<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Compliance as Code — API Reference

## OPA CLI

```bash
# Check policy syntax
opa check policy.rego

# Evaluate policy
opa eval --data policy/ --input input.json "data.kubernetes.admission.deny"

# Run tests
opa test policy/ -v

# Format policies
opa fmt -w policy/

# Build bundle
opa build -b policy/ -o bundle.tar.gz
```

## Conftest

```bash
# Test files against policies
conftest test deployment.yaml -p policy/ --output json

# Test multiple files
conftest test k8s/ terraform/ -p policy/ --all-namespaces

# Pull community policies
conftest pull github.com/open-policy-agent/library

# Verify policies
conftest verify -p policy/

# Parse input
conftest parse deployment.yaml
```

## InSpec

```bash
# Run profile
inspec exec cis-aws-profile -t aws://

# Run specific control
inspec exec cis-aws-profile --controls cis-aws-1.1

# Generate report
inspec exec cis-aws-profile --reporter json:/tmp/inspec-report.json

# Check profile
inspec check cis-aws-profile

# Supermarket (community profiles)
inspec supermarket profiles
```

## Framework Control Counts

| Framework | Total Controls | Automatable |
|-----------|---------------|-------------|
| CIS AWS v3.0 | ~170 | ~85% |
| SOC 2 Type II | ~60 | ~70% |
| PCI DSS v4.0 | ~250 | ~60% |
| HIPAA | ~75 | ~50% |
| NIST 800-53 | ~1000+ | ~40% |

## Policy Testing

```rego
# policy/kubernetes_test.rego
package kubernetes.admission

test_deny_privileged {
    deny["Privileged container not allowed: test"] with input as {
        "request": {
            "kind": {"kind": "Pod"},
            "object": {"spec": {"containers": [
                {"name": "test", "securityContext": {"privileged": true}}
            ]}}
        }
    }
}

test_allow_unprivileged {
    count(deny) == 0 with input as {
        "request": {
            "kind": {"kind": "Pod"},
            "object": {"spec": {"containers": [
                {"name": "test", "securityContext": {"privileged": false}}
            ]}}
        }
    }
}
```
