Documentation
¶
Overview ¶
Package compliance ports src/sec_af/compliance/mapping.py: the static CWE -> framework-control table SEC-AF scores findings against, the lookup and normalization helpers around it, the AI fallback for CWEs the table does not cover, and the gap aggregation the audit result reports.
The table itself lives in table_gen.go, mechanically derived from the Python module by scripts/gen_compliance_table.py — see that file.
Index ¶
- Variables
- func ClearAICache()
- func GetComplianceGaps[T any](findings []T) []schemas.ComplianceGap
- func GetComplianceMappings(cweID string, frameworks []string) []schemas.ComplianceMapping
- func GetComplianceMappingsHybrid(ctx context.Context, cweID string, frameworks []string, aiGate AIGateLike) []schemas.ComplianceMapping
- func GetSupportedFrameworks() []string
- type AIGateFunc
- type AIGateLike
Constants ¶
This section is empty.
Variables ¶
View Source
var ComplianceMap = map[string][]schemas.ComplianceMapping{
"CWE-78": {
{Framework: "PCI-DSS", ControlID: "Req 6.2.4", ControlName: "Custom software addresses common coding vulnerabilities"},
{Framework: "SOC2", ControlID: "CC7", ControlName: "System operations"},
{Framework: "OWASP", ControlID: "A03:2021", ControlName: "Injection"},
{Framework: "HIPAA", ControlID: "§164.312(c)(1)", ControlName: "Integrity"},
{Framework: "ISO27001", ControlID: "A.8.28", ControlName: "Secure coding"},
},
"CWE-79": {
{Framework: "PCI-DSS", ControlID: "Req 6.2.4", ControlName: "Custom software addresses common coding vulnerabilities"},
{Framework: "SOC2", ControlID: "CC7", ControlName: "System operations"},
{Framework: "OWASP", ControlID: "A03:2021", ControlName: "Injection"},
{Framework: "HIPAA", ControlID: "§164.312(c)(1)", ControlName: "Integrity"},
{Framework: "ISO27001", ControlID: "A.8.28", ControlName: "Secure coding"},
},
"CWE-89": {
{Framework: "PCI-DSS", ControlID: "Req 6.2.4", ControlName: "Custom software addresses common coding vulnerabilities"},
{Framework: "SOC2", ControlID: "CC6", ControlName: "Logical and physical access controls"},
{Framework: "OWASP", ControlID: "A03:2021", ControlName: "Injection"},
{Framework: "HIPAA", ControlID: "§164.312(a)(1)", ControlName: "Access control"},
{Framework: "ISO27001", ControlID: "A.8.28", ControlName: "Secure coding"},
},
"CWE-90": {
{Framework: "PCI-DSS", ControlID: "Req 6.2.4", ControlName: "Custom software addresses common coding vulnerabilities"},
{Framework: "SOC2", ControlID: "CC7", ControlName: "System operations"},
{Framework: "OWASP", ControlID: "A03:2021", ControlName: "Injection"},
{Framework: "HIPAA", ControlID: "§164.312(c)(1)", ControlName: "Integrity"},
{Framework: "ISO27001", ControlID: "A.8.28", ControlName: "Secure coding"},
},
"CWE-91": {
{Framework: "PCI-DSS", ControlID: "Req 6.2.4", ControlName: "Custom software addresses common coding vulnerabilities"},
{Framework: "SOC2", ControlID: "CC7", ControlName: "System operations"},
{Framework: "OWASP", ControlID: "A03:2021", ControlName: "Injection"},
{Framework: "HIPAA", ControlID: "§164.312(c)(1)", ControlName: "Integrity"},
{Framework: "ISO27001", ControlID: "A.8.28", ControlName: "Secure coding"},
},
"CWE-94": {
{Framework: "PCI-DSS", ControlID: "Req 6.2.4", ControlName: "Custom software addresses common coding vulnerabilities"},
{Framework: "SOC2", ControlID: "CC7", ControlName: "System operations"},
{Framework: "OWASP", ControlID: "A03:2021", ControlName: "Injection"},
{Framework: "HIPAA", ControlID: "§164.312(c)(1)", ControlName: "Integrity"},
{Framework: "ISO27001", ControlID: "A.8.28", ControlName: "Secure coding"},
},
"CWE-917": {
