@openauditmodel/cli 0.4.1 → 0.4.2

package/examples/profiles/message-broker-management/invalid/queue-purge-missing-destructive-flag.json

@@ -0,0 +1,79 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c40-0034-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-17T12:17:38.640Z",
+  "event": {
+    "name": "broker.queue.purge",
+    "category": "data-infrastructure",
+    "type": "delete",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Dead-letter queue purged after the poison messages were captured as evidence."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-6612",
+    "roles": ["messaging-operator"]
+  },
+  "resource": {
+    "type": "queue",
+    "id": "queue-fulfilment-dead-letter",
+    "name": "fulfilment-dead-letter",
+    "parentId": "vhost-order-processing",
+    "classification": "internal",
+    "ownerId": "team-fulfilment"
+  },
+  "relatedResources": [{ "type": "cluster", "id": "cluster-messaging-production" }],
+  "application": {
+    "name": "broker-control-service",
+    "environment": "production",
+    "version": "3.4.1",
+    "region": "region-1"
+  },
+  "authentication": {
+    "method": "oidc",
+    "provider": "corporate-idp",
+    "mfa": true
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "broker-administration",
+    "permissions": ["queue.purge"]
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-incident-change",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1,
+    "approvedAt": "2026-03-17T12:14:02Z"
+  },
+  "request": {
+    "requestId": "request-6f0b83",
+    "correlationId": "correlation-incident-2026-0431"
+  },
+  "reason": {
+    "code": "incident-recovery",
+    "text": "Queue drained to restore delivery after unprocessable messages blocked consumers.",
+    "reference": "incident-2026-0431"
+  },
+  "evidence": [
+    {
+      "type": "log",
+      "reference": "records/incident-2026-0431/dead-letter-inventory",
+      "contentType": "application/json",
+      "createdAt": "2026-03-17T12:10:44Z"
+    }
+  ],
+  "controlCategories": ["privileged-access", "incident-traceability"],
+  "tags": ["production", "incident-response"],
+  "metadata": {
+    "broker": {
+      "system": "rabbitmq",
+      "clusterId": "cluster-messaging-production",
+      "queue": {
+        "purgedMessageCount": 1842
+      }
+    }
+  }
+}

package/examples/profiles/message-broker-management/invalid/queue-purge-missing-reason.json

@@ -0,0 +1,77 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c40-0035-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-17T12:17:38.640Z",
+  "event": {
+    "name": "broker.queue.purge",
+    "category": "data-infrastructure",
+    "type": "delete",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Dead-letter queue purged after the poison messages were captured as evidence."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-6612",
+    "roles": ["messaging-operator"]
+  },
+  "resource": {
+    "type": "queue",
+    "id": "queue-fulfilment-dead-letter",
+    "name": "fulfilment-dead-letter",
+    "parentId": "vhost-order-processing",
+    "classification": "internal",
+    "ownerId": "team-fulfilment"
+  },
+  "relatedResources": [{ "type": "cluster", "id": "cluster-messaging-production" }],
+  "application": {
+    "name": "broker-control-service",
+    "environment": "production",
+    "version": "3.4.1",
+    "region": "region-1"
+  },
+  "authentication": {
+    "method": "oidc",
+    "provider": "corporate-idp",
+    "mfa": true
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "broker-administration",
+    "permissions": ["queue.purge"]
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-incident-change",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1,
+    "approvedAt": "2026-03-17T12:14:02Z"
+  },
+  "request": {
+    "requestId": "request-6f0b83",
+    "correlationId": "correlation-incident-2026-0431"
+  },
+  "evidence": [
+    {
+      "type": "log",
+      "reference": "records/incident-2026-0431/dead-letter-inventory",
+      "contentType": "application/json",
+      "createdAt": "2026-03-17T12:10:44Z"
+    }
+  ],
+  "controlCategories": ["privileged-access", "incident-traceability"],
+  "tags": ["production", "incident-response"],
+  "metadata": {
+    "broker": {
+      "system": "rabbitmq",
+      "clusterId": "cluster-messaging-production",
+      "operation": {
+        "destructive": true
+      },
+      "queue": {
+        "purgedMessageCount": 1842
+      }
+    }
+  }
+}

package/examples/profiles/message-broker-management/invalid/quota-update-missing-dimension.json

