"use strict";
/**
 * SOC 2 per-framework narrative prompt context.
 *
 * Declares section headings, evidence-linkage requirements, and required
 * control mappings for SOC 2 Type II compliance narratives.
 *
 * References:
 *   AICPA TSP Section 100 (2017) -- Trust Services Criteria
 *   AICPA AT-C Section 205 -- Examination Engagements
 *   AICPA Guide: Reporting on Controls at a Service Organization (SOC 2)
 *
 * Spec: P4-AIR-02 AC 4-6
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.SOC2_PROMPT_SPEC = void 0;
exports.SOC2_PROMPT_SPEC = {
    frameworkId: 'soc2',
    frameworkName: 'SOC 2 Type II',
    version: 'AICPA TSP Section 100 (2017 Trust Services Criteria)',
    sections: [
        {
            sectionId: 'soc2-cc1-control-environment',
            heading: 'CC1 Control Environment',
            regulatoryRef: 'AICPA TSP CC1.1-CC1.5',
            requiredEventTypes: ['agent:registered', 'governance:verdict'],
            controlMappings: [
                'CC1.1 -- COSO Principle 1: Commitment to integrity and ethical values',
                'CC1.2 -- COSO Principle 2: Board oversight of internal control',
                'CC1.3 -- COSO Principle 3: Organizational structures and authority',
                'CC1.4 -- COSO Principle 4: Commitment to competence',
                'CC1.5 -- COSO Principle 5: Accountability for internal control',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Describe the AI governance control environment. Cite agent registration events ' +
                'demonstrating that only authorized agents operate within the service boundary. ' +
                'Cite governance verdicts showing that controls are consistently applied and that ' +
                'accountability mechanisms (agent IDs, decision logs) are in place. Quantify the ' +
                'number of registered agents and governance decisions in the audit period.',
        },
        {
            sectionId: 'soc2-cc2-communication',
            heading: 'CC2 Communication and Information',
            regulatoryRef: 'AICPA TSP CC2.1-CC2.3',
            requiredEventTypes: ['agent:registered', 'approval:decided'],
            controlMappings: [
                'CC2.1 -- COSO Principle 13: Use of relevant quality information',
                'CC2.2 -- COSO Principle 14: Internal communication of control information',
                'CC2.3 -- COSO Principle 15: External communication to affected parties',
            ],
            citationRequirement: 'optional',
            promptGuidance: 'Document information flows within the AI governance platform relevant to CC2. ' +
                'Describe how approval decisions are communicated, how agents receive policy updates, ' +
                'and how governance findings are escalated to responsible parties. Reference approval ' +
                'events as evidence of structured communication channels.',
        },
        {
            sectionId: 'soc2-cc6-logical-access',
            heading: 'CC6 Logical and Physical Access Controls',
            regulatoryRef: 'AICPA TSP CC6.1-CC6.8',
            requiredEventTypes: ['governance:verdict', 'action:denied'],
            controlMappings: [
                'CC6.1 -- Logical access security measures to meet objectives',
                'CC6.2 -- Prior to issuing system credentials: registration and authorization',
                'CC6.3 -- Role-based access and least-privilege enforcement',
                'CC6.6 -- Logical access measures against threats from outside',
                'CC6.7 -- Transmission of data restricted to authorised users',
                'CC6.8 -- Controls to prevent or detect unauthorized software deployment',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Provide evidence of logical access control effectiveness. Cite governance verdict ' +
                'events showing that role checks fired before every privileged agent action. ' +
                'Cite deny-decision events demonstrating least-privilege enforcement. Quantify: ' +
                'total access decisions, denial rate, and any access attempts outside registered ' +
                'agent scopes. Transmission encryption controls should be noted if audit chain ' +
                'shows HTTPS-enforced event submission.',
        },
        {
            sectionId: 'soc2-cc7-system-operations',
            heading: 'CC7 System Operations',
            regulatoryRef: 'AICPA TSP CC7.1-CC7.5',
            requiredEventTypes: ['governance:verdict', 'incident:created'],
            controlMappings: [
                'CC7.1 -- Detection and monitoring of new vulnerabilities',
                'CC7.2 -- Monitoring of system components for anomalies',
                'CC7.3 -- Evaluation of security events to identify incidents',
                'CC7.4 -- Response to identified security incidents',
                'CC7.5 -- Recovery of affected systems after a security incident',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Document system operations and incident management posture. Describe anomaly ' +
                'detection events (circuit-breaker trips, threshold violations) as evidence for CC7.2. ' +
                'For any incident events, trace the detection-to-response timeline. If no incidents ' +
                'occurred, document the absence of qualifying events with chain evidence. ' +
                'Quantify monitoring coverage and detection latency where audit data permits.',
        },
        {
            sectionId: 'soc2-cc9-risk-mitigation',
            heading: 'CC9 Risk Mitigation',
            regulatoryRef: 'AICPA TSP CC9.1-CC9.2',
            requiredEventTypes: ['governance:verdict', 'approval:decided'],
            controlMappings: [
                'CC9.1 -- Identification and assessment of risks from vendors and business partners',
                'CC9.2 -- Risk monitoring through approved vendor relationships',
            ],
            citationRequirement: 'optional',
            promptGuidance: 'Describe risk mitigation controls applied to AI agent vendor relationships. ' +
                'Document how LLM provider integrations are governed (approval gates for new adapters, ' +
                'vendor risk assessments). Cite approval events for any new LLM or orchestrator ' +
                'provider onboarding during the audit window. Note any vendor-related governance ' +
                'verdicts or policy changes.',
        },
    ],
};
//# sourceMappingURL=soc2.js.map