{Framework: "PCI-DSS", ControlID: "Req 6.2.4", ControlName: "Custom software addresses common coding vulnerabilities"},
{Framework: "SOC2", ControlID: "CC7", ControlName: "System operations"},
{Framework: "OWASP", ControlID: "A03:2021", ControlName: "Injection"},
{Framework: "HIPAA", ControlID: "§164.312(c)(1)", ControlName: "Integrity"},
{Framework: "ISO27001", ControlID: "A.8.28", ControlName: "Secure coding"},
},
"CWE-287": {
{Framework: "PCI-DSS", ControlID: "Req 8", ControlName: "Identify users and authenticate access to system components"},
{Framework: "SOC2", ControlID: "CC6", ControlName: "Logical and physical access controls"},
{Framework: "OWASP", ControlID: "A07:2021", ControlName: "Identification and Authentication Failures"},
{Framework: "HIPAA", ControlID: "§164.312(d)", ControlName: "Person or entity authentication"},
{Framework: "ISO27001", ControlID: "A.5.17", ControlName: "Authentication information"},
},
"CWE-306": {
{Framework: "PCI-DSS", ControlID: "Req 8", ControlName: "Identify users and authenticate access to system components"},
{Framework: "SOC2", ControlID: "CC6", ControlName: "Logical and physical access controls"},
{Framework: "OWASP", ControlID: "A07:2021", ControlName: "Identification and Authentication Failures"},
{Framework: "HIPAA", ControlID: "§164.312(a)(1)", ControlName: "Access control"},
{Framework: "ISO27001", ControlID: "A.5.15", ControlName: "Access control"},
},
"CWE-352": {
{Framework: "PCI-DSS", ControlID: "Req 6.2.4", ControlName: "Custom software addresses common coding vulnerabilities"},
{Framework: "SOC2", ControlID: "CC6", ControlName: "Logical and physical access controls"},
{Framework: "OWASP", ControlID: "A01:2021", ControlName: "Broken Access Control"},
{Framework: "HIPAA", ControlID: "§164.312(a)(1)", ControlName: "Access control"},
{Framework: "ISO27001", ControlID: "A.8.5", ControlName: "Secure authentication"},
},
"CWE-862": {
{Framework: "PCI-DSS", ControlID: "Req 8", ControlName: "Identify users and authenticate access to system components"},
{Framework: "SOC2", ControlID: "CC6", ControlName: "Logical and physical access controls"},
{Framework: "OWASP", ControlID: "A01:2021", ControlName: "Broken Access Control"},
{Framework: "HIPAA", ControlID: "§164.312(a)(1)", ControlName: "Access control"},
{Framework: "ISO27001", ControlID: "A.5.15", ControlName: "Access control"},
},
"CWE-863": {
{Framework: "PCI-DSS", ControlID: "Req 8", ControlName: "Identify users and authenticate access to system components"},
{Framework: "SOC2", ControlID: "CC6", ControlName: "Logical and physical access controls"},
{Framework: "OWASP", ControlID: "A01:2021", ControlName: "Broken Access Control"},
{Framework: "HIPAA", ControlID: "§164.312(a)(1)", ControlName: "Access control"},
{Framework: "ISO27001", ControlID: "A.5.18", ControlName: "Access rights"},
},
"CWE-326": {
{Framework: "PCI-DSS", ControlID: "Req 3", ControlName: "Protect stored account data"},
{Framework: "SOC2", ControlID: "CC6", ControlName: "Logical and physical access controls"},
{Framework: "OWASP", ControlID: "A02:2021", ControlName: "Cryptographic Failures"},
{Framework: "HIPAA", ControlID: "§164.312(a)(2)(iv)", ControlName: "Encryption and decryption"},
{Framework: "ISO27001", ControlID: "A.8.24", ControlName: "Use of cryptography"},
},
"CWE-327": {
{Framework: "PCI-DSS", ControlID: "Req 3", ControlName: "Protect stored account data"},
{Framework: "SOC2", ControlID: "CC6", ControlName: "Logical and physical access controls"},
{Framework: "OWASP", ControlID: "A02:2021", ControlName: "Cryptographic Failures"},
{Framework: "HIPAA", ControlID: "§164.312(a)(2)(iv)", ControlName: "Encryption and decryption"},
