Skip to content

security-context.mdx

Latest commit

 

History

History
193 lines (122 loc) · 7.71 KB

security-context.mdx

File metadata and controls

193 lines (122 loc) · 7.71 KB
Raw
title Security Context
description Security Context protocol schemas

{/* ⚠️ AUTO-GENERATED — DO NOT EDIT. Run build-docs.ts to regenerate. Hand-written docs live in the module folders under content/docs/. */}

Unified Security Context Protocol

Provides a central governance layer that correlates and unifies

the four independent security subsystems it was designed against. Three of

the four have since been REMOVED per ADR-0056 D8 (declared-but-never-enforced;

see system/index.ts notes) — only encryption survives, marked experimental:

  • Audit (audit.zod.ts — REMOVED): the live audit path is plugin-audit's

always-on capture + object/field trackHistory + lifecycle audit retention

  • Encryption (encryption.zod.ts): Field-level encryption and key management

  • Compliance (compliance.zod.ts — REMOVED): GDPR/HIPAA/SOX/PCI-DSS configs

  • Masking (masking.zod.ts — REMOVED): PII data masking and tokenization

This schema enforces cross-cutting security policies, ensuring compliance

frameworks drive encryption requirements, masking rules respect role-based

audit visibility, and all security operations are correlated in a single

governance context.

See also: https://www.iso.org/standard/27001

@category Security

**Source:** `packages/spec/src/system/security-context.zod.ts`

TypeScript Usage

import { ComplianceAuditRequirement, ComplianceEncryptionRequirement, ComplianceFramework, DataClassification, DataClassificationPolicy, MaskingVisibilityRule, SecurityContextConfig, SecurityEventCorrelation } from '@objectstack/spec/system';
import type { ComplianceAuditRequirement, ComplianceEncryptionRequirement, ComplianceFramework, DataClassification, DataClassificationPolicy, MaskingVisibilityRule, SecurityContextConfig, SecurityEventCorrelation } from '@objectstack/spec/system';

// Validate data
const result = ComplianceAuditRequirement.parse(data);

ComplianceAuditRequirement

Compliance framework audit event requirements

Properties

Property Type Required Description
framework Enum<'gdpr' | 'hipaa' | 'sox' | 'pci_dss' | 'ccpa' | 'iso27001'> ✅ Compliance framework identifier
requiredEvents string[] ✅ Audit event types required by this framework (e.g., "data.delete", "auth.login")
retentionDays number ✅ Minimum audit log retention period required by this framework (in days)
alertOnMissing boolean ✅ Raise alert if a required audit event is not being captured

ComplianceEncryptionRequirement

Compliance framework encryption requirements

Properties

Property Type Required Description
framework Enum<'gdpr' | 'hipaa' | 'sox' | 'pci_dss' | 'ccpa' | 'iso27001'> ✅ Compliance framework identifier
dataClassifications Enum<'pii' | 'phi' | 'pci' | 'financial' | 'confidential' | 'internal' | 'public'>[] ✅ Data classifications that must be encrypted under this framework
minimumAlgorithm Enum<'aes-256-gcm' | 'aes-256-cbc' | 'chacha20-poly1305'> ✅ Minimum encryption algorithm strength required
keyRotationMaxDays number ✅ Maximum key rotation interval required (in days)

ComplianceFramework

Compliance framework identifier

Allowed Values

  • gdpr
  • hipaa
  • sox
  • pci_dss
  • ccpa
  • iso27001

DataClassification

Data classification level

Allowed Values

  • pii
  • phi
  • pci
  • financial
  • confidential
  • internal
  • public

DataClassificationPolicy

Security policy for a specific data classification level

Properties

Property Type Required Description
classification Enum<'pii' | 'phi' | 'pci' | 'financial' | 'confidential' | 'internal' | 'public'> ✅ Data classification level
requireEncryption boolean ✅ Encryption required for this classification
requireMasking boolean ✅ Masking required for this classification
requireAudit boolean ✅ Audit trail required for access to this classification
retentionDays number optional Data retention limit in days (for compliance)

MaskingVisibilityRule

Masking visibility and audit rule per data classification

Properties

Property Type Required Description
dataClassification Enum<'pii' | 'phi' | 'pci' | 'financial' | 'confidential' | 'internal' | 'public'> ✅ Data classification this rule applies to
defaultMasked boolean ✅ Whether data is masked by default
unmaskRoles string[] optional Roles allowed to view unmasked data
auditUnmask boolean ✅ Log an audit event when data is unmasked
requireApproval boolean ✅ Require explicit approval before unmasking
approvalRoles string[] optional Roles that can approve unmasking requests

SecurityContextConfig

Unified security context governance configuration

Properties

Property Type Required Description
enabled boolean ✅ Enable unified security context governance
complianceAuditRequirements { framework: Enum<'gdpr' | 'hipaa' | 'sox' | 'pci_dss' | 'ccpa' | 'iso27001'>; requiredEvents: string[]; retentionDays: number; alertOnMissing: boolean }[] optional Compliance-driven audit event requirements
complianceEncryptionRequirements { framework: Enum<'gdpr' | 'hipaa' | 'sox' | 'pci_dss' | 'ccpa' | 'iso27001'>; dataClassifications: Enum<'pii' | 'phi' | 'pci' | 'financial' | 'confidential' | 'internal' | 'public'>[]; minimumAlgorithm: Enum<'aes-256-gcm' | 'aes-256-cbc' | 'chacha20-poly1305'>; keyRotationMaxDays: number }[] optional Compliance-driven encryption requirements by data classification
maskingVisibility { dataClassification: Enum<'pii' | 'phi' | 'pci' | 'financial' | 'confidential' | 'internal' | 'public'>; defaultMasked: boolean; unmaskRoles?: string[]; auditUnmask: boolean; … }[] optional Masking visibility rules per data classification
dataClassifications { classification: Enum<'pii' | 'phi' | 'pci' | 'financial' | 'confidential' | 'internal' | 'public'>; requireEncryption: boolean; requireMasking: boolean; requireAudit: boolean; … }[] optional Data classification policies for unified security enforcement
eventCorrelation { enabled: boolean; correlationId: boolean; linkAuthToAudit: boolean; linkEncryptionToAudit: boolean; … } optional Cross-subsystem security event correlation settings
enforceOnWrite boolean ✅ Enforce encryption and masking requirements on data write operations
enforceOnRead boolean ✅ Enforce masking and audit requirements on data read operations
failOpen boolean ✅ When false (default), deny access if security context cannot be evaluated

SecurityEventCorrelation

Cross-subsystem security event correlation configuration

Properties

Property Type Required Description
enabled boolean ✅ Enable cross-subsystem security event correlation
correlationId boolean ✅ Inject a shared correlation ID into audit, encryption, and masking events
linkAuthToAudit boolean ✅ Link authentication events to subsequent data operation audit trails
linkEncryptionToAudit boolean ✅ Log encryption/decryption operations in the audit trail
linkMaskingToAudit boolean ✅ Log masking/unmasking operations in the audit trail