/**
 * SOC 2 Type II Evidence Report Template
 *
 * Covers all five Trust Services Criteria (TSC): Security (CC), Availability
 * (A), Confidentiality (C), Processing Integrity (PI), and Privacy (P).
 *
 * SOC 2 Type II attestations require evidence of operating effectiveness
 * over a defined review period (AICPA AT-C 205). Every section in this
 * template requires citations -- uncited claims are rejected before the
 * rendered artefact is returned.
 *
 * Regulatory references:
 *   AICPA Trust Services Criteria 2017 (TSC CC6.1-CC9.2)
 *   AICPA AT-C Section 205 -- Examination Engagements
 *   COSO Internal Control -- Integrated Framework 2013
 *
 * Spec: P4-AIR-02 item 1
 *
 * @connexum/ai-governance
 */
const CITATION_INSTRUCTION = `
MANDATORY CITATION RULES: Every factual claim MUST immediately reference the
audit-chain event ID in square brackets, e.g. [EVT-abc123]. You may ONLY cite
event IDs from the AVAILABLE EVENTS list supplied in context. If the available
events do not support a claim, write "Insufficient evidence in the audit window
to support this assertion." Never fabricate event IDs or invent facts.
`.trim();
export const SOC2_TYPE_II_TEMPLATE = {
    templateId: 'tpl-soc2-type-ii-v1',
    name: 'SOC 2 Type II Evidence Report',
    framework: 'soc2',
    requiredAuditEventTypes: [
        'governance:verdict',
        'approval:decided',
        'agent:registered',
    ],
    artefactFormat: 'pdf',
    legalReviewRequired: true,
    sections: [
        {
            id: 'soc2-cc6-logical-access',
            title: 'CC6: Logical and Physical Access Controls',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the CC6 (Logical and Physical Access Controls) section of a
SOC 2 Type II evidence report for an AI governance platform.

TSC Reference: CC6.1 (prior to granting access), CC6.2 (credentials management),
CC6.3 (access removal), CC6.6 (network controls), CC6.7 (transmission encryption),
CC6.8 (malware protection).

Using ONLY the audit-chain events provided, describe:
1. How AI agent access is granted, provisioned, and revoked (cite registration
   and de-registration events from the chain).
2. Evidence that the governance runtime enforced deny decisions for out-of-scope
   tool invocations during the review period.
3. Any access anomalies or policy violations detected and the enforcement actions
   taken.
4. Quantify: number of access-control events, deny rate, and any escalations.

${CITATION_INSTRUCTION}

Write 3-5 formal paragraphs suitable for a Type II auditor package. Do not
include the word "draft" -- this is the authoritative evidence narrative.
`.trim(),
        },
        {
            id: 'soc2-cc7-monitoring',
            title: 'CC7: System Operations and Monitoring',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the CC7 (System Operations) section of a SOC 2 Type II report.

TSC Reference: CC7.1 (detection and monitoring), CC7.2 (evaluation of security
events), CC7.3 (response), CC7.4 (recovery), CC7.5 (post-incident review).

Using ONLY the audit-chain events provided, describe:
1. Continuous monitoring controls active during the review period, including
   anomaly detection and circuit-breaker enforcement.
2. Security events detected, their severity classification, and the response
   actions taken.
3. Evidence that monitoring controls operated continuously throughout the period
   with no material gaps.
4. Mean time to detect (MTTD) and mean time to respond (MTTR) where evidence
   permits calculation.

${CITATION_INSTRUCTION}

Write 3-5 formal paragraphs. Quantify where possible.
`.trim(),
        },
        {
            id: 'soc2-cc8-change-management',
            title: 'CC8: Change Management',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the CC8 (Change Management) section of a SOC 2 Type II report.

TSC Reference: CC8.1 (infrastructure and software changes authorised, tested,
documented, and approved prior to implementation).

Using ONLY the audit-chain events provided, describe:
1. Evidence that AI agent policy changes (policy snapshots) were recorded and
   version-controlled in the audit chain.
2. Approval workflow events confirming that changes requiring human review
   received documented approvals before taking effect.
3. Any change failures, rollbacks, or emergency changes and the associated
   approvals or post-hoc authorisations.

${CITATION_INSTRUCTION}

Write 3-5 formal paragraphs.
`.trim(),
        },
        {
            id: 'soc2-cc9-risk-mitigation',
            title: 'CC9: Risk Mitigation',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the CC9 (Risk Mitigation) section of a SOC 2 Type II report.

TSC Reference: CC9.1 (risk mitigation activities), CC9.2 (vendor and business
partner risk).

Using ONLY the audit-chain events provided, describe:
1. Automated risk-mitigation controls enforced by the governance runtime
   (circuit breakers, approval gates, suspension events).
2. Evidence of vendor or LLM provider governance: which adapters were active,
   any provider-specific policy overrides applied.
3. How the platform's HITL (human-in-the-loop) controls ensure that AI agent
   risk is continuously mitigated.

${CITATION_INSTRUCTION}

Write 3-5 formal paragraphs.
`.trim(),
        },
        {
            id: 'soc2-a1-availability',
            title: 'A1: Availability',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the A1 (Availability) section of a SOC 2 Type II report.

TSC Reference: A1.1 (capacity planning), A1.2 (environmental threats),
A1.3 (recovery and continuity testing).

Using ONLY the audit-chain events provided, describe:
1. Evidence that the governance runtime remained operational throughout the
   review period (uptime evidence from event timestamps).
2. Any service interruptions, their duration, and recovery actions taken.
3. Rate-limiting and circuit-breaker events that demonstrate the system
   protected availability by preventing runaway agent behaviour.

${CITATION_INSTRUCTION}

Write 3-4 formal paragraphs.
`.trim(),
        },
        {
            id: 'soc2-pi1-processing-integrity',
            title: 'PI1: Processing Integrity',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the PI1 (Processing Integrity) section of a SOC 2 Type II report.

TSC Reference: PI1.1 (complete, valid, accurate, timely processing), PI1.2
(outputs are complete, accurate, and distributed to authorised parties).

Using ONLY the audit-chain events provided, describe:
1. Evidence that AI agent governance decisions (ALLOW/DENY/REQUIRE_APPROVAL)
   were recorded completely and with integrity in the tamper-evident chain.
2. Any detected chain-integrity violations or hash mismatches and their
   resolution.
3. Completeness of audit records relative to agent activity during the window.

${CITATION_INSTRUCTION}

Write 3-4 formal paragraphs.
`.trim(),
        },
    ],
};
//# sourceMappingURL=soc2-type-ii.js.map