@openauditmodel/cli 0.4.0 → 0.4.2

package/examples/profiles/identity-and-access-management/valid/permission-revoke.json

@@ -0,0 +1,77 @@
+{
+  "specVersion": "0.1",
+  "id": "018f4a05-1111-7222-8333-000000000005",
+  "time": "2026-06-01T11:00:00.000Z",
+  "event": {
+    "name": "identity.permission.revoke",
+    "category": "identity",
+    "type": "revoke",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "Direct export permission withdrawn after an access review."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-4821",
+    "roles": ["identity-administrator"]
+  },
+  "application": {
+    "name": "identity-service",
+    "environment": "production",
+    "version": "3.4.1"
+  },
+  "resource": {
+    "type": "user",
+    "id": "user-5120",
+    "tenantId": "tenant-42"
+  },
+  "relatedResources": [
+    {
+      "type": "permission",
+      "id": "permission-report-export"
+    }
+  ],
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "identity-permission-change",
+    "policyVersion": "7"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-access-change",
+    "requestId": "approval-request-5512",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1,
+    "approvers": [
+      {
+        "type": "user",
+        "id": "user-2210",
+        "roles": ["access-approver"]
+      }
+    ],
+    "approvedAt": "2026-06-01T09:59:47Z"
+  },
+  "reason": {
+    "code": "access-review",
+    "text": "Permission no longer required by the reviewed role definition.",
+    "reference": "access-review-2026-q2"
+  },
+  "request": {
+    "requestId": "request-a5",
+    "correlationId": "correlation-a5",
+    "traceId": "4bf92f3577b34da6a3ce929d0e0e4736",
+    "spanId": "00f067aa0ba902b7",
+    "protocol": "https",
+    "method": "POST",
+    "route": "/identity/{principalId}/access"
+  },
+  "controlCategories": ["privileged-access", "separation-of-duties"],
+  "metadata": {
+    "permission": {
+      "id": "permission-report-export",
+      "scope": "tenant",
+      "privileged": false
+    }
+  }
+}

package/examples/profiles/identity-and-access-management/valid/role-assign-privileged.json

@@ -0,0 +1,87 @@
+{
+  "specVersion": "0.1",
+  "id": "018f4a04-1111-7222-8333-000000000004",
+  "time": "2026-06-01T10:00:00.000Z",
+  "event": {
+    "name": "identity.role.assign",
+    "category": "identity",
+    "type": "update",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Time-bound platform administrator role assigned for a change window."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-4821",
+    "roles": ["identity-administrator"]
+  },
+  "application": {
+    "name": "identity-service",
+    "environment": "production",
+    "version": "3.4.1"
+  },
+  "resource": {
+    "type": "user",
+    "id": "admin-0091",
+    "tenantId": "tenant-42"
+  },
+  "relatedResources": [
+    {
+      "type": "role",
+      "id": "role-platform-administrator",
+      "name": "platform-administrator"
+    }
+  ],
+  "authentication": {
+    "method": "oidc",
+    "provider": "corporate-idp",
+    "mfa": true,
+    "assuranceLevel": "high",
+    "authenticatedAt": "2026-06-01T09:58:02Z"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "just-in-time-privileged-access",
+    "policyVersion": "7"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-access-change",
+    "requestId": "approval-request-5512",
+    "requiredApprovals": 2,
+    "receivedApprovals": 2,
+    "approvers": [
+      {
+        "type": "user",
+        "id": "user-2210",
+        "roles": ["access-approver"]
+      }
+    ],
+    "approvedAt": "2026-06-01T09:59:47Z"
+  },
+  "reason": {
+    "code": "scheduled-maintenance",
+    "text": "Approved change window for the authentication configuration update.",
+    "reference": "change-10241"
+  },
+  "request": {
+    "requestId": "request-a4",
+    "correlationId": "correlation-a4",
+    "traceId": "4bf92f3577b34da6a3ce929d0e0e4736",
+    "spanId": "00f067aa0ba902b7",
+    "protocol": "https",
+    "method": "POST",
+    "route": "/identity/{principalId}/access"
+  },
+  "controlCategories": ["privileged-access", "change-approval", "separation-of-duties"],
+  "metadata": {
+    "role": {
+      "id": "role-platform-administrator",
+      "privileged": true,
+      "scope": "tenant"
+    },
+    "effectiveFrom": "2026-06-01T10:00:00Z",
+    "expiresAt": "2026-06-01T12:00:00Z"
+  }
+}

package/examples/profiles/identity-and-access-management/valid/role-assign-standard.json

