@openauditmodel/cli 0.4.1 → 0.4.2

package/examples/profiles/message-broker-management/valid/topic-delete-denied.json

@@ -0,0 +1,69 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c40-0004-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-17T11:40:55.090Z",
+  "event": {
+    "name": "broker.topic.delete",
+    "category": "data-infrastructure",
+    "type": "delete",
+    "outcome": "failure",
+    "severity": "high",
+    "summary": "Topic deletion refused by policy on a production cluster.",
+    "error": {
+      "code": "permission-denied",
+      "type": "authorization",
+      "message": "Deleting a production topic requires the streaming administrator role.",
+      "retryable": false
+    }
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-7731",
+    "roles": ["streaming-operator"]
+  },
+  "resource": {
+    "type": "topic",
+    "id": "topic-payments-settlement-completed",
+    "name": "payments-settlement-completed",
+    "parentId": "cluster-streaming-production",
+    "classification": "confidential",
+    "ownerId": "team-payments-platform"
+  },
+  "application": {
+    "name": "broker-control-service",
+    "environment": "production",
+    "version": "3.4.1",
+    "region": "region-1"
+  },
+  "authentication": {
+    "method": "oidc",
+    "provider": "corporate-idp",
+    "mfa": true
+  },
+  "authorization": {
+    "decision": "deny",
+    "engine": "policy-service",
+    "policy": "broker-administration",
+    "reason": "Actor lacks the required administrative role.",
+    "permissions": ["topic.delete"]
+  },
+  "request": {
+    "requestId": "request-6f0b71",
+    "correlationId": "correlation-broker-change-4491"
+  },
+  "reason": {
+    "code": "cleanup-attempt",
+    "text": "Operator attempted to remove a topic believed to be unused."
+  },
+  "controlCategories": ["privileged-access", "access-denial"],
+  "tags": ["production", "control-plane"],
+  "metadata": {
+    "broker": {
+      "system": "kafka",
+      "clusterId": "cluster-streaming-production",
+      "operation": {
+        "destructive": true
+      }
+    }
+  }
+}

package/examples/profiles/message-broker-management/valid/topic-delete.json

@@ -0,0 +1,77 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c40-0003-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-17T10:26:12.410Z",
+  "event": {
+    "name": "broker.topic.delete",
+    "category": "data-infrastructure",
+    "type": "delete",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Decommissioned topic deleted after the consuming service was retired."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-4188",
+    "roles": ["streaming-administrator"]
+  },
+  "resource": {
+    "type": "topic",
+    "id": "topic-legacy-invoice-export",
+    "name": "legacy-invoice-export",
+    "parentId": "cluster-streaming-production",
+    "classification": "internal",
+    "ownerId": "team-finance-integration"
+  },
+  "relatedResources": [{ "type": "cluster", "id": "cluster-streaming-production" }],
+  "application": {
+    "name": "broker-control-service",
+    "environment": "production",
+    "version": "3.4.1",
+    "region": "region-1"
+  },
+  "authentication": {
+    "method": "oidc",
+    "provider": "corporate-idp",
+    "mfa": true
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "broker-administration",
+    "permissions": ["topic.delete"]
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-broker-change",
+    "requestId": "approval-request-2213",
+    "requiredApprovals": 2,
+    "receivedApprovals": 2,
+    "approvers": [
+      { "type": "user", "id": "user-1180", "roles": ["platform-lead"] },
+      { "type": "user", "id": "user-2094", "roles": ["data-owner"] }
+    ],
+    "approvedAt": "2026-03-17T10:11:03Z"
+  },
+  "request": {
+    "requestId": "request-6f0b58",
+    "correlationId": "correlation-broker-decommission-1180"
+  },
+  "reason": {
+    "code": "service-decommission",
+    "text": "Consuming service retired and the topic drained.",
+    "reference": "change-8244"
+  },
+  "controlCategories": ["privileged-access", "change-approval"],
+  "tags": ["production", "control-plane"],
+  "metadata": {
+    "broker": {
+      "system": "kafka",
+      "clusterId": "cluster-streaming-production",
+      "approvalRequired": true,
+      "operation": {
+        "destructive": true
+      }
+    }
+  }
+}

package/examples/profiles/message-broker-management/valid/topic-retention-reduce.json

