<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Security Architecture Review — API Reference

## agent.js CLI

```bash
# Initialize review for a system
node scripts/agent.js --action init --system "Payment Service" --compliance pci-dss,soc2

# Execute full checklist review
node scripts/agent.js --action review --checklist full

# Score findings
node scripts/agent.js --action score --findings findings.json

# Generate review report
node scripts/agent.js --action report --findings findings.json --output report.json
```

## Review Domains

| Domain | Checks | Key Frameworks |
|--------|--------|---------------|
| Authentication | 4 | CIS 5-6, OWASP ASVS, CISA ZT |
| Authorization | 3 | CIS 6, SOC 2, NIST AC |
| Data Protection | 4 | CIS 3, PCI-DSS 3-4, ISO 27001 |
| Network | 3 | CIS 12, NIST PR.PT, PCI-DSS 1 |
| Operations | 4 | CIS 7-8-11-17, NIST RS |

## Risk Rating Scale

| Score | Rating | Action Required |
|-------|--------|-----------------|
| 0-15 | Acceptable | Monitor, schedule next review |
| 15-40 | Needs Work | Plan remediation within quarter |
| 40-70 | High Risk | Immediate remediation required |
| 70+ | Unacceptable | Stop deployment, escalate |

## Compliance Framework Mapping

| Framework | Focus Areas |
|-----------|-------------|
| PCI-DSS | Payment data, encryption, network segmentation |
| SOC 2 | Trust services criteria: security, availability, confidentiality |
| HIPAA | PHI protection, access controls, audit trails |
| ISO 27001 | Information security management system |
| NIST CSF | Identify, Protect, Detect, Respond, Recover |