@@ -0,0 +1,80 @@
+{
+  "specVersion": "0.1",
+  "id": "018f4a03-1111-7222-8333-000000000003",
+  "time": "2026-06-01T09:00:00.000Z",
+  "event": {
+    "name": "identity.role.assign",
+    "category": "identity",
+    "type": "update",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "Support role assigned for the duty rotation."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-4821",
+    "roles": ["identity-administrator"]
+  },
+  "application": {
+    "name": "identity-service",
+    "environment": "production",
+    "version": "3.4.1"
+  },
+  "resource": {
+    "type": "user",
+    "id": "user-7391",
+    "tenantId": "tenant-42"
+  },
+  "relatedResources": [
+    {
+      "type": "role",
+      "id": "role-support-agent",
+      "name": "support-agent"
+    }
+  ],
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "identity-role-assignment",
+    "policyVersion": "7"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-access-change",
+    "requestId": "approval-request-5512",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1,
+    "approvers": [
+      {
+        "type": "user",
+        "id": "user-2210",
+        "roles": ["access-approver"]
+      }
+    ],
+    "approvedAt": "2026-06-01T09:59:47Z"
+  },
+  "reason": {
+    "code": "access-request",
+    "text": "Approved access request for the support duty rotation.",
+    "reference": "access-request-8841"
+  },
+  "request": {
+    "requestId": "request-a3",
+    "correlationId": "correlation-a3",
+    "traceId": "4bf92f3577b34da6a3ce929d0e0e4736",
+    "spanId": "00f067aa0ba902b7",
+    "protocol": "https",
+    "method": "POST",
+    "route": "/identity/{principalId}/access"
+  },
+  "controlCategories": ["privileged-access", "change-approval"],
+  "metadata": {
+    "role": {
+      "id": "role-support-agent",
+      "privileged": false,
+      "scope": "tenant"
+    },
+    "effectiveFrom": "2026-06-02T00:00:00Z",
+    "expiresAt": "2026-09-02T00:00:00Z"
+  }
+}

package/examples/profiles/identity-and-access-management/valid/service-account-create.json

@@ -0,0 +1,55 @@
+{
+  "specVersion": "0.1",
+  "id": "018f4a06-1111-7222-8333-000000000006",
+  "time": "2026-06-01T12:00:00.000Z",
+  "event": {
+    "name": "identity.service-account.create",
+    "category": "identity",
+    "type": "create",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Service account created for the reporting export worker."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-4821",
+    "roles": ["identity-administrator"]
+  },
+  "application": {
+    "name": "identity-service",
+    "environment": "production",
+    "version": "3.4.1"
+  },
+  "resource": {
+    "type": "service-account",
+    "id": "service-account-reporting-worker"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "identity-service-account-lifecycle",
+    "policyVersion": "7"
+  },
+  "reason": {
+    "code": "platform-change",
+    "text": "Scheduled export worker requires its own workload identity.",
+    "reference": "change-10118"
+  },
+  "request": {
+    "requestId": "request-a6",
+    "correlationId": "correlation-a6",
+    "traceId": "4bf92f3577b34da6a3ce929d0e0e4736",
+    "spanId": "00f067aa0ba902b7",
+    "protocol": "https",
+    "method": "POST",
+    "route": "/identity/{principalId}/access"
+  },
+  "controlCategories": ["privileged-access"],
+  "metadata": {
+    "serviceAccount": {
+      "purpose": "Generates scheduled customer activity exports.",
+      "ownerId": "user-1180",
+      "expiresAt": "2027-06-01T00:00:00Z"
+    }
+  }
+}