@@ -0,0 +1,77 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c40-0002-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-17T09:03:41.880Z",
+  "event": {
+    "name": "broker.topic.update",
+    "category": "data-infrastructure",
+    "type": "update",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Topic retention shortened, discarding messages older than the new window."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-6612",
+    "roles": ["streaming-operator"]
+  },
+  "resource": {
+    "type": "topic",
+    "id": "topic-payments-settlement-completed",
+    "name": "payments-settlement-completed",
+    "parentId": "cluster-streaming-production",
+    "classification": "confidential",
+    "ownerId": "team-payments-platform"
+  },
+  "application": {
+    "name": "broker-control-service",
+    "environment": "production",
+    "version": "3.4.1",
+    "region": "region-1"
+  },
+  "authentication": {
+    "method": "oidc",
+    "provider": "corporate-idp",
+    "mfa": true
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "broker-administration",
+    "permissions": ["topic.configure"]
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-broker-change",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1,
+    "approvedAt": "2026-03-17T08:58:10Z"
+  },
+  "request": {
+    "requestId": "request-6f0b44",
+    "correlationId": "correlation-broker-change-4472"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["retentionHours"],
+    "before": { "retentionHours": 720 },
+    "after": { "retentionHours": 24 },
+    "ticketId": "change-8210"
+  },
+  "reason": {
+    "code": "storage-reclaim",
+    "text": "Retention shortened to recover cluster storage after a capacity review.",
+    "reference": "change-8210"
+  },
+  "controlCategories": ["privileged-access", "change-approval"],
+  "tags": ["production", "control-plane"],
+  "metadata": {
+    "broker": {
+      "system": "kafka",
+      "clusterId": "cluster-streaming-production",
+      "operation": {
+        "destructive": true
+      }
+    }
+  }
+}

