@openauditmodel/cli 0.4.0 → 0.4.2

package/examples/profiles/secrets-and-key-management/invalid/policy-update-missing-change.json

@@ -0,0 +1,61 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0208-7a2b-9c3d-4e5f60710208",
+  "time": "2026-05-25T14:07:55.630Z",
+  "event": {
+    "name": "secret.policy.update",
+    "category": "configuration",
+    "type": "update",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "The rotation policy for service credentials was tightened."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-1150",
+    "tenantId": "tenant-4"
+  },
+  "resource": {
+    "type": "policy",
+    "id": "policy-secret-rotation",
+    "name": "service-credential-rotation-policy",
+    "classification": "internal",
+    "ownerId": "team-platform",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "secret-store",
+    "environment": "production",
+    "version": "4.2.0"
+  },
+  "request": {
+    "requestId": "request-c77",
+    "correlationId": "change-9315"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "secret-governance",
+    "policyVersion": "9"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "secret-governance-review",
+    "requestId": "approval-9210",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1,
+    "approvedAt": "2026-05-25T13:50:00Z"
+  },
+  "reason": {
+    "code": "control-strengthening",
+    "text": "Annual review shortened the rotation interval and made export approval mandatory.",
+    "reference": "change-9315"
+  },
+  "controlCategories": ["secret-management", "configuration-integrity", "change-approval"],
+  "metadata": {
+    "secret": {
+      "type": "service-credential",
+      "provider": "software-vault"
+    }
+  }
+}

package/examples/profiles/secrets-and-key-management/invalid/secret-create-missing-authorization.json

@@ -0,0 +1,53 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0201-7a2b-9c3d-4e5f60710201",
+  "time": "2026-05-04T08:12:41.220Z",
+  "event": {
+    "name": "secret.create",
+    "category": "security",
+    "type": "create",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "A database credential was registered in the secret store."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-3180",
+    "tenantId": "tenant-4"
+  },
+  "resource": {
+    "type": "secret",
+    "id": "secret-4120",
+    "name": "orders-database-credential",
+    "classification": "restricted",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "secret-store",
+    "environment": "production",
+    "version": "4.2.0"
+  },
+  "organization": {
+    "tenantId": "tenant-4"
+  },
+  "request": {
+    "requestId": "request-c41",
+    "correlationId": "secret-onboarding-2210"
+  },
+  "reason": {
+    "code": "service-onboarding",
+    "text": "The new order service requires its own database credential.",
+    "reference": "change-7741"
+  },
+  "controlCategories": ["secret-management", "privileged-access"],
+  "metadata": {
+    "secret": {
+      "type": "database-credential",
+      "provider": "software-vault",
+      "expiresAt": "2026-11-04T08:12:41Z",
+      "approvalRequired": false,
+      "emergencyAccess": false
+    }
+  }
+}

package/examples/profiles/secrets-and-key-management/invalid/secret-export-missing-destination.json

@@ -0,0 +1,74 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0206-7a2b-9c3d-4e5f60710206",
+  "time": "2026-05-21T11:05:37.316Z",
+  "event": {
+    "name": "secret.export",
+    "category": "privileged-operation",
+    "type": "export",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Stored credentials were exported to a replacement custody system during a migration."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-1150",
+    "tenantId": "tenant-4"
+  },
+  "resource": {
+    "type": "secret",
+    "id": "secret-collection-88",
+    "name": "payments-service-secrets",
+    "classification": "secret",
+    "ownerId": "team-platform",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "secret-store",
+    "environment": "production",
+    "version": "4.2.0"
+  },
+  "organization": {
+    "tenantId": "tenant-4"
+  },
+  "request": {
+    "requestId": "request-a54",
+    "correlationId": "custody-migration-1180"
+  },
+  "authentication": {
+    "method": "mfa",
+    "provider": "workforce-directory",
+    "mfa": true,
+    "assuranceLevel": "high",
+    "sessionId": "session-4410",
+    "authenticatedAt": "2026-05-21T10:58:00Z"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "secret-export",
+    "policyVersion": "9"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "secret-export-review",
+    "requestId": "approval-8823",
+    "requiredApprovals": 2,
+    "receivedApprovals": 2,
+    "approvedAt": "2026-05-20T16:20:00Z"
+  },
+  "reason": {
+    "code": "platform-migration",
+    "text": "Migration of stored credentials to the replacement custody system.",
+    "reference": "change-9004"
+  },
+  "controlCategories": ["secret-management", "privileged-access", "change-approval"],
+  "metadata": {
+    "secret": {
+      "type": "service-credential",
+      "provider": "software-vault",
+      "approvalRequired": true,
+      "emergencyAccess": false
+    }
+  }
+}

package/examples/profiles/secrets-and-key-management/invalid/secret-reveal-missing-reason.json