@@ -0,0 +1,72 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c40-0040-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-17T14:21:07.760Z",
+  "event": {
+    "name": "broker.quota.update",
+    "category": "data-infrastructure",
+    "type": "update",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "Producer throughput quota raised for the orders publishing client."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-4188",
+    "roles": ["streaming-administrator"]
+  },
+  "resource": {
+    "type": "quota",
+    "id": "quota-orders-producer",
+    "name": "orders-producer",
+    "parentId": "cluster-streaming-production",
+    "classification": "internal"
+  },
+  "application": {
+    "name": "broker-control-service",
+    "environment": "production",
+    "version": "3.4.1",
+    "region": "region-1"
+  },
+  "authentication": {
+    "method": "oidc",
+    "provider": "corporate-idp",
+    "mfa": true
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "broker-administration",
+    "permissions": ["quota.alter"]
+  },
+  "request": {
+    "requestId": "request-6f0ba2",
+    "correlationId": "correlation-broker-capacity-2288"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["producerByteRate"],
+    "before": { "producerByteRate": 5242880 },
+    "after": { "producerByteRate": 10485760 },
+    "ticketId": "change-8277"
+  },
+  "reason": {
+    "code": "capacity-increase",
+    "text": "Seasonal order volume exceeded the previous publishing ceiling.",
+    "reference": "change-8277"
+  },
+  "controlCategories": ["privileged-access", "availability-control"],
+  "tags": ["production", "control-plane"],
+  "metadata": {
+    "broker": {
+      "system": "kafka",
+      "clusterId": "cluster-streaming-production",
+      "operation": {
+        "destructive": false
+      },
+      "quota": {
+        "appliesTo": "client-orders-publisher"
+      }
+    }
+  }
+}

package/examples/profiles/message-broker-management/invalid/topic-create-missing-authorization.json

@@ -0,0 +1,61 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c40-0031-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-17T08:12:04.220Z",
+  "event": {
+    "name": "broker.topic.create",
+    "category": "data-infrastructure",
+    "type": "create",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "Topic created for settlement events on the production streaming cluster."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-6612",
+    "roles": ["streaming-operator"]
+  },
+  "resource": {
+    "type": "topic",
+    "id": "topic-payments-settlement-completed",
+    "name": "payments-settlement-completed",
+    "parentId": "cluster-streaming-production",
+    "classification": "confidential",
+    "ownerId": "team-payments-platform"
+  },
+  "relatedResources": [{ "type": "cluster", "id": "cluster-streaming-production" }],
+  "application": {
+    "name": "broker-control-service",
+    "environment": "production",
+    "version": "3.4.1",
+    "region": "region-1"
+  },
+  "authentication": {
+    "method": "oidc",
+    "provider": "corporate-idp",
+    "mfa": true
+  },
+  "request": {
+    "requestId": "request-6f0b31",
+    "correlationId": "correlation-broker-change-4471"
+  },
+  "reason": {
+    "code": "platform-onboarding",
+    "text": "New settlement pipeline requires a dedicated topic."
+  },
+  "controlCategories": ["privileged-access", "resource-provisioning"],
+  "tags": ["production", "control-plane"],
+  "metadata": {
+    "broker": {
+      "system": "kafka",
+      "clusterId": "cluster-streaming-production",
+      "operation": {
+        "destructive": false
+      },
+      "topic": {
+        "partitions": 12,
+        "replicationFactor": 3
+      }
+    }
+  }
+}

package/examples/profiles/message-broker-management/invalid/topic-create-missing-classification.json

@@ -0,0 +1,66 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c40-0033-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-17T08:12:04.220Z",
+  "event": {
+    "name": "broker.topic.create",
+    "category": "data-infrastructure",
+    "type": "create",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "Topic created for settlement events on the production streaming cluster."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-6612",
+    "roles": ["streaming-operator"]
+  },
+  "resource": {
+    "type": "topic",
+    "id": "topic-payments-settlement-completed",
+    "name": "payments-settlement-completed",
+    "parentId": "cluster-streaming-production",
+    "ownerId": "team-payments-platform"
+  },
+  "relatedResources": [{ "type": "cluster", "id": "cluster-streaming-production" }],
+  "application": {
+    "name": "broker-control-service",
+    "environment": "production",
+    "version": "3.4.1",
+    "region": "region-1"
+  },
+  "authentication": {
+    "method": "oidc",
+    "provider": "corporate-idp",
+    "mfa": true
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "broker-administration",
+    "permissions": ["topic.create"]
+  },
+  "request": {
+    "requestId": "request-6f0b31",
+    "correlationId": "correlation-broker-change-4471"
+  },
+  "reason": {
+    "code": "platform-onboarding",
+    "text": "New settlement pipeline requires a dedicated topic."
+  },
+  "controlCategories": ["privileged-access", "resource-provisioning"],
+  "tags": ["production", "control-plane"],
+  "metadata": {
+    "broker": {
+      "system": "kafka",
+      "clusterId": "cluster-streaming-production",
+      "operation": {
+        "destructive": false
+      },
+      "topic": {
+        "partitions": 12,
+        "replicationFactor": 3
+      }
+    }
+  }
+}

package/examples/profiles/message-broker-management/invalid/topic-create-missing-cluster.json