{Framework: "ISO27001", ControlID: "A.8.24", ControlName: "Use of cryptography"},
},
"CWE-328": {
{Framework: "PCI-DSS", ControlID: "Req 3", ControlName: "Protect stored account data"},
{Framework: "SOC2", ControlID: "CC6", ControlName: "Logical and physical access controls"},
{Framework: "OWASP", ControlID: "A02:2021", ControlName: "Cryptographic Failures"},
{Framework: "HIPAA", ControlID: "§164.312(a)(2)(iv)", ControlName: "Encryption and decryption"},
{Framework: "ISO27001", ControlID: "A.8.24", ControlName: "Use of cryptography"},
},
"CWE-330": {
{Framework: "PCI-DSS", ControlID: "Req 3", ControlName: "Protect stored account data"},
{Framework: "SOC2", ControlID: "CC6", ControlName: "Logical and physical access controls"},
{Framework: "OWASP", ControlID: "A02:2021", ControlName: "Cryptographic Failures"},
{Framework: "HIPAA", ControlID: "§164.312(c)(1)", ControlName: "Integrity"},
{Framework: "ISO27001", ControlID: "A.8.24", ControlName: "Use of cryptography"},
},
"CWE-916": {
{Framework: "PCI-DSS", ControlID: "Req 8", ControlName: "Identify users and authenticate access to system components"},
{Framework: "SOC2", ControlID: "CC6", ControlName: "Logical and physical access controls"},
{Framework: "OWASP", ControlID: "A07:2021", ControlName: "Identification and Authentication Failures"},
{Framework: "HIPAA", ControlID: "§164.312(d)", ControlName: "Person or entity authentication"},
{Framework: "ISO27001", ControlID: "A.8.24", ControlName: "Use of cryptography"},
},
"CWE-840": {
{Framework: "PCI-DSS", ControlID: "Req 6", ControlName: "Develop and maintain secure systems and software"},
{Framework: "SOC2", ControlID: "CC7", ControlName: "System operations"},
{Framework: "OWASP", ControlID: "A04:2021", ControlName: "Insecure Design"},
{Framework: "HIPAA", ControlID: "§164.308(a)(1)(ii)(A)", ControlName: "Risk analysis"},
{Framework: "ISO27001", ControlID: "A.8.25", ControlName: "Secure development lifecycle"},
},
"CWE-841": {
{Framework: "PCI-DSS", ControlID: "Req 6", ControlName: "Develop and maintain secure systems and software"},
{Framework: "SOC2", ControlID: "CC7", ControlName: "System operations"},
{Framework: "OWASP", ControlID: "A04:2021", ControlName: "Insecure Design"},
{Framework: "HIPAA", ControlID: "§164.308(a)(1)(ii)(A)", ControlName: "Risk analysis"},
{Framework: "ISO27001", ControlID: "A.8.25", ControlName: "Secure development lifecycle"},
},
"CWE-200": {
{Framework: "PCI-DSS", ControlID: "Req 3", ControlName: "Protect stored account data"},
{Framework: "SOC2", ControlID: "CC6", ControlName: "Logical and physical access controls"},
{Framework: "OWASP", ControlID: "A01:2021", ControlName: "Broken Access Control"},
{Framework: "HIPAA", ControlID: "§164.312(a)(1)", ControlName: "Access control"},
{Framework: "ISO27001", ControlID: "A.8.12", ControlName: "Data leakage prevention"},
},
"CWE-209": {
{Framework: "PCI-DSS", ControlID: "Req 6", ControlName: "Develop and maintain secure systems and software"},
{Framework: "SOC2", ControlID: "CC7", ControlName: "System operations"},
{Framework: "OWASP", ControlID: "A09:2021", ControlName: "Security Logging and Monitoring Failures"},
{Framework: "HIPAA", ControlID: "§164.312(b)", ControlName: "Audit controls"},
{Framework: "ISO27001", ControlID: "A.8.15", ControlName: "Logging"},
},
"CWE-312": {
{Framework: "PCI-DSS", ControlID: "Req 3", ControlName: "Protect stored account data"},
{Framework: "SOC2", ControlID: "CC6", ControlName: "Logical and physical access controls"},
{Framework: "OWASP", ControlID: "A02:2021", ControlName: "Cryptographic Failures"},
{Framework: "HIPAA", ControlID: "§164.312(a)(2)(iv)", ControlName: "Encryption and decryption"},