@@ -0,0 +1,65 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0204-7a2b-9c3d-4e5f60710204",
+  "time": "2026-05-12T09:42:18.004Z",
+  "event": {
+    "name": "secret.reveal",
+    "category": "privileged-operation",
+    "type": "read",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "An operator viewed a stored credential during an authorized investigation."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-2044",
+    "tenantId": "tenant-4"
+  },
+  "resource": {
+    "type": "secret",
+    "id": "secret-4120",
+    "classification": "restricted",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "secret-store",
+    "environment": "production",
+    "version": "4.2.0"
+  },
+  "request": {
+    "requestId": "request-e17",
+    "correlationId": "incident-3390"
+  },
+  "authentication": {
+    "method": "mfa",
+    "provider": "workforce-directory",
+    "mfa": true,
+    "assuranceLevel": "high",
+    "sessionId": "session-9d21",
+    "authenticatedAt": "2026-05-12T09:41:00Z"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "secret-access",
+    "policyVersion": "9"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "secret-access-review",
+    "requestId": "approval-6612",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1,
+    "approvedAt": "2026-05-12T09:38:00Z"
+  },
+  "controlCategories": ["secret-management", "privileged-access"],
+  "metadata": {
+    "secret": {
+      "type": "database-credential",
+      "provider": "software-vault",
+      "approvalRequired": false,
+      "emergencyAccess": false
+    }
+  }
+}

package/examples/profiles/secrets-and-key-management/invalid/secret-revoke-missing-reason.json

@@ -0,0 +1,52 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0207-7a2b-9c3d-4e5f60710207",
+  "time": "2026-05-22T07:31:09.442Z",
+  "event": {
+    "name": "secret.revoke",
+    "category": "security",
+    "type": "revoke",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "A stored credential was invalidated after suspected exposure."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-2044",
+    "tenantId": "tenant-4"
+  },
+  "resource": {
+    "type": "secret",
+    "id": "secret-4120",
+    "classification": "restricted",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "secret-store",
+    "environment": "production",
+    "version": "4.2.0"
+  },
+  "request": {
+    "requestId": "request-b23",
+    "correlationId": "incident-4102"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "secret-incident-response",
+    "policyVersion": "9"
+  },
+  "approval": {
+    "status": "not-required",
+    "workflowId": "secret-incident-response"
+  },
+  "controlCategories": ["secret-management", "incident-response"],
+  "metadata": {
+    "secret": {
+      "type": "database-credential",
+      "provider": "software-vault",
+      "approvalRequired": false
+    }
+  }
+}

package/examples/profiles/secrets-and-key-management/invalid/secret-rotate-missing-change.json

@@ -0,0 +1,48 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0203-7a2b-9c3d-4e5f60710203",
+  "time": "2026-05-11T02:00:03.507Z",
+  "event": {
+    "name": "secret.rotate",
+    "category": "security",
+    "type": "rotate",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "Scheduled rotation replaced the stored value. The value itself is not recorded."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-rotation-worker"
+  },
+  "resource": {
+    "type": "secret",
+    "id": "secret-4120",
+    "classification": "restricted",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "secret-store",
+    "environment": "production",
+    "version": "4.2.0"
+  },
+  "request": {
+    "requestId": "request-d02",
+    "correlationId": "rotation-run-0511"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "secret-rotation",
+    "policyVersion": "9"
+  },
+  "controlCategories": ["secret-management"],
+  "metadata": {
+    "secret": {
+      "type": "database-credential",
+      "provider": "software-vault",
+      "rotationTrigger": "schedule",
+      "expiresAt": "2026-11-11T02:00:03Z"
+    }
+  }
+}

package/examples/profiles/secrets-and-key-management/invalid/secret-rotate-missing-type.json

@@ -0,0 +1,54 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0202-7a2b-9c3d-4e5f60710202",
+  "time": "2026-05-11T02:00:03.507Z",
+  "event": {
+    "name": "secret.rotate",
+    "category": "security",
+    "type": "rotate",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "Scheduled rotation replaced the stored value. The value itself is not recorded."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-rotation-worker"
+  },
+  "resource": {
+    "type": "secret",
+    "id": "secret-4120",
+    "classification": "restricted",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "secret-store",
+    "environment": "production",
+    "version": "4.2.0"
+  },
+  "request": {
+    "requestId": "request-d02",
+    "correlationId": "rotation-run-0511"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "secret-rotation",
+    "policyVersion": "9"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["secret", "version", "rotatedAt"],
+    "before": { "version": "7" },
+    "after": { "version": "8" },
+    "ticketId": "change-8120"
+  },
+  "controlCategories": ["secret-management"],
+  "metadata": {
+    "secret": {
+      "provider": "software-vault",
+      "rotationTrigger": "schedule",
+      "expiresAt": "2026-11-11T02:00:03Z"
+    }
+  }
+}

package/examples/profiles/secrets-and-key-management/not-applicable/key-decrypt.json