@@ -0,0 +1,66 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c40-0032-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-17T08:12:04.220Z",
+  "event": {
+    "name": "broker.topic.create",
+    "category": "data-infrastructure",
+    "type": "create",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "Topic created for settlement events on the production streaming cluster."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-6612",
+    "roles": ["streaming-operator"]
+  },
+  "resource": {
+    "type": "topic",
+    "id": "topic-payments-settlement-completed",
+    "name": "payments-settlement-completed",
+    "parentId": "cluster-streaming-production",
+    "classification": "confidential",
+    "ownerId": "team-payments-platform"
+  },
+  "relatedResources": [{ "type": "cluster", "id": "cluster-streaming-production" }],
+  "application": {
+    "name": "broker-control-service",
+    "environment": "production",
+    "version": "3.4.1",
+    "region": "region-1"
+  },
+  "authentication": {
+    "method": "oidc",
+    "provider": "corporate-idp",
+    "mfa": true
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "broker-administration",
+    "permissions": ["topic.create"]
+  },
+  "request": {
+    "requestId": "request-6f0b31",
+    "correlationId": "correlation-broker-change-4471"
+  },
+  "reason": {
+    "code": "platform-onboarding",
+    "text": "New settlement pipeline requires a dedicated topic."
+  },
+  "controlCategories": ["privileged-access", "resource-provisioning"],
+  "tags": ["production", "control-plane"],
+  "metadata": {
+    "broker": {
+      "system": "kafka",
+      "operation": {
+        "destructive": false
+      },
+      "topic": {
+        "partitions": 12,
+        "replicationFactor": 3
+      }
+    }
+  }
+}

package/examples/profiles/message-broker-management/invalid/topic-delete-denied-missing-error-type.json

@@ -0,0 +1,68 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c40-0037-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-17T11:40:55.090Z",
+  "event": {
+    "name": "broker.topic.delete",
+    "category": "data-infrastructure",
+    "type": "delete",
+    "outcome": "failure",
+    "severity": "high",
+    "summary": "Topic deletion refused by policy on a production cluster.",
+    "error": {
+      "code": "permission-denied",
+      "message": "Deleting a production topic requires the streaming administrator role.",
+      "retryable": false
+    }
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-7731",
+    "roles": ["streaming-operator"]
+  },
+  "resource": {
+    "type": "topic",
+    "id": "topic-payments-settlement-completed",
+    "name": "payments-settlement-completed",
+    "parentId": "cluster-streaming-production",
+    "classification": "confidential",
+    "ownerId": "team-payments-platform"
+  },
+  "application": {
+    "name": "broker-control-service",
+    "environment": "production",
+    "version": "3.4.1",
+    "region": "region-1"
+  },
+  "authentication": {
+    "method": "oidc",
+    "provider": "corporate-idp",
+    "mfa": true
+  },
+  "authorization": {
+    "decision": "deny",
+    "engine": "policy-service",
+    "policy": "broker-administration",
+    "reason": "Actor lacks the required administrative role.",
+    "permissions": ["topic.delete"]
+  },
+  "request": {
+    "requestId": "request-6f0b71",
+    "correlationId": "correlation-broker-change-4491"
+  },
+  "reason": {
+    "code": "cleanup-attempt",
+    "text": "Operator attempted to remove a topic believed to be unused."
+  },
+  "controlCategories": ["privileged-access", "access-denial"],
+  "tags": ["production", "control-plane"],
+  "metadata": {
+    "broker": {
+      "system": "kafka",
+      "clusterId": "cluster-streaming-production",
+      "operation": {
+        "destructive": true
+      }
+    }
+  }
+}

package/examples/profiles/message-broker-management/invalid/topic-delete-missing-approval.json

