<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Cloud Landing Zone Security — API Reference

## agent.js CLI

```bash
# Design account/OU structure
node scripts/agent.js --action design --config org-config.json

# Generate guardrails (SCPs, Config Rules, auto-remediation)
node scripts/agent.js --action guardrails --config org-config.json --output guardrails.json

# Audit landing zone configuration
node scripts/agent.js --action audit --config org-config.json --output audit.json

# Validate guardrail completeness
node scripts/agent.js --action validate --guardrails guardrails.json
```

## Organization Config JSON Schema

```json
{
  "allowed_regions": ["us-east-1", "us-west-2"],
  "cloudtrail": true,
  "guardduty": true,
  "s3_block_public": true,
  "ebs_encryption": true,
  "flow_logs": true,
  "scps_applied": true,
  "central_logging": true,
  "budget_alerts": true
}
```

## Guardrail Categories

| Category | Type | Enforcement |
|----------|------|------------|
| Preventive | SCP | Blocks prohibited actions |
| Detective | Config Rule | Detects non-compliance |
| Corrective | Auto-remediation | Fixes violations automatically |

## Account Structure OUs

- **Security** — Log archive, security tooling, audit
- **Infrastructure** — Shared services, network hub
- **Workload** — Production and non-production sub-OUs
- **Sandbox** — Experimentation with restrictions