@@ -0,0 +1,27 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0103-7a2b-9c3d-4e5f60710103",
+  "time": "2026-05-11T02:34:19.004Z",
+  "event": {
+    "name": "key.decrypt",
+    "category": "data-access",
+    "type": "execute",
+    "outcome": "success",
+    "severity": "debug",
+    "summary": "A workload decrypted a stored record using a key it is permitted to use."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-archive-reader"
+  },
+  "resource": {
+    "type": "key",
+    "id": "key-1907",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "key-custody-service",
+    "environment": "production",
+    "version": "6.0.1"
+  }
+}

package/examples/profiles/secrets-and-key-management/not-applicable/secret-cache-refresh.json

@@ -0,0 +1,27 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0102-7a2b-9c3d-4e5f60710102",
+  "time": "2026-05-11T02:34:18.912Z",
+  "event": {
+    "name": "secret.cache-refresh",
+    "category": "data-access",
+    "type": "read",
+    "outcome": "success",
+    "severity": "debug",
+    "summary": "A workload refreshed its cached copy of a credential on the usual interval."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-orders-api"
+  },
+  "resource": {
+    "type": "secret",
+    "id": "secret-4120",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "secret-store",
+    "environment": "production",
+    "version": "4.2.0"
+  }
+}

package/examples/profiles/secrets-and-key-management/not-applicable/secret-retrieve.json

@@ -0,0 +1,27 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0101-7a2b-9c3d-4e5f60710101",
+  "time": "2026-05-11T02:04:18.660Z",
+  "event": {
+    "name": "secret.retrieve",
+    "category": "data-access",
+    "type": "read",
+    "outcome": "success",
+    "severity": "info",
+    "summary": "A workload read its own credential from the secret store at start-up."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-orders-api"
+  },
+  "resource": {
+    "type": "secret",
+    "id": "secret-4120",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "secret-store",
+    "environment": "production",
+    "version": "4.2.0"
+  }
+}

package/examples/profiles/secrets-and-key-management/valid/certificate-issue.json

@@ -0,0 +1,55 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0012-7a2b-9c3d-4e5f60710012",
+  "time": "2026-05-20T06:44:02.365Z",
+  "event": {
+    "name": "certificate.issue",
+    "category": "security",
+    "type": "create",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "A service certificate was issued by the internal certificate authority."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-certificate-manager"
+  },
+  "resource": {
+    "type": "certificate",
+    "id": "certificate-7715",
+    "name": "checkout-service",
+    "classification": "internal",
+    "ownerId": "team-checkout",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "certificate-authority",
+    "environment": "production",
+    "version": "2.8.4"
+  },
+  "request": {
+    "requestId": "request-b40",
+    "correlationId": "certificate-issue-6620"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "certificate-issuance",
+    "policyVersion": "3"
+  },
+  "reason": {
+    "code": "service-onboarding",
+    "text": "The checkout service was enrolled for mutual authentication.",
+    "reference": "change-9905"
+  },
+  "controlCategories": ["key-management"],
+  "metadata": {
+    "secret": {
+      "type": "certificate",
+      "provider": "internal-certificate-authority",
+      "algorithm": "rsa-4096",
+      "expiresAt": "2027-05-20T06:44:02Z",
+      "approvalRequired": false
+    }
+  }
+}

package/examples/profiles/secrets-and-key-management/valid/key-destroy.json

@@ -0,0 +1,64 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0010-7a2b-9c3d-4e5f60710010",
+  "time": "2026-06-02T09:00:44.918Z",
+  "event": {
+    "name": "key.destroy",
+    "category": "security",
+    "type": "delete",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "A retired encryption key was destroyed after its data had been re-encrypted."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-6033",
+    "tenantId": "tenant-4"
+  },
+  "resource": {
+    "type": "key",
+    "id": "key-1907",
+    "name": "customer-archive-encryption",
+    "classification": "secret",
+    "ownerId": "team-data-platform",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "key-custody-service",
+    "environment": "production",
+    "version": "6.0.1"
+  },
+  "request": {
+    "requestId": "request-f31",
+    "correlationId": "key-decommission-5580"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "key-custody",
+    "policyVersion": "4"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "key-destruction-review",
+    "requestId": "approval-9001",
+    "requiredApprovals": 2,
+    "receivedApprovals": 2,
+    "approvedAt": "2026-06-01T12:00:00Z"
+  },
+  "reason": {
+    "code": "decommissioning",
+    "text": "Every record protected by this key was re-encrypted under its successor and verified.",
+    "reference": "change-9780"
+  },
+  "controlCategories": ["key-management", "change-approval"],
+  "metadata": {
+    "secret": {
+      "type": "encryption-key",
+      "provider": "managed-key-service",
+      "algorithm": "aes-256-gcm",
+      "approvalRequired": true,
+      "emergencyAccess": false
+    }
+  }
+}