@openauditmodel/cli 0.4.0 → 0.4.2

package/examples/profiles/customer-and-account-management/valid/customer-delete.json

@@ -0,0 +1,71 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2c40-0006-7b3c-8d4e-5f6071829306",
+  "time": "2026-04-08T15:02:38.410Z",
+  "event": {
+    "name": "customer.delete",
+    "category": "data-modification",
+    "type": "delete",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Personal data erased from a closed customer record; settlement history retained."
+  },
+  "actor": {
+    "type": "user",
+    "id": "operator-4102",
+    "tenantId": "tenant-19",
+    "roles": ["customer-data-steward"]
+  },
+  "resource": {
+    "type": "customer",
+    "id": "customer-42",
+    "classification": "restricted",
+    "tenantId": "tenant-19"
+  },
+  "application": {
+    "name": "customer-platform",
+    "environment": "production",
+    "version": "5.2.0",
+    "service": "customer-records"
+  },
+  "organization": {
+    "tenantId": "tenant-19",
+    "businessUnitId": "unit-retail"
+  },
+  "request": {
+    "requestId": "request-9f31f3",
+    "correlationId": "erasure-7742"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "customer-data-retention",
+    "policyVersion": "3"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-customer-erasure",
+    "requiredApprovals": 2,
+    "receivedApprovals": 2,
+    "approvedAt": "2026-04-08T14:59:10Z"
+  },
+  "reason": {
+    "code": "erasure-request",
+    "text": "Erasure requested after the retention period for the closed relationship elapsed.",
+    "reference": "case-3901"
+  },
+  "privacy": {
+    "containsPersonalData": false,
+    "processing": "drop",
+    "minimized": true,
+    "purpose": "operational-audit"
+  },
+  "controlCategories": ["customer-lifecycle", "data-erasure"],
+  "metadata": {
+    "customer": {
+      "customerType": "business",
+      "deletionScope": "personal-data",
+      "retainedRecords": "settlement-history"
+    }
+  }
+}

package/examples/profiles/customer-and-account-management/valid/customer-merge.json

@@ -0,0 +1,79 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2c40-0003-7b3c-8d4e-5f6071829303",
+  "time": "2026-04-08T11:04:12.510Z",
+  "event": {
+    "name": "customer.merge",
+    "category": "data-modification",
+    "type": "update",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Duplicate business customer record merged into the surviving record."
+  },
+  "actor": {
+    "type": "user",
+    "id": "operator-3318",
+    "tenantId": "tenant-19",
+    "roles": ["customer-administrator"]
+  },
+  "resource": {
+    "type": "customer",
+    "id": "customer-42",
+    "classification": "restricted",
+    "tenantId": "tenant-19"
+  },
+  "relatedResources": [
+    {
+      "type": "customer",
+      "id": "customer-8420",
+      "classification": "restricted",
+      "tenantId": "tenant-19"
+    }
+  ],
+  "application": {
+    "name": "customer-platform",
+    "environment": "production",
+    "version": "5.2.0",
+    "service": "customer-records"
+  },
+  "organization": {
+    "tenantId": "tenant-19",
+    "businessUnitId": "unit-retail"
+  },
+  "request": {
+    "requestId": "request-9f31c4",
+    "correlationId": "duplicate-resolution-2290"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "customer-data-quality",
+    "policyVersion": "4"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-customer-merge",
+    "requestId": "approval-request-6104",
+    "requiredApprovals": 2,
+    "receivedApprovals": 2,
+    "approvedAt": "2026-04-08T10:58:33Z"
+  },
+  "reason": {
+    "code": "duplicate-record",
+    "text": "Two records described the same business party after a bulk import.",
+    "reference": "case-3502"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["relatedAccounts", "primaryContactId"]
+  },
+  "controlCategories": ["customer-lifecycle", "data-quality"],
+  "metadata": {
+    "customer": {
+      "customerType": "business",
+      "status": "active",
+      "mergedFromId": "customer-8420",
+      "mergeStrategy": "retain-oldest"
+    }
+  }
+}

package/examples/profiles/customer-and-account-management/valid/customer-restrict.json