package/examples/profiles/secrets-and-key-management/README.md

@@ -0,0 +1,115 @@
+# Secrets and key management profile fixtures
+
+**Status: Informative.** These fixtures illustrate and regression-test the
+[secrets-and-key-management profile](../../../profiles/secrets-and-key-management/). The rules
+themselves are in
+[profile.json](../../../profiles/secrets-and-key-management/profile.json).
+
+```bash
+auditmodel check-profile examples/profiles/secrets-and-key-management/valid \
+  --profile secrets-and-key-management
+```
+
+Every fixture here — valid, invalid and not-applicable alike — is a **core-conforming** event. The
+ones under `invalid/` fail the profile, not the core schema. That separation is the point: a profile
+adds requirements to events the core already accepts.
+
+## The guarantee these fixtures carry
+
+Each file under `valid/` must satisfy all three commands, and a test enforces it:
+
+```bash
+auditmodel validate      examples/profiles/secrets-and-key-management/valid
+auditmodel lint-privacy  examples/profiles/secrets-and-key-management/valid
+auditmodel check-profile examples/profiles/secrets-and-key-management/valid \
+  --profile secrets-and-key-management
+```
+
+A profile that accepted an event the core rejects would break the core invariant. A profile for
+_this_ domain that accepted an event carrying the material it describes would be worse than no
+profile at all, so a further test scans every fixture — including the invalid and not-applicable ones
+— for a scalar under any credential-shaped property name and fails if it finds one.
+
+**No fixture contains a secret value, key material, a private key, a recovery phrase, a password, a
+token, a client secret, a connection string or a fingerprint of any of them.** Every event records
+that an operation happened and nothing about what was protected.
+
+## Valid fixtures
+
+| File                           | Event                  | Demonstrates                                                    |
+| ------------------------------ | ---------------------- | --------------------------------------------------------------- |
+| `secret-create.json`           | `secret.create`        | Material brought into custody, with a recorded owner            |
+| `secret-rotate.json`           | `secret.rotate`        | Unattended scheduled rotation, recorded as a `change`           |
+| `secret-reveal.json`           | `secret.reveal`        | Privileged human access with authentication and justification   |
+| `secret-reveal-emergency.json` | `secret.reveal`        | Break-glass access with a retrospective, still-pending approval |
+| `secret-export.json`           | `secret.export`        | Export naming its destination kind, under a declared approval   |
+| `secret-revoke.json`           | `secret.revoke`        | Invalidation after suspected exposure                           |
+| `secret-policy-update.json`    | `secret.policy.update` | A custody policy change recorded as before and after            |
+| `key-generate.json`            | `key.generate`         | A key generated inside the custody module                       |
+| `key-import.json`              | `key.import`           | Externally generated material accepted, and why                 |
+| `key-destroy.json`             | `key.destroy`          | Irreversible destruction under an approval its policy required  |
+| `key-export.json`              | `key.export`           | Key material leaving one custodian for another                  |
+| `certificate-issue.json`       | `certificate.issue`    | Issuance recording when validity ends                           |
+
+Two of these produce a **warning** and no error, which is intentional:
+
+- `secret-rotate.json` has no `/reason`. A scheduled rotation has no justification beyond the policy
+  that scheduled it, and `SECRET-CORE-003` recommends rather than requires one.
+- `key-import.json` has no `/metadata/secret/expiresAt`. A key held for as long as the data it
+  protects has no expiry to record, and `SECRET-KEY-002` recommends rather than requires one.
+
+A warning never fails conformance.
+
+## Invalid fixtures
+
+Each removes exactly one required value from a valid fixture, so it fails for one documented reason.
+A test asserts both the rule and the pointer, and that **exactly one** error is produced.
+
+| File                                       | Violates               | At                                 |
+| ------------------------------------------ | ---------------------- | ---------------------------------- |
+| `secret-create-missing-authorization.json` | `SECRET-CORE-001`      | `/authorization`                   |
+| `secret-rotate-missing-type.json`          | `SECRET-CORE-002`      | `/metadata/secret/type`            |
+| `key-generate-missing-owner.json`          | `SECRET-LIFECYCLE-001` | `/resource/ownerId`                |
+| `secret-rotate-missing-change.json`        | `SECRET-ROTATE-001`    | `/change`                          |
+| `secret-reveal-missing-reason.json`        | `SECRET-ACCESS-001`    | `/reason`                          |
+| `emergency-reveal-missing-approval.json`   | `SECRET-ACCESS-002`    | `/approval`                        |
+| `secret-export-missing-destination.json`   | `SECRET-EXPORT-001`    | `/metadata/secret/destinationType` |
+| `secret-revoke-missing-reason.json`        | `SECRET-DESTROY-001`   | `/reason`                          |
+| `key-destroy-missing-approval.json`        | `SECRET-APPROVAL-001`  | `/approval`                        |
+| `policy-update-missing-change.json`        | `SECRET-POLICY-001`    | `/change`                          |
+| `certificate-issue-missing-expiry.json`    | `SECRET-CERT-001`      | `/metadata/secret/expiresAt`       |
+| `key-import-missing-reason.json`           | `SECRET-KEY-001`       | `/reason`                          |
+
+Two of them are worth reading together with the valid fixture they came from:
+
+- `emergency-reveal-missing-approval.json` still declares `emergencyAccess: true`. That declaration
+  is what makes the missing approval a violation; the identical event without the flag conforms.
+- `key-destroy-missing-approval.json` still declares `approvalRequired: true`. The producer's own
+  policy is what the rule enforces, so the same event under a deployment that declares `false`
+  conforms.
+
+## Not-applicable fixtures
+
+| File                        | Event                  | Why it is out of scope                            |
+| --------------------------- | ---------------------- | ------------------------------------------------- |
+| `secret-retrieve.json`      | `secret.retrieve`      | A workload reading its own credential at start-up |
+| `secret-cache-refresh.json` | `secret.cache-refresh` | The same workload refreshing its cached copy      |
+| `key-decrypt.json`          | `key.decrypt`          | A cryptographic operation _with_ a key            |
+
+These are perfectly good audit events that the profile deliberately does not govern.
+`check-profile` reports each as not applicable with exit code 3, and each carries little more than
+the core required fields — which is the shape an ungoverned custody event is expected to have.
+
+They exist to hold the exclusion in place. If a future edit widened a selector to a bare `secret.` or
+`key.` prefix, these fixtures would start conforming instead of being skipped, and the test would
+fail — which is the point, because that edit would silently impose an authorization decision, a
+classification and a material type on the highest-volume events a custody system emits.
+
+## Vendor neutrality
+
+No fixture names a real product, company, cloud provider, jurisdiction or regulation. Custody system
+kinds (`software-vault`, `hardware-security-module`, `managed-key-service`,
+`internal-certificate-authority`), material types, destination kinds, policy names and control
+categories are illustrative tokens, not any vendor's or organization's scheme. Algorithm names are
+public standard identifiers used as examples; the profile requires no particular algorithm and
+asserts nothing about the adequacy of any of them.

