Proposal: Safety Relevance Metadata for CycloneDX

## Summary

This proposal introduces an optional **Safety Relevance** metadata property for CycloneDX components.

The goal is to capture whether a component participates in safety-critical or mission-critical functions where compromise, malfunction, or misuse could contribute to:

* Physical harm
* Human safety risks
* Environmental damage
* Critical infrastructure disruption
* Societal impact

The proposal complements existing CycloneDX capabilities such as Vulnerability Disclosure, VEX, AI BOM, and dependency analysis by adding contextual information about the operational consequences of component failure.

## Motivation

CycloneDX provides rich metadata describing:

* Component identity
* Dependencies
* Vulnerabilities
* VEX assertions
* Services
* AI and machine learning artifacts

However, it does not currently express whether a component is part of a safety-critical system.

Organizations in automotive, healthcare, robotics, industrial control systems, energy, and AI increasingly require this context to:

* Prioritize remediation
* Interpret VEX results
* Build safety cases
* Meet regulatory obligations
* Improve risk governance

## Initial Proposal

Introduce optional metadata properties:

* cyclonedx:safety-relevance
* cyclonedx:safety-domain
* cyclonedx:safety-impact

Example:

safety-relevance = Critical

safety-domain = Medical

safety-impact = HumanSafety

## Example Classification

* None
* Indirect
* Critical
* Unknown

## Questions for the Community

1. Should Safety Relevance begin as custom properties or as a first-class schema object?
2. Are there existing use cases in medical, automotive, AI, or industrial systems?
3. How should Safety Relevance interact with VEX and vulnerability analysis?
4. Would a common taxonomy benefit downstream tooling and SBOM consumers?

## Next Steps

If there is interest, I can:

* Draft a formal schema proposal
* Provide example BOMs
* Develop mappings to VEX and AI BOM
* Collaborate with the community on taxonomy and governance