@@ -0,0 +1,76 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2c40-0005-7b3c-8d4e-5f6071829305",
+  "time": "2026-04-08T13:47:22.660Z",
+  "event": {
+    "name": "customer.restrict",
+    "category": "security",
+    "type": "update",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Customer relationship restricted to inbound settlement only after a periodic review."
+  },
+  "actor": {
+    "type": "user",
+    "id": "operator-4102",
+    "tenantId": "tenant-19",
+    "roles": ["customer-risk-officer"]
+  },
+  "resource": {
+    "type": "customer",
+    "id": "customer-42",
+    "classification": "restricted",
+    "tenantId": "tenant-19"
+  },
+  "application": {
+    "name": "customer-platform",
+    "environment": "production",
+    "version": "5.2.0",
+    "service": "customer-risk"
+  },
+  "organization": {
+    "tenantId": "tenant-19",
+    "businessUnitId": "unit-retail"
+  },
+  "request": {
+    "requestId": "request-9f31e6",
+    "correlationId": "periodic-review-4471"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "customer-risk-controls",
+    "policyVersion": "11"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-customer-restriction",
+    "requiredApprovals": 2,
+    "receivedApprovals": 2,
+    "approvedAt": "2026-04-08T13:44:51Z"
+  },
+  "reason": {
+    "code": "periodic-review-finding",
+    "text": "Periodic review could not confirm the declared ownership structure.",
+    "reference": "review-2026-044"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["status", "permittedOperations"],
+    "before": {
+      "status": "active"
+    },
+    "after": {
+      "status": "restricted"
+    }
+  },
+  "controlCategories": ["customer-lifecycle", "customer-restriction"],
+  "metadata": {
+    "customer": {
+      "customerType": "business",
+      "status": "restricted",
+      "restrictionScope": "outbound-payments",
+      "reviewId": "review-2026-044"
+    }
+  }
+}

package/examples/profiles/customer-and-account-management/valid/customer-update.json

@@ -0,0 +1,65 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2c40-0002-7b3c-8d4e-5f6071829302",
+  "time": "2026-04-08T10:31:47.880Z",
+  "event": {
+    "name": "customer.update",
+    "category": "data-modification",
+    "type": "update",
+    "outcome": "success",
+    "summary": "Registered trading address and billing contact reference updated."
+  },
+  "actor": {
+    "type": "user",
+    "id": "operator-3318",
+    "tenantId": "tenant-19",
+    "roles": ["customer-administrator"]
+  },
+  "resource": {
+    "type": "customer",
+    "id": "customer-42",
+    "classification": "restricted",
+    "tenantId": "tenant-19"
+  },
+  "application": {
+    "name": "customer-platform",
+    "environment": "production",
+    "version": "5.2.0",
+    "service": "customer-records"
+  },
+  "organization": {
+    "tenantId": "tenant-19",
+    "businessUnitId": "unit-retail"
+  },
+  "request": {
+    "requestId": "request-9f31b7",
+    "correlationId": "customer-maintenance-5108"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "customer-maintenance",
+    "policyVersion": "9"
+  },
+  "reason": {
+    "code": "customer-request",
+    "text": "Customer notified a change of registered trading address.",
+    "reference": "case-3417"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["registeredAddress", "billingContactId"]
+  },
+  "privacy": {
+    "containsPersonalData": false,
+    "minimized": true,
+    "processing": "reference",
+    "purpose": "operational-audit"
+  },
+  "metadata": {
+    "customer": {
+      "customerType": "business",
+      "status": "active"
+    }
+  }
+}