{Framework: "ISO27001", ControlID: "A.8.24", ControlName: "Use of cryptography"},
},
"CWE-319": {
{Framework: "PCI-DSS", ControlID: "Req 4", ControlName: "Protect cardholder data with strong cryptography during transmission"},
{Framework: "SOC2", ControlID: "CC6", ControlName: "Logical and physical access controls"},
{Framework: "OWASP", ControlID: "A02:2021", ControlName: "Cryptographic Failures"},
{Framework: "HIPAA", ControlID: "§164.312(e)(1)", ControlName: "Transmission security"},
{Framework: "ISO27001", ControlID: "A.8.20", ControlName: "Network security"},
},
"CWE-532": {
{Framework: "PCI-DSS", ControlID: "Req 3", ControlName: "Protect stored account data"},
{Framework: "SOC2", ControlID: "CC7", ControlName: "System operations"},
{Framework: "OWASP", ControlID: "A09:2021", ControlName: "Security Logging and Monitoring Failures"},
{Framework: "HIPAA", ControlID: "§164.312(b)", ControlName: "Audit controls"},
{Framework: "ISO27001", ControlID: "A.8.15", ControlName: "Logging"},
},
"CWE-829": {
{Framework: "PCI-DSS", ControlID: "Req 6", ControlName: "Develop and maintain secure systems and software"},
{Framework: "SOC2", ControlID: "CC8", ControlName: "Change management"},
{Framework: "OWASP", ControlID: "A08:2021", ControlName: "Software and Data Integrity Failures"},
{Framework: "HIPAA", ControlID: "§164.308(a)(1)(ii)(B)", ControlName: "Risk management"},
{Framework: "ISO27001", ControlID: "A.8.25", ControlName: "Secure development lifecycle"},
},
"CWE-1104": {
{Framework: "PCI-DSS", ControlID: "Req 6", ControlName: "Develop and maintain secure systems and software"},
{Framework: "SOC2", ControlID: "CC8", ControlName: "Change management"},
{Framework: "OWASP", ControlID: "A06:2021", ControlName: "Vulnerable and Outdated Components"},
{Framework: "HIPAA", ControlID: "§164.308(a)(1)(ii)(B)", ControlName: "Risk management"},
{Framework: "ISO27001", ControlID: "A.8.8", ControlName: "Management of technical vulnerabilities"},
},
"CWE-16": {
{Framework: "PCI-DSS", ControlID: "Req 2", ControlName: "Apply secure configurations to all system components"},
{Framework: "SOC2", ControlID: "CC7", ControlName: "System operations"},
{Framework: "OWASP", ControlID: "A05:2021", ControlName: "Security Misconfiguration"},
{Framework: "HIPAA", ControlID: "§164.308(a)(1)(ii)(B)", ControlName: "Risk management"},
{Framework: "ISO27001", ControlID: "A.8.9", ControlName: "Configuration management"},
},
"CWE-259": {
{Framework: "PCI-DSS", ControlID: "Req 8", ControlName: "Identify users and authenticate access to system components"},
{Framework: "SOC2", ControlID: "CC6", ControlName: "Logical and physical access controls"},
{Framework: "OWASP", ControlID: "A07:2021", ControlName: "Identification and Authentication Failures"},
{Framework: "HIPAA", ControlID: "§164.312(d)", ControlName: "Person or entity authentication"},
{Framework: "ISO27001", ControlID: "A.5.17", ControlName: "Authentication information"},
},
"CWE-321": {
{Framework: "PCI-DSS", ControlID: "Req 3", ControlName: "Protect stored account data"},
{Framework: "SOC2", ControlID: "CC6", ControlName: "Logical and physical access controls"},
{Framework: "OWASP", ControlID: "A02:2021", ControlName: "Cryptographic Failures"},
{Framework: "HIPAA", ControlID: "§164.312(a)(2)(iv)", ControlName: "Encryption and decryption"},
{Framework: "ISO27001", ControlID: "A.8.24", ControlName: "Use of cryptography"},
},
"CWE-798": {
{Framework: "PCI-DSS", ControlID: "Req 8", ControlName: "Identify users and authenticate access to system components"},
{Framework: "SOC2", ControlID: "CC6", ControlName: "Logical and physical access controls"},
