"use strict";
/**
 * PCI DSS per-framework narrative prompt context.
 *
 * Declares section headings, evidence-linkage requirements, and required
 * control mappings for PCI DSS v4.0 compliance narratives.
 *
 * References:
 *   PCI Security Standards Council -- PCI DSS v4.0 (March 2022)
 *   PCI DSS v4.0 ROC Reporting Template
 *   PCI DSS v4.0 SAQ (Self-Assessment Questionnaire) variants A through D
 *
 * Spec: P4-AIR-02 AC 4-6
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.PCI_DSS_PROMPT_SPEC = void 0;
exports.PCI_DSS_PROMPT_SPEC = {
    frameworkId: 'pci-dss',
    frameworkName: 'PCI DSS v4.0',
    version: 'PCI DSS v4.0 (March 2022)',
    sections: [
        {
            sectionId: 'pcidss-req7-access-control',
            heading: 'Requirement 7 Restrict Access to System Components',
            regulatoryRef: 'PCI DSS v4.0 Requirement 7',
            requiredEventTypes: ['governance:verdict', 'action:denied'],
            controlMappings: [
                '7.1.1 -- Processes for granting and revoking access to CHD components',
                '7.2.1 -- Access control model covering all system components and data',
                '7.2.2 -- Privileged user access assigned based on need-to-know',
                '7.2.4 -- All user accounts reviewed at least every 6 months',
                '7.3.1 -- Automated mechanisms to manage access rights',
                '7.3.2 -- Automated access control systems to enforce access restrictions',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Document access control enforcement over AI agents handling cardholder data (CHD). ' +
                'Cite governance verdict events demonstrating that every AI agent action on CHD ' +
                'components was evaluated against an access control policy. ' +
                'Cite deny-decision events as evidence of need-to-know enforcement (7.2.2). ' +
                'Quantify: total access decisions, denial rate, and any privileged access escalations.',
        },
        {
            sectionId: 'pcidss-req8-authentication',
            heading: 'Requirement 8 Identify Users and Authenticate Access',
            regulatoryRef: 'PCI DSS v4.0 Requirement 8',
            requiredEventTypes: ['agent:registered', 'governance:verdict'],
            controlMappings: [
                '8.2.1 -- Unique IDs assigned to all users and system accounts',
                '8.2.2 -- Group, shared, or generic accounts managed with approval',
                '8.3.4 -- Invalid authentication attempts locked out after 10 attempts',
                '8.4.1 -- MFA implemented for all non-console administrative access into CDE',
                '8.6.1 -- System/application accounts managed by policies and procedures',
                '8.6.2 -- Passwords/passphrases for system/application accounts not hard-coded',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Demonstrate AI agent identity controls under Requirement 8. ' +
                'Cite agent registration events as evidence of unique ID assignment (8.2.1). ' +
                'Cite governance verdict events showing that agent authentication status was ' +
                'verified before CDE access was granted. Quantify: registered agent IDs, ' +
                'authentication verification events, and any lockout/suspension actions. ' +
                'Note that AI agents are treated as system/application accounts under 8.6.1.',
        },
        {
            sectionId: 'pcidss-req10-logging',
            heading: 'Requirement 10 Log and Monitor All Access',
            regulatoryRef: 'PCI DSS v4.0 Requirement 10',
            requiredEventTypes: ['governance:verdict', 'agent:registered'],
            controlMappings: [
                '10.2.1 -- Audit logs capturing all individual user access to CHD',
                '10.2.1.1 -- All actions taken by root/admin privilege',
                '10.2.1.2 -- All access to audit logs',
                '10.2.1.3 -- All invalid logical access attempts',
                '10.2.1.5 -- Use of and changes to identification/authentication mechanisms',
                '10.3.1 -- Audit logs protected from destruction and modification',
                '10.3.2 -- Audit log files protected from unauthorized modifications',
                '10.5.1 -- Retain audit log history for at least 12 months',
                '10.6.1 -- Synchronised system clocks (NTP/similar)',
                '10.7.1 -- Failures of critical security controls detected and responded to',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Provide evidence of audit log completeness and integrity for PCI Requirement 10. ' +
                'Describe the audit chain architecture: hash-linked chain, tamper detection, ' +
                'all event types captured. Cite agent and governance events as log completeness evidence. ' +
                'Document log retention period against the 12-month minimum (10.5.1). ' +
                'Note SHA-256 chain integrity as evidence of log protection (10.3.1-10.3.2). ' +
                'Quantify: events logged per day, coverage rate, and any chain gaps detected.',
        },
        {
            sectionId: 'pcidss-req12-policies',
            heading: 'Requirement 12 Security Policies and Programs',
            regulatoryRef: 'PCI DSS v4.0 Requirement 12',
            requiredEventTypes: ['agent:registered', 'governance:verdict'],
            controlMappings: [
                '12.1.1 -- Overall information security policy established and communicated',
                '12.3.1 -- Targeted risk analyses performed for PCI DSS requirements',
                '12.6.2 -- Security awareness program reviewed at least annually',
                '12.10.1 -- Incident response plan maintained and tested',
                '12.10.7 -- Incident response procedures for payment page scripts',
            ],
            citationRequirement: 'optional',
            promptGuidance: 'Document policy and program controls for AI agent operations in the CDE. ' +
                'Describe how compliance packs encode the security policies required by 12.1.1. ' +
                'Reference agent registration events as evidence of the structured onboarding ' +
                'program required for system accounts. Note governance verdict coverage as ' +
                'evidence that policy awareness is operationalised, not merely documented.',
        },
    ],
};
//# sourceMappingURL=pcidss.js.map