package/examples/profiles/deployment-and-change-management/README.md

@@ -0,0 +1,115 @@
+# Deployment and change management profile fixtures
+
+**Status: Informative.** These fixtures illustrate and regression-test the
+[deployment-and-change-management profile](../../../profiles/deployment-and-change-management/). The
+rules themselves are in
+[profile.json](../../../profiles/deployment-and-change-management/profile.json).
+
+```bash
+auditmodel check-profile examples/profiles/deployment-and-change-management/valid --profile deployment-and-change-management
+```
+
+Every fixture here — valid, invalid and not-applicable alike — is a **core-conforming** event. The
+ones under `invalid/` fail the profile, not the core schema. That separation is the point: a profile
+adds requirements to events the core already accepts.
+
+## The guarantee these fixtures carry
+
+Each file under `valid/` must satisfy all three commands, and a test enforces it:
+
+```bash
+auditmodel validate      examples/profiles/deployment-and-change-management/valid
+auditmodel lint-privacy  examples/profiles/deployment-and-change-management/valid
+auditmodel check-profile examples/profiles/deployment-and-change-management/valid --profile deployment-and-change-management
+```
+
+A profile that accepted an event the core rejects would break the core invariant. A profile that
+accepted an event carrying a pipeline credential would be worse than no profile.
+
+## Valid fixtures
+
+| File                           | Event                             | Demonstrates                                                               |
+| ------------------------------ | --------------------------------- | -------------------------------------------------------------------------- |
+| `release-create.json`          | `deployment.release.create`       | A release candidate prepared automatically; nothing is running yet         |
+| `release-approve.json`         | `deployment.release.approve`      | An approval decision, recorded on the event that is the decision           |
+| `deploy-automated.json`        | `deployment.release.deploy`       | Fully automated delivery with no human approval, and no rule demanding one |
+| `deploy-approved.json`         | `deployment.release.deploy`       | A gated production deployment, where `approvalRequired` is `true`          |
+| `deploy-failed.json`           | `deployment.release.deploy`       | A failure that left the target untouched                                   |
+| `deploy-partial.json`          | `deployment.release.deploy`       | `outcome: partial` — part of the fleet moved, so two versions are serving  |
+| `release-cancel.json`          | `deployment.release.cancel`       | A rollout stopped in flight, authorized and justified                      |
+| `rollback-emergency.json`      | `deployment.release.rollback`     | An emergency rollback executed while its approval was still `pending`      |
+| `infrastructure-apply.json`    | `deployment.infrastructure.apply` | Automation as `actor` and the change's author as `subject`                 |
+| `configuration-update.json`    | `configuration.setting.update`    | An approved configuration change with sanitized before and after values    |
+| `secret-rotate-emergency.json` | `configuration.secret.rotate`     | A rotation that records the changed field name and never the secret        |
+| `change-request-approve.json`  | `change.request.approve`          | The change record whose identifier ties the whole sequence together        |
+
+Two of these produce a `DEPLOY-CORE-003` **warning** for a missing `/metadata/deployment/pipelineId`:
+`configuration-update.json`, a change made by an administrator from a console, and
+`change-request-approve.json`, an approval recorded in a change management system. Neither came from
+a pipeline, so neither has a pipeline identifier. That is exactly why the field is recommended rather
+than required, and a warning never fails conformance.
+
+`deploy-automated.json` also shows why the target environment is recorded separately from the core
+`application.environment`: the delivery platform runs in `production` and deploys into `staging` on
+the same event.
+
+## Invalid fixtures
+
+Each removes exactly one profile-required value from a valid fixture, so it fails for one documented
+reason. A test asserts both the rule and the pointer, and that **exactly one** error is produced.
+
+| File                                              | Derived from                   | Violates               | At                                      |
+| ------------------------------------------------- | ------------------------------ | ---------------------- | --------------------------------------- |
