matching-existing-controls

Fetch all active published controls via GET /controls?status=active&state=published, then compute a weighted similarity score for each candidate against the requirement. Scores of 0.80 or above indicate the existing control can be reused.

Use 0.80 as the threshold for automatic reuse and 0.50 as the floor for possible matches. Scores between 0.50 and 0.79 should be flagged for human review rather than silently reused, and anything below 0.50 means designing a new control.

Name similarity uses token-set Jaccard overlap weighted at 0.35, while description overlap uses keyword extraction and shared concept matching weighted at 0.30. Category alignment contributes 0.20 and plugin relevance 0.15 to the total score.

Flag matches scoring between 0.50 and 0.79 for human review because the similarity is plausible but not certain enough for automatic reuse. For example, a score of 0.70 indicates overlapping concepts but insufficient confidence to map the requirement silently.

Lexical methods like token-set Jaccard can miss semantically equivalent controls phrased differently and may over-score controls sharing generic compliance vocabulary. The 0.50–0.79 review band exists precisely to catch these ambiguous cases.