@@ -0,0 +1,65 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c40-0036-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-17T10:26:12.410Z",
+  "event": {
+    "name": "broker.topic.delete",
+    "category": "data-infrastructure",
+    "type": "delete",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Decommissioned topic deleted after the consuming service was retired."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-4188",
+    "roles": ["streaming-administrator"]
+  },
+  "resource": {
+    "type": "topic",
+    "id": "topic-legacy-invoice-export",
+    "name": "legacy-invoice-export",
+    "parentId": "cluster-streaming-production",
+    "classification": "internal",
+    "ownerId": "team-finance-integration"
+  },
+  "relatedResources": [{ "type": "cluster", "id": "cluster-streaming-production" }],
+  "application": {
+    "name": "broker-control-service",
+    "environment": "production",
+    "version": "3.4.1",
+    "region": "region-1"
+  },
+  "authentication": {
+    "method": "oidc",
+    "provider": "corporate-idp",
+    "mfa": true
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "broker-administration",
+    "permissions": ["topic.delete"]
+  },
+  "request": {
+    "requestId": "request-6f0b58",
+    "correlationId": "correlation-broker-decommission-1180"
+  },
+  "reason": {
+    "code": "service-decommission",
+    "text": "Consuming service retired and the topic drained.",
+    "reference": "change-8244"
+  },
+  "controlCategories": ["privileged-access", "change-approval"],
+  "tags": ["production", "control-plane"],
+  "metadata": {
+    "broker": {
+      "system": "kafka",
+      "clusterId": "cluster-streaming-production",
+      "approvalRequired": true,
+      "operation": {
+        "destructive": true
+      }
+    }
+  }
+}

package/examples/profiles/message-broker-management/not-applicable/consumer-group-rebalance.json

@@ -0,0 +1,40 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c40-0023-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-17T20:03:52.740Z",
+  "event": {
+    "name": "broker.consumer-group.rebalance",
+    "category": "data-infrastructure",
+    "type": "execute",
+    "outcome": "success",
+    "severity": "info",
+    "summary": "Consumer group partitions reassigned after a worker instance restarted."
+  },
+  "actor": {
+    "type": "system",
+    "id": "broker-coordinator"
+  },
+  "resource": {
+    "type": "consumer-group",
+    "id": "consumer-group-payments-settlement",
+    "name": "payments-settlement",
+    "parentId": "cluster-streaming-production",
+    "classification": "internal"
+  },
+  "application": {
+    "name": "streaming-platform",
+    "environment": "production",
+    "version": "3.7.0",
+    "region": "region-1"
+  },
+  "tags": ["production", "data-plane"],
+  "metadata": {
+    "broker": {
+      "system": "kafka",
+      "clusterId": "cluster-streaming-production",
+      "rebalance": {
+        "memberCount": 6
+      }
+    }
+  }
+}

package/examples/profiles/message-broker-management/not-applicable/message-consume.json

@@ -0,0 +1,41 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c40-0022-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-17T20:01:11.480Z",
+  "event": {
+    "name": "broker.message.consume",
+    "category": "data-infrastructure",
+    "type": "read",
+    "outcome": "success",
+    "severity": "info",
+    "summary": "Fulfilment worker consumed an order state transition."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-account-fulfilment-worker"
+  },
+  "resource": {
+    "type": "topic",
+    "id": "topic-orders-events",
+    "name": "orders-events",
+    "parentId": "cluster-streaming-production",
+    "classification": "internal"
+  },
+  "application": {
+    "name": "fulfilment-service",
+    "environment": "production",
+    "version": "4.9.3",
+    "region": "region-1"
+  },
+  "request": {
+    "requestId": "request-7a1c06",
+    "correlationId": "correlation-order-4471"
+  },
+  "tags": ["production", "data-plane"],
+  "metadata": {
+    "broker": {
+      "system": "kafka",
+      "clusterId": "cluster-streaming-production"
+    }
+  }
+}

package/examples/profiles/message-broker-management/not-applicable/message-publish.json

@@ -0,0 +1,41 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c40-0021-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-17T20:01:11.020Z",
+  "event": {
+    "name": "broker.message.publish",
+    "category": "data-infrastructure",
+    "type": "create",
+    "outcome": "success",
+    "severity": "info",
+    "summary": "Order state transition published to the orders topic."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-account-orders-publisher"
+  },
+  "resource": {
+    "type": "topic",
+    "id": "topic-orders-events",
+    "name": "orders-events",
+    "parentId": "cluster-streaming-production",
+    "classification": "internal"
+  },
+  "application": {
+    "name": "orders-service",
+    "environment": "production",
+    "version": "5.2.0",
+    "region": "region-1"
+  },
+  "request": {
+    "requestId": "request-7a1c05",
+    "correlationId": "correlation-order-4471"
+  },
+  "tags": ["production", "data-plane"],
+  "metadata": {
+    "broker": {
+      "system": "kafka",
+      "clusterId": "cluster-streaming-production"
+    }
+  }
+}