+| `deploy-missing-deployment-id.json`               | `deploy-automated.json`        | `DEPLOY-CORE-001`      | `/metadata/deployment/id`               |
+| `deploy-missing-environment.json`                 | `deploy-automated.json`        | `DEPLOY-CORE-001`      | `/metadata/deployment/environment`      |
+| `deploy-missing-approval-required.json`           | `deploy-automated.json`        | `DEPLOY-CORE-002`      | `/metadata/deployment/approvalRequired` |
+| `deploy-missing-version.json`                     | `deploy-automated.json`        | `DEPLOY-RELEASE-001`   | `/metadata/deployment/version`          |
+| `deploy-missing-previous-version.json`            | `deploy-automated.json`        | `DEPLOY-RELEASE-002`   | `/metadata/deployment/previousVersion`  |
+| `cancel-missing-authorization.json`               | `release-cancel.json`          | `DEPLOY-REVERT-001`    | `/authorization`                        |
+| `cancel-missing-reason.json`                      | `release-cancel.json`          | `DEPLOY-REVERT-001`    | `/reason`                               |
+| `configuration-update-missing-authorization.json` | `configuration-update.json`    | `DEPLOY-CONFIG-001`    | `/authorization`                        |
+| `secret-rotate-missing-changed-fields.json`       | `secret-rotate-emergency.json` | `DEPLOY-CONFIG-001`    | `/change/changedFields`                 |
+| `secret-rotate-missing-reason.json`               | `secret-rotate-emergency.json` | `DEPLOY-EMERGENCY-001` | `/reason`                               |
+| `change-request-approve-missing-approval.json`    | `change-request-approve.json`  | `DEPLOY-APPROVAL-001`  | `/approval/status`                      |
+| `deploy-approved-missing-approval.json`           | `deploy-approved.json`         | `DEPLOY-APPROVAL-002`  | `/approval/status`                      |
+| `deploy-failed-missing-resulting-state.json`      | `deploy-failed.json`           | `DEPLOY-FAILURE-001`   | `/metadata/deployment/resultingState`   |
+| `deploy-partial-missing-resulting-state.json`     | `deploy-partial.json`          | `DEPLOY-FAILURE-002`   | `/metadata/deployment/resultingState`   |
+
+Every enforceable rule in the profile has at least one negative fixture here.
+`DEPLOY-CORE-003` and `DEPLOY-AUTOMATION-001` have none, because a warning cannot fail conformance
+and a fixture that failed nothing would prove nothing.
+
+The `cancel-*` fixtures start from `release-cancel.json` rather than from `rollback-emergency.json`
+even though both are governed by `DEPLOY-REVERT-001`. Removing `/reason` from the emergency rollback
+would break two rules at once — `DEPLOY-REVERT-001` and `DEPLOY-EMERGENCY-001` — and a negative
+fixture that fails for two reasons cannot show which rule it is testing.
+
+## Not-applicable fixtures
+
+| File                    | Event                         | Why it is out of scope                                   |
+| ----------------------- | ----------------------------- | -------------------------------------------------------- |
+| `pipeline-poll.json`    | `deployment.pipeline.poll`    | A runner asking whether there is work; nothing changed   |
+| `build-log-append.json` | `deployment.build.log-append` | Build output; a build produces an artifact, not a change |
+| `secret-access.json`    | `configuration.secret.access` | A workload reading the credential it starts with         |
+
+`check-profile` reports each as not applicable with exit code 3. That is not conformance — it says
+the profile had nothing to say about the event.
+
+They exist to hold the exclusions in place. If a future edit widened a selector to a bare
+`deployment.` or `configuration.secret.` prefix, these fixtures would start being checked instead of
+skipped and the test would fail. That is the point: such an edit would silently impose a change
+identifier, a target environment and an approval-policy flag on every poll, every build log line and
+every process start in a deployment.
+
+## Vendor neutrality
+
+No fixture names a real product, company, cloud, pipeline tool, orchestrator, version control system,
+jurisdiction or regulation. Environments, version strings, pipeline identifiers, policy names and
+change record identifiers are illustrative strings, not any organization's scheme. The profile
+requires none of them to take a particular form, and `production` appears only as an example value.
+
+## Privacy
+
+No fixture contains a credential, token, key, connection string, endpoint, commit hash, email address
+or personal name. The secret rotation records `change.changedFields: ["secret"]` and nothing else
+about the secret, which is the disclosure the profile asks for and the whole of it.

