Overview
The OSCAL export refuses to emit an SSP or POA&M that the NIST OSCAL 1.1.2 schema would reject, and reports which fields are wrong instead of producing a document that cannot be submitted.
What the gate checks
Every export and the validate endpoint run the document against the official NIST OSCAL schemas, vendored with the platform. A document that fails is refused and not saved; the response names the fields that are wrong.
Why SSP export currently refuses
The NIST schema requires at least one system user and one inventory item in a complete SSP, and the platform does not collect either yet. Export therefore returns a 422 listing those fields. This is the correct behaviour: no placeholder users or inventory were invented to make the gate pass.
What is fixed versus the old generator
Metadata no longer carries fields the schema forbids, statement text lives in the structure the schema expects, empty properties are dropped, and leveraged authorizations require a real date rather than an invented one.
Older documents
OSCAL documents saved before this gate existed were never re-validated and may be invalid. Run them through the validate endpoint before relying on them.