{Framework: "OWASP", ControlID: "A07:2021", ControlName: "Identification and Authentication Failures"},
{Framework: "HIPAA", ControlID: "§164.312(d)", ControlName: "Person or entity authentication"},
{Framework: "ISO27001", ControlID: "A.5.17", ControlName: "Authentication information"},
},
"CWE-285": {
{Framework: "PCI-DSS", ControlID: "Req 8", ControlName: "Identify users and authenticate access to system components"},
{Framework: "SOC2", ControlID: "CC6", ControlName: "Logical and physical access controls"},
{Framework: "OWASP", ControlID: "A01:2021", ControlName: "Broken Access Control"},
{Framework: "HIPAA", ControlID: "§164.312(a)(1)", ControlName: "Access control"},
{Framework: "ISO27001", ControlID: "A.5.15", ControlName: "Access control"},
},
"CWE-346": {
{Framework: "PCI-DSS", ControlID: "Req 8", ControlName: "Identify users and authenticate access to system components"},
{Framework: "SOC2", ControlID: "CC6", ControlName: "Logical and physical access controls"},
{Framework: "OWASP", ControlID: "A01:2021", ControlName: "Broken Access Control"},
{Framework: "HIPAA", ControlID: "§164.312(a)(1)", ControlName: "Access control"},
{Framework: "ISO27001", ControlID: "A.5.16", ControlName: "Identity management"},
},
"CWE-601": {
{Framework: "PCI-DSS", ControlID: "Req 6", ControlName: "Develop and maintain secure systems and software"},
{Framework: "SOC2", ControlID: "CC7", ControlName: "System operations"},
{Framework: "OWASP", ControlID: "A01:2021", ControlName: "Broken Access Control"},
{Framework: "HIPAA", ControlID: "§164.312(c)(1)", ControlName: "Integrity"},
{Framework: "ISO27001", ControlID: "A.8.28", ControlName: "Secure coding"},
},
"CWE-918": {
{Framework: "PCI-DSS", ControlID: "Req 6", ControlName: "Develop and maintain secure systems and software"},
{Framework: "SOC2", ControlID: "CC7", ControlName: "System operations"},
{Framework: "OWASP", ControlID: "A10:2021", ControlName: "Server-Side Request Forgery"},
{Framework: "HIPAA", ControlID: "§164.312(e)(1)", ControlName: "Transmission security"},
{Framework: "ISO27001", ControlID: "A.8.20", ControlName: "Network security"},
},
}
ComplianceMap ports the module-level COMPLIANCE_MAP table of src/sec_af/compliance/mapping.py: the static CWE -> framework-control mapping every finding is scored against.
Key order below is the Python dict's literal (insertion) order, and each value keeps the Python list order, because GetComplianceMappings returns the per-CWE list verbatim and callers compare it positionally.
Regenerate with:
PYTHONPATH=src ~/.agentfield/packages/sec-af/venv/bin/python \
go/scripts/gen_compliance_table.py
Functions ¶
func ClearAICache ¶
func ClearAICache()
ClearAICache empties the AI fallback cache.
It is the port of the Python tests' `mapping._AI_COMPLIANCE_CACHE.clear()`: module-level caches leak across test cases, so every hybrid test starts by clearing it. Nothing in the production path calls this.
func GetComplianceGaps ¶
func GetComplianceGaps[T any](findings []T) []schemas.ComplianceGap
GetComplianceGaps ports get_compliance_gaps: it walks findings, maps each one's CWE through the static table, and aggregates per framework control how many findings hit it, which CWEs, and the worst severity among them.
The parameter is generic so the two Python call shapes both work unchanged: `[]schemas.VerifiedFinding` (what the orchestrator passes) and `[]any` / `[]map[string]any` (what the tests pass). Field access is the port of `_read_field`, i.e. Python's duck typing — see readField.
Findings without a truthy `cwe_id`, and findings whose CWE the table does not know, are skipped (Python `continue`s on both).
