From 9f518d24ce1a50fde5d6a1234480fded0731ed19 Mon Sep 17 00:00:00 2001
From: Chris Compton <daniel.compton@nist.gov>
Date: Mon, 17 Oct 2022 11:04:01 -0500
Subject: [PATCH] Support additional control-origination props #784 (#1460)

* Support additional control-origination props #784
* Update recommended path to target additional nodes.

Co-authored-by: David Waltermire <david.waltermire@nist.gov>
---
 src/metaschema/oscal_ssp_metaschema.xml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/metaschema/oscal_ssp_metaschema.xml b/src/metaschema/oscal_ssp_metaschema.xml
index 6c51f093dd..41aa0c8e3a 100644
--- a/src/metaschema/oscal_ssp_metaschema.xml
+++ b/src/metaschema/oscal_ssp_metaschema.xml
@@ -717,10 +717,10 @@
       <field ref="remarks" in-xml="WITH_WRAPPER"/>
     </model>
     <constraint>
-      <allowed-values target="prop/@name" allow-other="yes">
-        <enum value="control-origination">Identifies the source of the implemented control.</enum>
+      <allowed-values target="(.|statement|.//by-component)/prop/@name" allow-other="yes">
+        <enum value="control-origination">Identifies the source of the implemented control.  Any <code>control-origination</code> prop defined in a child context will override the parent value.</enum>
       </allowed-values>
-      <allowed-values target="prop[@name='control-origination']/@value">
+      <allowed-values target="(.|statement|.//by-component)/prop[@name='control-origination']/@value">
         <enum value="organization">The control is implemented by the organization owning the system, but is not specific to the system itself.</enum>
         <enum value="system-specific">The control is implemented specifically to this system.</enum>
         <enum value="customer-configured">The control is provided by the system, but must be configured by the customer.</enum>