AACE 122R-22 QRAMM maturity tier badge for an SRA result. Scores a Schedule Risk Analysis run (from monte_carlo_p50_p80 or any equivalent dict) against AACE RP 122R-22 (Quantitative Risk Analysis Maturity Model) structure: tier 1 (Initial) through tier 4 (Optimized) per CMMI-style framing of evid...
Part of the Cpp Cpm Engine server.
Free to start. No card required.
AI agents may call qramm_maturity to permanently remove or destroy resources in Cpp Cpm Engine. Without a policy, an autonomous agent could delete critical data in a loop with no way to undo the damage. PolicyLayer blocks destructive tools by default and requires explicit human approval before enabling them.
Without a policy, an AI agent could call qramm_maturity in a loop, permanently destroying resources in Cpp Cpm Engine. There is no undo for destructive operations. PolicyLayer blocks this tool by default and only allows it when a human explicitly approves the action.
Destructive tools permanently remove data. Block by default. Only enable with explicit approval workflows.
{
"version": "1",
"default": "deny",
"hide": [
"qramm_maturity"
]
}See the full Cpp Cpm Engine policy for all 12 tools.
These attack patterns abuse exactly the kind of access qramm_maturity gives an agent. Each links to the full case and the policy that stops it:
Other destructive tools across the catalogue. The same approach applies to each: deny by default, or require human approval.
AACE 122R-22 QRAMM maturity tier badge for an SRA result. Scores a Schedule Risk Analysis run (from monte_carlo_p50_p80 or any equivalent dict) against AACE RP 122R-22 (Quantitative Risk Analysis Maturity Model) structure: tier 1 (Initial) through tier 4 (Optimized) per CMMI-style framing of evidence the SRA carries. Inputs the SRA inspects (defensively, all keys optional): - baseline.percentiles (P50 / P80 presence) - baseline.config (iterations, opt/ml/pes %, distribution) - baseline.sensitivity (per-activity tornado rows) - mitigated (scenario comparison evidence) - risk_register_simulation + risk_register_used (Hulett qualitative risk register evidence) - convergence (optional MC convergence diagnostics) Use this tool any time you have an SRA result and want a maturity tier suitable for a forensic-claim methodology section. The badge carries a mandatory caveat that the tier definitions are an interpretation of typical risk-maturity- model structure pending confirmation against AACE 122R-22 §3 primary text. Args: sra_result: dict from monte_carlo_p50_p80. May be {} - the badge degrades to Tier 1 with a clear note. Returns: { "rp_citation": "AACE RP 122R-22 ...", "tier": int (1-4), "tier_label": "Initial" | "Defined" | "Managed" | "Optimized", "tier_description": longer interpretive description, "tier_color": "#xxxxxx", "evidence": ["..." what the SRA had / lacked], "gaps_to_next_tier": ["..." concrete advance steps], "caveat": disclosure string }. It is categorised as a Destructive tool in the Cpp Cpm Engine MCP Server, which means it can permanently delete or destroy data. Block by default and require explicit approval.
Register the Cpp Cpm Engine MCP server in PolicyLayer and add a rule for qramm_maturity: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Cpp Cpm Engine. Nothing to install.
qramm_maturity is a Destructive tool with critical risk. Critical-risk tools should be blocked by default and only enabled with explicit human approval.
Yes. Add a rate_limit block to the qramm_maturity rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for qramm_maturity. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
qramm_maturity is provided by the Cpp Cpm Engine MCP server (https://mcp.criticalpathpartners.ca/mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Deterministic rules across all 12 Cpp Cpm Engine tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.
Free to start. No card required.
4,600+ MCP servers and 31,000+ tools scanned and risk-classified.