package/examples/profiles/identity-and-access-management/valid/user-create.json

@@ -0,0 +1,55 @@
+{
+  "specVersion": "0.1",
+  "id": "018f4a01-1111-7222-8333-000000000001",
+  "time": "2026-06-01T08:00:00.000Z",
+  "event": {
+    "name": "identity.user.create",
+    "category": "identity",
+    "type": "create",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "Account created for a new joiner."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-4821",
+    "roles": ["identity-administrator"]
+  },
+  "application": {
+    "name": "identity-service",
+    "environment": "production",
+    "version": "3.4.1"
+  },
+  "resource": {
+    "type": "user",
+    "id": "user-9001",
+    "tenantId": "tenant-42"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "identity-user-lifecycle",
+    "policyVersion": "7"
+  },
+  "reason": {
+    "code": "onboarding",
+    "text": "Scheduled onboarding for a confirmed start date.",
+    "reference": "onboarding-7741"
+  },
+  "request": {
+    "requestId": "request-a1",
+    "correlationId": "correlation-a1",
+    "traceId": "4bf92f3577b34da6a3ce929d0e0e4736",
+    "spanId": "00f067aa0ba902b7",
+    "protocol": "https",
+    "method": "POST",
+    "route": "/identity/{principalId}/access"
+  },
+  "controlCategories": ["privileged-access"],
+  "metadata": {
+    "user": {
+      "type": "employee",
+      "departmentId": "department-support"
+    }
+  }
+}

package/examples/profiles/identity-and-access-management/valid/user-disable.json

@@ -0,0 +1,79 @@
+{
+  "specVersion": "0.1",
+  "id": "018f4a02-1111-7222-8333-000000000002",
+  "time": "2026-06-01T08:15:00.000Z",
+  "event": {
+    "name": "identity.user.disable",
+    "category": "identity",
+    "type": "update",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Account disabled on the last working day."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-4821",
+    "roles": ["identity-administrator"]
+  },
+  "application": {
+    "name": "identity-service",
+    "environment": "production",
+    "version": "3.4.1"
+  },
+  "resource": {
+    "type": "user",
+    "id": "user-7391",
+    "tenantId": "tenant-42"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "identity-user-lifecycle",
+    "policyVersion": "7"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-access-change",
+    "requestId": "approval-request-5512",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1,
+    "approvers": [
+      {
+        "type": "user",
+        "id": "user-2210",
+        "roles": ["access-approver"]
+      }
+    ],
+    "approvedAt": "2026-06-01T09:59:47Z"
+  },
+  "reason": {
+    "code": "offboarding",
+    "text": "Employment ended and access was withdrawn on the agreed date.",
+    "reference": "offboarding-3312"
+  },
+  "request": {
+    "requestId": "request-a2",
+    "correlationId": "correlation-a2",
+    "traceId": "4bf92f3577b34da6a3ce929d0e0e4736",
+    "spanId": "00f067aa0ba902b7",
+    "protocol": "https",
+    "method": "POST",
+    "route": "/identity/{principalId}/access"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["status"],
+    "before": {
+      "status": "active"
+    },
+    "after": {
+      "status": "disabled"
+    }
+  },
+  "controlCategories": ["privileged-access"],
+  "metadata": {
+    "user": {
+      "type": "employee"
+    }
+  }
+}

