Why is UUID not used to reference back-matter resources in control-implementation?

[telosBA]

When parties, information data types, location, and leveraged authorization are used, uuid is referenced. Back-matter is the only tag to not maintain this uuid linkage when referenced in other locations for OSCAL SSP. Is there a reason why href was used in this case instead?

[aj-stein-nist]

When parties, information data types, location, and leveraged authorization are used, uuid is referenced. Back-matter is the only tag to not maintain this uuid linkage when referenced in other locations for OSCAL SSP. Is there a reason why href was used in this case instead?

Sorry, can give a specific example re the referencing of back-matter/resources in the control-implementation? I assume you are not talking about resource UUIDs and such so I want to make sure I address the specific question/explanation you have in mind.

UPDATE: I can't mark my comment below as the answer, but 👇 in #1254 (reply in thread) that is the actual answer (not this).

[telosBA]

control-implementation implemented-requirement statement link href description reads: "...a local reference using a fragment e.g. #fragment that points to a back-matter resource in the same document." It is the use of fragment as opposed to resource uuid that we are concerned with.

[aj-stein-nist]

Ah ok, thank you so much! We quickly summarized in a triage meeting and in my notes I missed the important bit! 😆 So it seems we are discussing the finer points of this text (as it is currently written on the published site at the time of this writing):

The value of the href can be an internet resource, or a local reference using a fragment e.g. #fragment that points to a back-matter resource in the same document.

If a local reference using a fragment is used, this will be indicated by a fragment "#" followed by an identifier which references an identified resource in the document's back-matter or another object that is within the scope of the containing OSCAL document.

If an internet resource is used, the href value will be an absolute or relative URI pointing to the location of the referenced resource. A relative URI will be resolved relative to the location of the document containing the link.

In this case this seems to be for convenience and unified use of the same data element (@href) to closely as mirror HTML anchor and linking mechanisms as close as possible. This allows to have it contextually be a UUID #UUID like #5bbe4393-8df2-4de2-8284-5442cd8fdf93 or not flexibly in the same place as developers (and many users) familiar with the HTML document model.

tl;dr: Flexibility and similar to many common use cases.