package/examples/profiles/secrets-and-key-management/invalid/certificate-issue-missing-expiry.json

@@ -0,0 +1,54 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0212-7a2b-9c3d-4e5f60710212",
+  "time": "2026-05-20T06:44:02.365Z",
+  "event": {
+    "name": "certificate.issue",
+    "category": "security",
+    "type": "create",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "A service certificate was issued by the internal certificate authority."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-certificate-manager"
+  },
+  "resource": {
+    "type": "certificate",
+    "id": "certificate-7715",
+    "name": "checkout-service",
+    "classification": "internal",
+    "ownerId": "team-checkout",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "certificate-authority",
+    "environment": "production",
+    "version": "2.8.4"
+  },
+  "request": {
+    "requestId": "request-b40",
+    "correlationId": "certificate-issue-6620"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "certificate-issuance",
+    "policyVersion": "3"
+  },
+  "reason": {
+    "code": "service-onboarding",
+    "text": "The checkout service was enrolled for mutual authentication.",
+    "reference": "change-9905"
+  },
+  "controlCategories": ["key-management"],
+  "metadata": {
+    "secret": {
+      "type": "certificate",
+      "provider": "internal-certificate-authority",
+      "algorithm": "rsa-4096",
+      "approvalRequired": false
+    }
+  }
+}

package/examples/profiles/secrets-and-key-management/invalid/emergency-reveal-missing-approval.json

@@ -0,0 +1,61 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0205-7a2b-9c3d-4e5f60710205",
+  "time": "2026-05-19T23:14:52.881Z",
+  "event": {
+    "name": "secret.reveal",
+    "category": "privileged-operation",
+    "type": "read",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Break-glass access to a stored credential during a production outage."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-2044",
+    "tenantId": "tenant-4"
+  },
+  "resource": {
+    "type": "secret",
+    "id": "secret-5507",
+    "classification": "secret",
+    "ownerId": "team-settlement",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "secret-store",
+    "environment": "production",
+    "version": "4.2.0"
+  },
+  "request": {
+    "requestId": "request-f88",
+    "correlationId": "incident-4021"
+  },
+  "authentication": {
+    "method": "mfa",
+    "provider": "workforce-directory",
+    "mfa": true,
+    "assuranceLevel": "high",
+    "sessionId": "session-b704",
+    "authenticatedAt": "2026-05-19T23:14:10Z"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "secret-break-glass",
+    "policyVersion": "9"
+  },
+  "reason": {
+    "code": "emergency-access",
+    "text": "Settlement processing was halted and the on-call engineer needed the stored credential to restart the job.",
+    "reference": "incident-4021"
+  },
+  "controlCategories": ["secret-management", "privileged-access", "break-glass-access"],
+  "metadata": {
+    "secret": {
+      "type": "service-credential",
+      "provider": "software-vault",
+      "emergencyAccess": true
+    }
+  }
+}

package/examples/profiles/secrets-and-key-management/invalid/key-destroy-missing-approval.json