package/examples/profiles/deployment-and-change-management/invalid/cancel-missing-authorization.json

@@ -0,0 +1,59 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2c40-1007-7a3b-8c4d-5e6f70819207",
+  "time": "2026-03-16T11:12:48.550Z",
+  "event": {
+    "name": "deployment.release.cancel",
+    "category": "deployment",
+    "type": "execute",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "Rollout halted by the on-call engineer before the remaining instances were replaced."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-8814",
+    "roles": ["on-call-engineer"]
+  },
+  "resource": {
+    "type": "deployment",
+    "id": "deployment-2026-0316-6",
+    "name": "checkout-service-release",
+    "parentId": "cluster-staging-1"
+  },
+  "relatedResources": [{ "type": "service", "id": "service-checkout" }],
+  "application": {
+    "name": "delivery-platform",
+    "environment": "production",
+    "version": "4.2.0",
+    "component": "release-controller"
+  },
+  "approval": {
+    "status": "not-required"
+  },
+  "request": {
+    "requestId": "request-4d8e05",
+    "correlationId": "deployment-2026-0316-6"
+  },
+  "change": {
+    "type": "none",
+    "ticketId": "change-2026-0316-6",
+    "deploymentId": "deployment-2026-0316-6"
+  },
+  "reason": {
+    "code": "error-rate-regression",
+    "text": "Checkout error rate rose on the updated instances during the canary window."
+  },
+  "controlCategories": ["change-management"],
+  "tags": ["staging"],
+  "metadata": {
+    "deployment": {
+      "id": "deployment-2026-0316-6",
+      "environment": "staging",
+      "version": "9.1.2",
+      "approvalRequired": false,
+      "pipelineId": "pipeline-checkout-delivery",
+      "resultingState": "partially-applied"
+    }
+  }
+}

package/examples/profiles/deployment-and-change-management/invalid/cancel-missing-reason.json

@@ -0,0 +1,61 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2c40-1007-7a3b-8c4d-5e6f70819207",
+  "time": "2026-03-16T11:12:48.550Z",
+  "event": {
+    "name": "deployment.release.cancel",
+    "category": "deployment",
+    "type": "execute",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "Rollout halted by the on-call engineer before the remaining instances were replaced."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-8814",
+    "roles": ["on-call-engineer"]
+  },
+  "resource": {
+    "type": "deployment",
+    "id": "deployment-2026-0316-6",
+    "name": "checkout-service-release",
+    "parentId": "cluster-staging-1"
+  },
+  "relatedResources": [{ "type": "service", "id": "service-checkout" }],
+  "application": {
+    "name": "delivery-platform",
+    "environment": "production",
+    "version": "4.2.0",
+    "component": "release-controller"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "rollout-control",
+    "policyVersion": "3"
+  },
+  "approval": {
+    "status": "not-required"
+  },
+  "request": {
+    "requestId": "request-4d8e05",
+    "correlationId": "deployment-2026-0316-6"
+  },
+  "change": {
+    "type": "none",
+    "ticketId": "change-2026-0316-6",
+    "deploymentId": "deployment-2026-0316-6"
+  },
+  "controlCategories": ["change-management"],
+  "tags": ["staging"],
+  "metadata": {
+    "deployment": {
+      "id": "deployment-2026-0316-6",
+      "environment": "staging",
+      "version": "9.1.2",
+      "approvalRequired": false,
+      "pipelineId": "pipeline-checkout-delivery",
+      "resultingState": "partially-applied"
+    }
+  }
+}

package/examples/profiles/deployment-and-change-management/invalid/change-request-approve-missing-approval.json

