<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Security Policy Framework — API Reference

## Policy Management APIs

```bash
# List policies in document management system
find /policies -name "*.md" -type f | sort

# Check policy metadata completeness
grep -L "review_date:" /policies/*.md

# Validate policy YAML frontmatter
python3 -c "import yaml; yaml.safe_load(open('policy.md'))"
```

## Framework Mapping References

| Framework | Policy Requirement | Control ID |
|-----------|-------------------|------------|
| ISO 27001 | Information security policies | A.5.1 |
| NIST CSF | Organizational context | GV.OC |
| CIS Controls | Establish governance program | 1.1 |
| SOC 2 | Control environment | CC1.1-CC1.5 |
| PCI DSS | Security policy | 12.1 |

## Policy Lifecycle Commands

```bash
# Generate policy from template
node agent.js --action generate --type information-security

# Run gap analysis against ISO 27001
node agent.js --action gap-analysis --framework iso-27001 --input /policies

# Inventory all policies
node agent.js --action inventory --input /policies
```