package/examples/profiles/incident-management/README.md

@@ -0,0 +1,125 @@
+# Incident management profile fixtures
+
+**Status: Informative.** These fixtures illustrate and regression-test the
+[incident-management profile](../../../profiles/incident-management/). The rules themselves are in
+[profile.json](../../../profiles/incident-management/profile.json).
+
+```bash
+auditmodel check-profile examples/profiles/incident-management/valid --profile incident-management
+```
+
+Every fixture here — valid, invalid and not-applicable alike — is a **core-conforming** event. The
+ones under `invalid/` fail the profile, not the core schema. That separation is the point: a profile
+adds requirements to events the core already accepts.
+
+Read in order, the valid fixtures tell one story: a checkout latency incident raised from a
+monitoring signal, escalated to major, reassigned, resolved with a workaround, analysed, remediated,
+closed under approval, and then reopened when the problem came back. They share one
+`request.correlationId`, which is what makes them assemble into that story rather than sit as thirteen
+unrelated records.
+
+## The guarantee these fixtures carry
+
+Each file under `valid/` must satisfy all three commands, and a test enforces it:
+
+```bash
+auditmodel validate      examples/profiles/incident-management/valid
+auditmodel lint-privacy  examples/profiles/incident-management/valid
+auditmodel check-profile examples/profiles/incident-management/valid --profile incident-management
+```
+
+A profile that accepted an event the core rejects would break the core invariant. A profile that
+accepted an event carrying a credential would be worse than no profile. The fixtures under
+`invalid/` and `not-applicable/` are held to the same core and privacy standards; only the profile
+result differs.
+
+## Valid fixtures
+
+| File                            | Event                        | Demonstrates                                                              |
+| ------------------------------- | ---------------------------- | ------------------------------------------------------------------------- |
+| `case-create.json`              | `incident.case.create`       | Raising a case with priority, impact, urgency and a detection time        |
+| `priority-change.json`          | `incident.priority.change`   | Reprioritisation recorded as a transition with a justification            |
+| `assignment-change.json`        | `incident.assignment.change` | The newly accountable principal named in `subject`, not `actor`           |
+| `major-declare.json`            | `incident.major.declare`     | Escalation to major: transition, justification and the priority in force  |
+| `case-resolve.json`             | `incident.case.resolve`      | A workaround, distinguished from a permanent fix by `resolutionType`      |
+| `case-close.json`               | `incident.case.close`        | Closure the producer declared as needing approval, with the decision      |
+| `case-reopen.json`              | `incident.case.reopen`       | A reopen as a new transition, on the original correlation identifier      |
+| `problem-case-close.json`       | `problem.case.close`         | A closure declared as **not** needing approval, so the condition is quiet |
+| `rca-create.json`               | `incident.rca.create`        | An analysis naming its method and referencing the document                |
+| `rca-approve.json`              | `incident.rca.approve`       | An event that is itself an approval, recording the decision               |
+| `corrective-action-open.json`   | `corrective-action.open`     | Remediation opened against a named owner                                  |
+| `corrective-action-verify.json` | `corrective-action.verify`   | Verification recording **how** the fix was demonstrated                   |
+| `sla-breach.json`               | `incident.sla.breach`        | A system observation, with no `/authorization` demanded of it             |
+
+All thirteen conform with **no warnings**: every recommendation the profile makes is also satisfied.
+That is a property of this fixture set, not a requirement — a warning never fails conformance.
+
+Two fixtures are worth reading for what they leave out. `sla-breach.json` carries no
+`/authorization`, because a missed commitment is detected by a monitor rather than decided by a
+person, and `INC-CORE-001` deliberately excludes it. `problem-case-close.json` carries no
+`/approval`, because it records `approvalRequired: false` — the flag is stated rather than omitted,
+so the trail distinguishes "approval was not required" from "nobody said".
+
+## Invalid fixtures
+
+Each removes exactly one profile-required value from a valid fixture, so it fails for one documented
+reason. A test asserts both the rule and the pointer, and that **exactly one** error is produced.
+
+| File                                           | Derived from                    | Violates           | At                                                       |
+| ---------------------------------------------- | ------------------------------- | ------------------ | -------------------------------------------------------- |
+| `case-close-missing-authorization.json`        | `case-close.json`               | `INC-CORE-001`     | `/authorization`                                         |
+| `case-create-missing-status.json`              | `case-create.json`              | `INC-CORE-001`     | `/metadata/incident/status`                              |
+| `assignment-change-missing-change.json`        | `assignment-change.json`        | `INC-STATE-001`    | `/change`                                                |
+| `case-close-missing-reason.json`               | `case-close.json`               | `INC-STATE-002`    | `/reason`                                                |
+| `priority-change-missing-priority.json`        | `priority-change.json`          | `INC-PRIORITY-001` | `/metadata/incident/priority`                            |
+| `assignment-change-missing-assignee.json`      | `assignment-change.json`        | `INC-ASSIGN-001`   | `/subject`                                               |
+| `case-resolve-missing-resolution-type.json`    | `case-resolve.json`             | `INC-RESOLVE-001`  | `/metadata/incident/resolutionType`                      |
+| `case-close-missing-approval.json`             | `case-close.json`               | `INC-CLOSE-001`    | `/approval/status`                                       |
+| `case-reopen-missing-change.json`              | `case-reopen.json`              | `INC-REOPEN-001`   | `/change`                                                |
+| `case-reopen-missing-reason.json`              | `case-reopen.json`              | `INC-REOPEN-001`   | `/reason`                                                |
+| `rca-create-missing-method.json`               | `rca-create.json`               | `INC-RCA-001`      | `/metadata/incident/rca/method`                          |
+| `rca-approve-missing-approval.json`            | `rca-approve.json`              | `INC-RCA-002`      | `/approval/status`                                       |
+| `corrective-action-verify-missing-method.json` | `corrective-action-verify.json` | `INC-CAPA-001`     | `/metadata/incident/correctiveAction/verificationMethod` |
+| `sla-breach-missing-target.json`               | `sla-breach.json`               | `INC-SLA-001`      | `/metadata/incident/sla/target`                          |
+
+There is one invalid fixture for **every requirement of every enforceable rule**, which is why
+`INC-CORE-001` and `INC-REOPEN-001` have two each: each of them requires two different things, and a
+fixture that removed only one of them would leave the other requirement untested. A test derives that
+list from `profile.json` and fails if a requirement is added without a fixture that holds it in place.
+The three advisory rules — `INC-CORE-002`, `INC-CREATE-001` and `INC-EVIDENCE-001` — have no invalid
+fixture by construction: a recommendation produces a warning and can never fail.
+
+`case-close-missing-approval.json` also emits two warnings, for the recommended `/approval/approvers`
+and `/approval/approvedAt` that vanished with the object. Warnings are not errors, and the fixture
+still fails for exactly one reason.
+
+## Not-applicable fixtures
+
+| File                          | Event                    | Why it is out of scope                                                                    |
+| ----------------------------- | ------------------------ | ----------------------------------------------------------------------------------------- |
+| `monitoring-alert-raise.json` | `monitoring.alert.raise` | A threshold alert that cleared itself in 45 seconds and never became a managed case       |
+| `note-create.json`            | `incident.note.create`   | A working note appended to an incident timeline — high volume, not a lifecycle transition |
+| `case-view.json`              | `incident.case.view`     | Reading a closed case in a console; a data-access event, not a change to the case         |
+
+`check-profile` reports each as **not applicable**, with exit code 3. Not applicable is not
+conformance: the tool says the profile is silent about the event, never that the profile is satisfied.
+
+They exist to hold the exclusions in place. If a future edit widened a selector to a bare `incident.`
+or `incident.case.` prefix, these fixtures would start conforming instead of being skipped, and the
+test would fail — which is the point, because that edit would put the profile's heaviest requirements
+on every alert, every note and every record view in a service management system.
+
+`case-view.json` carries `/metadata/incident/status` even though nothing asks it to. That is
+deliberate: an event is out of scope because of its **name**, not because it happens to lack the
+fields the profile would have wanted.
+
+## Vendor neutrality
+
+No fixture names a real product, company, person, jurisdiction or regulation. Priority values,
+resolution types, verification methods, policy names and commitment names are illustrative tokens,
+not any organization's scheme, and the profile closes none of those vocabularies.
+
+Identifiers are opaque and lower-case (`incident-2026-0418`, `user-5140`, `service-checkout`). No
+fixture contains a credential, a token, a personal email address, a real name or free text describing
+an individual — the profile requires no free-text field, and these fixtures are checked by
+`auditmodel lint-privacy` in CI to keep it that way.