@@ -0,0 +1,56 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0211-7a2b-9c3d-4e5f60710211",
+  "time": "2026-06-02T09:00:44.918Z",
+  "event": {
+    "name": "key.destroy",
+    "category": "security",
+    "type": "delete",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "A retired encryption key was destroyed after its data had been re-encrypted."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-6033",
+    "tenantId": "tenant-4"
+  },
+  "resource": {
+    "type": "key",
+    "id": "key-1907",
+    "name": "customer-archive-encryption",
+    "classification": "secret",
+    "ownerId": "team-data-platform",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "key-custody-service",
+    "environment": "production",
+    "version": "6.0.1"
+  },
+  "request": {
+    "requestId": "request-f31",
+    "correlationId": "key-decommission-5580"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "key-custody",
+    "policyVersion": "4"
+  },
+  "reason": {
+    "code": "decommissioning",
+    "text": "Every record protected by this key was re-encrypted under its successor and verified.",
+    "reference": "change-9780"
+  },
+  "controlCategories": ["key-management", "change-approval"],
+  "metadata": {
+    "secret": {
+      "type": "encryption-key",
+      "provider": "managed-key-service",
+      "algorithm": "aes-256-gcm",
+      "approvalRequired": true,
+      "emergencyAccess": false
+    }
+  }
+}

package/examples/profiles/secrets-and-key-management/invalid/key-generate-missing-owner.json

@@ -0,0 +1,56 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0209-7a2b-9c3d-4e5f60710209",
+  "time": "2026-05-14T10:26:12.775Z",
+  "event": {
+    "name": "key.generate",
+    "category": "security",
+    "type": "create",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "A message signing key was generated inside the hardware custody module."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-6033",
+    "tenantId": "tenant-4"
+  },
+  "resource": {
+    "type": "key",
+    "id": "key-2208",
+    "name": "payment-message-signing",
+    "classification": "secret",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "key-custody-service",
+    "environment": "production",
+    "version": "6.0.1",
+    "region": "eu-west"
+  },
+  "request": {
+    "requestId": "request-d19",
+    "correlationId": "key-onboarding-3302"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "key-custody",
+    "policyVersion": "4"
+  },
+  "reason": {
+    "code": "service-onboarding",
+    "text": "A dedicated signing key was created for the payment message gateway.",
+    "reference": "change-9440"
+  },
+  "controlCategories": ["key-management", "privileged-access"],
+  "metadata": {
+    "secret": {
+      "type": "signing-key",
+      "provider": "hardware-security-module",
+      "algorithm": "ecdsa-p256",
+      "expiresAt": "2027-05-14T00:00:00Z",
+      "approvalRequired": false
+    }
+  }
+}

package/examples/profiles/secrets-and-key-management/invalid/key-import-missing-reason.json

@@ -0,0 +1,59 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0210-7a2b-9c3d-4e5f60710210",
+  "time": "2026-05-15T16:48:30.109Z",
+  "event": {
+    "name": "key.import",
+    "category": "security",
+    "type": "import",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Externally generated key material was accepted into the custody system."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-6033",
+    "tenantId": "tenant-4"
+  },
+  "resource": {
+    "type": "key",
+    "id": "key-3341",
+    "name": "counterparty-file-exchange",
+    "classification": "restricted",
+    "ownerId": "team-integration",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "key-custody-service",
+    "environment": "production",
+    "version": "6.0.1"
+  },
+  "request": {
+    "requestId": "request-e63",
+    "correlationId": "key-exchange-4415"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "key-custody",
+    "policyVersion": "4"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "key-import-review",
+    "requestId": "approval-8891",
+    "requiredApprovals": 2,
+    "receivedApprovals": 2,
+    "approvedAt": "2026-05-15T15:30:00Z"
+  },
+  "controlCategories": ["key-management", "privileged-access"],
+  "metadata": {
+    "secret": {
+      "type": "encryption-key",
+      "provider": "hardware-security-module",
+      "algorithm": "aes-256-gcm",
+      "origin": "external-party",
+      "approvalRequired": false
+    }
+  }
+}