[{"initiative_id":"ARA-261031-2D523F","source_app":"ara","capability":"risk_analyst","finding_id":"R-01","finding_type":"risk","title":"Employees see colleagues' salary or medical data","description":"Retrieval returns documents the user should not see.","severity":"Critical","likelihood":"Likely","impact":"Major","confidence":"ai_inferred","regulations_cited":[]},{"initiative_id":"ARA-261031-2D523F","source_app":"ara","capability":"risk_analyst","finding_id":"R-02","finding_type":"risk","title":"Wrong policy answers","description":"Out-of-date or hallucinated answers.","severity":"Medium","likelihood":"Possible","impact":"Moderate","confidence":"ai_inferred","regulations_cited":[]},{"initiative_id":"ARA-261031-2D523F","source_app":"ara","capability":"risk_analyst","finding_id":"R-03","finding_type":"risk","title":"External LLM retains HR data","description":"Provider stores prompts or uses them for training.","severity":"High","likelihood":"Possible","impact":"Major","confidence":"ai_inferred","regulations_cited":[]},{"initiative_id":"ARA-261031-2D523F","source_app":"ara","capability":"risk_analyst","finding_id":"R-04","finding_type":"risk","title":"Translation errors change policy meaning","description":"Mandarin or Portuguese answers misstate the policy.","severity":"Medium","likelihood":"Possible","impact":"Moderate","confidence":"ai_inferred","regulations_cited":[]},{"initiative_id":"ARA-261031-2D523F","source_app":"ara","capability":"compliance_analyst","finding_id":"CMP-01","finding_type":"gap","title":"Privacy Act 1988 (Australia) - potentially_applicable","description":"Applies to Australian operations; the employee records exemption may cover some handling by a private-sector employer, but not necessarily disclosure to an external provider.","severity":"Medium","confidence":"ai_inferred","regulations_cited":["Privacy Act 1988"],"policy_questions":["What does Privacy Act 1988 require for this scenario?"],"source_url":"https://www.oaic.gov.au/privacy/the-privacy-act"},{"initiative_id":"ARA-261031-2D523F","source_app":"ara","capability":"compliance_analyst","finding_id":"CMP-02","finding_type":"gap","title":"General Data Protection Regulation (EU) 2016/679 (European Union) - potentially_applicable","description":"Applies if employees are in the EU; health data is a special category.","severity":"Medium","confidence":"ai_inferred","regulations_cited":["General Data Protection Regulation (EU) 2016/679"],"policy_questions":["What does General Data Protection Regulation (EU) 2016/679 require for this scenario?"],"source_url":null},{"initiative_id":"ARA-261031-2D523F","source_app":"ara","capability":"compliance_analyst","finding_id":"CMP-03","finding_type":"gap","title":"Regulation (EU) 2024/1689 (AI Act), Article 50 transparency (European Union) - potentially_applicable","description":"AI systems that interact with people must make clear they are interacting with AI.","severity":"Medium","confidence":"ai_inferred","regulations_cited":["Regulation (EU) 2024/1689 (AI Act), Article 50 transparency"],"policy_questions":["What does Regulation (EU) 2024/1689 (AI Act), Article 50 transparency require for this scenario?"],"source_url":null},{"initiative_id":"ARA-261031-2D523F","source_app":"ara","capability":"compliance_analyst","finding_id":"CMP-04","finding_type":"citation","title":"Personal Information Protection Law (China); LGPD (Brazil) (China; Brazil) - not_enough_information","description":"Mandarin and Portuguese suggest employees in these countries; locations are not stated.","severity":"Medium","confidence":"ai_inferred","regulations_cited":["Personal Information Protection Law (China); LGPD (Brazil)"],"policy_questions":["What does Personal Information Protection Law (China); LGPD (Brazil) require for this scenario?"],"source_url":null},{"initiative_id":"ARA-261031-2D523F","source_app":"ara","capability":"security_analyst","finding_id":"T-01","finding_type":"risk","title":"Permission bypass through retrieval","description":"A user asks indirectly for restricted content.","severity":"Critical","likelihood":"Likely","impact":"Major","confidence":"ai_inferred"},{"initiative_id":"ARA-261031-2D523F","source_app":"ara","capability":"security_analyst","finding_id":"T-02","finding_type":"risk","title":"Indirect prompt injection in a policy document","description":"An uploaded document contains instructions.","severity":"Medium","likelihood":"Possible","impact":"Moderate","confidence":"ai_inferred"},{"initiative_id":"ARA-261031-2D523F","source_app":"ara","capability":"control_analyst","finding_id":"C-01","finding_type":"control","title":"Permission-aware retrieval","description":"Only documents the employee may read are searchable; permissions synced from the source.","severity":"High","confidence":"ai_inferred","controls_addressing":["R-01"]},{"initiative_id":"ARA-261031-2D523F","source_app":"ara","capability":"control_analyst","finding_id":"C-02","finding_type":"control","title":"Exclude personal records from the index","description":"Index policies only; route personal questions to the HR system.","severity":"High","confidence":"ai_inferred","controls_addressing":["R-01","R-03"]},{"initiative_id":"ARA-261031-2D523F","source_app":"ara","capability":"control_analyst","finding_id":"C-03","finding_type":"control","title":"Provider terms: no training, limited retention","description":"Contract and configuration prevent data use for training.","severity":"High","confidence":"ai_inferred","controls_addressing":["R-03"]},{"initiative_id":"ARA-261031-2D523F","source_app":"ara","capability":"control_analyst","finding_id":"C-04","finding_type":"control","title":"Grounded answers with citations and version control","description":"Answers cite the current policy version; low evidence means no answer.","severity":"Medium","confidence":"ai_inferred","controls_addressing":["R-02","R-04"]},{"initiative_id":"ARA-261031-2D523F","source_app":"ara","capability":"control_analyst","finding_id":"C-05","finding_type":"control","title":"Leakage testing before go-live","description":"Test each role against protected records (for example with Secure-RAG Breach Lab).","severity":"High","confidence":"ai_inferred","controls_addressing":["R-01"]}]