package/examples/profiles/incident-management/invalid/assignment-change-missing-assignee.json

@@ -0,0 +1,69 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c1a-0003-7a2b-9c3d-4e5f60718303",
+  "time": "2026-03-14T09:48:19.220Z",
+  "event": {
+    "name": "incident.assignment.change",
+    "category": "workflow",
+    "type": "update",
+    "outcome": "success",
+    "severity": "low",
+    "summary": "Incident reassigned from the service desk to the platform team."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-3301",
+    "roles": ["incident-manager"],
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "incident",
+    "id": "incident-2026-0418",
+    "name": "checkout-latency-degradation",
+    "classification": "internal",
+    "tenantId": "tenant-7"
+  },
+  "relatedResources": [
+    {
+      "type": "service",
+      "id": "service-checkout"
+    }
+  ],
+  "application": {
+    "name": "incident-service",
+    "environment": "production",
+    "version": "5.2.0"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "incident-handling",
+    "permissions": ["incident.assignment.change"]
+  },
+  "request": {
+    "requestId": "request-4493",
+    "correlationId": "correlation-incident-2026-0418"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["assignedTeam", "assignedTo"],
+    "before": {
+      "assignedTeam": "team-service-desk"
+    },
+    "after": {
+      "assignedTeam": "team-platform"
+    },
+    "incidentId": "incident-2026-0418"
+  },
+  "reason": {
+    "code": "specialist-required",
+    "text": "Diagnosis moved to the team that owns the checkout connection pool."
+  },
+  "controlCategories": ["incident-traceability"],
+  "metadata": {
+    "incident": {
+      "status": "in-progress",
+      "priority": "p1",
+      "assignedTeam": "team-platform"
+    }
+  }
+}