# SOC 2 (Trust Services Criteria) → LeanCTX mapping matrix (GL #424, H3 Epic A).
#
# Scope: TSC criteria where the context pipeline is in the audit boundary —
# logical access to the pipeline's capabilities, monitoring of its
# operation, confidentiality of what flows through it. Entity-level
# criteria (governance, risk assessment, HR) are out of scope.

framework = "soc2"
title = "SOC 2 — AICPA Trust Services Criteria (2017, revised 2022 points of focus)"
version_pin = "TSC 2017 incl. 2022 revised points of focus"
pinned_on = "2026-06-11"
review_cycle_months = 6
disclaimer = "LeanCTX is tooling support for compliance work — not legal advice. A SOC 2 report covers an organisation's controls as a whole; LeanCTX provides enforceable controls and evidence for the context-pipeline slice."
reference_pack = "soc2-context"

[[controls]]
id = "SOC2-CC6.1"
clause = "CC6.1"
requirement = "Logical access security: access to protected resources is restricted to authorized users"
mechanism = "pack_rule"
leanctx = "Role-based capability gate (default-deny) over every tool invocation; pack allow/deny_tools narrow the surface further"
evidence = "capability check results + denied-call audit entries"
coverage = "full"
test = "soc2_cc61_default_deny_capability_gate"

[[controls]]
id = "SOC2-CC6.6"
clause = "CC6.6"
requirement = "Boundaries of the system are protected against external threats"
mechanism = "pack_rule"
leanctx = "Network egress tools deniable by pack (deny_tools); path jail keeps reads inside the project boundary, violations audited"
evidence = "pack deny list + path_jail_violation audit entries"
coverage = "full"
test = "soc2_cc66_egress_deniable_and_path_jailed"

[[controls]]
id = "SOC2-CC7.2"
clause = "CC7.2"
requirement = "System operations are monitored to detect anomalies and security events"
mechanism = "audit_event"
leanctx = "Typed security events (security_violation, secret_detected, rate_limited, budget_exceeded) recorded in the tamper-evident trail and exported as governance events"
evidence = "audit entries by event_type + OCP event stream"
coverage = "full"
test = "soc2_cc72_security_events_are_typed_and_recorded"

[[controls]]
id = "SOC2-CC7.1"
clause = "CC7.1"
requirement = "Configuration changes and vulnerabilities are identified"
mechanism = "audit_event"
leanctx = "Role changes are first-class audit events (role_changed); policy packs are versioned files whose changes are git diffs"
evidence = "role_changed entries + pack version history"
coverage = "partial"
gap = "Vulnerability management of the host system is outside the pipeline boundary"
test = "soc2_cc71_role_changes_are_audited"

[[controls]]
id = "SOC2-C1.1"
clause = "C1.1 (Confidentiality)"
requirement = "Confidential information is identified and protected"
mechanism = "pack_rule"
leanctx = "Named redaction patterns (credentials + regulated identifiers) strip confidential material before it enters model context"
evidence = "redaction fixtures matched by resolved patterns in CI"
coverage = "full"
test = "soc2_c11_confidential_material_redacted"

[[controls]]
id = "SOC2-CC8.1"
clause = "CC8.1"
requirement = "Changes to infrastructure and software are authorized, tested and approved"
mechanism = "none"
leanctx = "Change management is an organisational process; pack changes being git-reviewable supports it but approval workflows live in the VCS"
evidence = "n/a"
coverage = "none"
gap = "Use VCS branch protection + review rules for pack changes"

[[controls]]
id = "SOC2-A1.2"
clause = "A1.2 (Availability)"
requirement = "Environmental protections, backup and recovery are in place"
mechanism = "none"
leanctx = "Availability of the host environment is out of scope for a context pipeline"
evidence = "n/a"
coverage = "none"
gap = "Host/platform responsibility"