@@ -0,0 +1,57 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2c40-100c-7a3b-8c4d-5e6f7081920c",
+  "time": "2026-03-17T09:44:51.492Z",
+  "event": {
+    "name": "change.request.approve",
+    "category": "workflow",
+    "type": "approve",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "Change request approved for the production authentication configuration."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-7702",
+    "roles": ["security-officer"]
+  },
+  "resource": {
+    "type": "change-request",
+    "id": "change-2026-0317-4",
+    "name": "session-lifetime-reduction"
+  },
+  "relatedResources": [{ "type": "configuration", "id": "configuration-authentication-session" }],
+  "application": {
+    "name": "change-management-service",
+    "environment": "production",
+    "version": "6.4.2"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "change-approval",
+    "policyVersion": "11"
+  },
+  "request": {
+    "requestId": "request-31fa8c",
+    "correlationId": "change-2026-0317-4"
+  },
+  "change": {
+    "type": "none",
+    "ticketId": "change-2026-0317-4"
+  },
+  "reason": {
+    "code": "security-hardening",
+    "text": "Approved on the strength of the security review finding.",
+    "reference": "change-2026-0317-4"
+  },
+  "controlCategories": ["change-approval"],
+  "tags": ["production"],
+  "metadata": {
+    "deployment": {
+      "id": "change-2026-0317-4",
+      "environment": "production",
+      "approvalRequired": true,
+      "riskLevel": "high"
+    }
+  }
+}

package/examples/profiles/deployment-and-change-management/invalid/configuration-update-missing-authorization.json

@@ -0,0 +1,81 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2c40-100a-7a3b-8c4d-5e6f7081920a",
+  "time": "2026-03-17T09:52:03.884Z",
+  "event": {
+    "name": "configuration.setting.update",
+    "category": "configuration",
+    "type": "update",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Session lifetime reduced on the production authentication configuration."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-0091",
+    "roles": ["platform-administrator"]
+  },
+  "resource": {
+    "type": "configuration",
+    "id": "configuration-authentication-session",
+    "name": "authentication-session-policy",
+    "parentId": "cluster-production-1",
+    "classification": "restricted"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "version": "9.0.3",
+    "instance": "instance-7c1a"
+  },
+  "authentication": {
+    "method": "mfa",
+    "mfa": true,
+    "assuranceLevel": "high"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-standard-change",
+    "requestId": "approval-request-6120",
+    "requiredApprovals": 2,
+    "receivedApprovals": 2,
+    "approvers": [
+      { "type": "user", "id": "user-1180", "roles": ["change-manager"] },
+      { "type": "user", "id": "user-7702", "roles": ["security-officer"] }
+    ],
+    "approvedAt": "2026-03-17T09:44:51Z"
+  },
+  "request": {
+    "requestId": "request-cc10ab",
+    "correlationId": "change-2026-0317-4",
+    "method": "PATCH",
+    "route": "/clusters/{clusterId}/configurations/{configurationId}"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["sessionLifetimeMinutes", "requireReauthenticationForPrivilegedActions"],
+    "before": {
+      "sessionLifetimeMinutes": 720,
+      "requireReauthenticationForPrivilegedActions": false
+    },
+    "after": {
+      "sessionLifetimeMinutes": 60,
+      "requireReauthenticationForPrivilegedActions": true
+    },
+    "ticketId": "change-2026-0317-4"
+  },
+  "reason": {
+    "code": "security-hardening",
+    "text": "Session lifetime reduced following a security review finding.",
+    "reference": "change-2026-0317-4"
+  },
+  "controlCategories": ["configuration-integrity", "change-approval"],
+  "tags": ["production"],
+  "metadata": {
+    "deployment": {
+      "id": "change-2026-0317-4",
+      "environment": "production",
+      "approvalRequired": true
+    }
+  }
+}