Method
Use the same eight fields every time.
Expertise is explaining why this control stops this path, and what it still leaves possible. A risk label is only the start.
Task: the approved outcome, in one sentence. Asset: what would be harmed. Input: every place an attacker can write, including attachments, pages, tool descriptions, and memory. Permission: the grant you intend, narrower than the person.
Harmful path: the steps from that input to an effect. Enforcement: the component that can reject the effect when the model asks for it. Evidence: the test that shows the rejection and shows the approved work still succeeds. Remaining risk: what is still possible, and who accepts it.
A release criterion is a condition you meet before the use expands. “Tenant separation is tested” is a criterion. “We felt ready” is not.