# Contributing to AATS

Open a focused issue or RFC before changing a normative control. Explain the risk, proposed wording, capability level, verification method, evidence burden, privacy impact, and interoperability effect. Keep requirements vendor-neutral and testable. New fields in schemas need examples and validation. Changes to normative text need a changelog entry and control-ID migration note when relevant.

All participants must disclose relevant conflicts of interest. By submitting a contribution, you confirm that you have the right to license it under the repository license. Editors may request a reproducible test case or alternative evidence method before accepting a control.