5305-F. Not read.
SAM 5300.4	Named inside SIMM 5305-F. Not read.
The verbatim SAM 4986.9 standard disclosure clause	The duty and its trigger were verified. The exact clause wording was not captured, so it is paraphrased here and never quoted.

A correction made by reading

The scoping document assumed the written disclosure duty lived in SAM 4986.2. Reading the SAM 4986 series shows otherwise: SAM 4986.2 is the definitions section, where "Material Impact / Materially Impacts" is defined, and the contractor disclosure duty sits in SAM 4986.9, GenAI Procurement. The mapping cites the corrected locations. The exact standard clause wording was not captured verbatim and is paraphrased, never quoted.

The full account, including where the disclosure duty comes from and the change discipline that applies when a source revises, is in docs/california-mapping.md in the repository.