The result is sorted by (framework, control_id, control_name), so it is fully deterministic even though the aggregation itself runs over a Go map.
func GetComplianceMappings ¶
func GetComplianceMappings(cweID string, frameworks []string) []schemas.ComplianceMapping
GetComplianceMappings ports get_compliance_mappings: the static table lookup for one CWE, optionally restricted to a set of frameworks.
Passing a nil or empty frameworks slice is Python's `frameworks=None` / `frameworks=[]` — both are falsy, so both mean "no filter".
The returned slice is always freshly allocated and never aliases the table, which is what Python's `mapping.model_copy(deep=True)` buys: a caller that mutates a returned ComplianceMapping cannot corrupt the table for the next caller. ComplianceMapping is a struct of three strings, so a slice copy IS a deep copy.
An unmapped CWE yields an empty (non-nil) slice, matching Python's `[]`.
func GetComplianceMappingsHybrid ¶
func GetComplianceMappingsHybrid( ctx context.Context, cweID string, frameworks []string, aiGate AIGateLike, ) []schemas.ComplianceMapping
GetComplianceMappingsHybrid ports get_compliance_mappings_hybrid: the static table first, and only for a CWE the table does not know does it ask the AI gate — caching the answer so the same unknown CWE costs one LLM call per process.
Python parity, in order:
- the static lookup (already framework-filtered) wins whenever it is non-empty — the gate is not even constructed;
- no gate (Python's `ai_gate is None`, Go's nil interface) yields [];
- the cache is keyed by (normalized CWE, sorted normalized framework set or None) and stores the ALREADY FILTERED list;
- a gate failure yields [] and is NOT cached, so a transient error does not poison the CWE for the rest of the run. Python swallows the exception (`except Exception: return []`) and so does this function — which is why it returns no error: any diagnostics belong in the AIGateLike implementation, where the caller still has the error in hand.
Python parity quirk kept deliberately: the prompt interpolates `cwe_description = "Unknown CWE"` — a local constant that is never derived from the CWE — so every fallback prompt says "(Unknown CWE)".
func GetSupportedFrameworks ¶
func GetSupportedFrameworks() []string
GetSupportedFrameworks ports get_supported_frameworks:
sorted({m.framework for ms in COMPLIANCE_MAP.values() for m in ms})
i.e. ["HIPAA", "ISO27001", "OWASP", "PCI-DSS", "SOC2"]. Python sorts strings by code point; Go's sort.Strings sorts by UTF-8 byte order, which is the same ordering for valid UTF-8.
Types ¶
type AIGateFunc ¶
AIGateFunc adapts a plain function to AIGateLike.
func (AIGateFunc) InvokeComplianceGate ¶
func (f AIGateFunc) InvokeComplianceGate(ctx context.Context, user string) (schemas.ComplianceGate, error)
InvokeComplianceGate implements AIGateLike.
type AIGateLike ¶
type AIGateLike interface {
// InvokeComplianceGate runs the gate with the compliance prompt and
// returns the parsed ComplianceGate. An error is Python's raised
// exception: GetComplianceMappingsHybrid swallows it and returns no
// mappings, exactly like the `except Exception: return []` in mapping.py.
InvokeComplianceGate(ctx context.Context, user string) (schemas.ComplianceGate, error)
}
AIGateLike mirrors mapping.py's `_AIGateLike` Protocol, narrowed to the one call GetComplianceMappingsHybrid actually makes:
suggestion = await ai_gate.invoke(user=prompt, schema=ComplianceGate)
Python's Protocol is generic over the pydantic model because AIGateWrapper serves every gate; a Go method cannot carry a type parameter, so the seam is specialised to ComplianceGate here. That also keeps this package free of any dependency on internal/gates (which in turn depends on aix, harnessx and the SDK) — the production wiring adapts the real gate with AIGateFunc:
compliance.GetComplianceMappingsHybrid(ctx, cwe, frameworks,
compliance.AIGateFunc(func(ctx context.Context, user string) (schemas.ComplianceGate, error) {
return gates.Invoke[schemas.ComplianceGate](ctx, gate, user, "")
}))
A nil AIGateLike is Python's `ai_gate=None`: no fallback, empty result.
Source Files
Click to show internal directories.
Click to hide internal directories.