Security Context

Unified Security Context Protocol

Provides a central governance layer that correlates and unifies the four independent security subsystems it was designed against. Three of the four have since been REMOVED per ADR-0056 D8 (declared-but-never-enforced; see system/index.ts notes) — only encryption survives, marked experimental:

Audit (audit.zod.ts — REMOVED): the live audit path is plugin-audit's always-on capture + object/field trackHistory + lifecycle audit retention
Encryption (encryption.zod.ts): Field-level encryption and key management
Compliance (compliance.zod.ts — REMOVED): GDPR/HIPAA/SOX/PCI-DSS configs
Masking (masking.zod.ts — REMOVED): PII data masking and tokenization

This schema enforces cross-cutting security policies, ensuring compliance frameworks drive encryption requirements, masking rules respect role-based audit visibility, and all security operations are correlated in a single governance context.

@category Security

Source: packages/spec/src/system/security-context.zod.ts

TypeScript Usage

import { ComplianceAuditRequirementSchema, ComplianceEncryptionRequirementSchema, ComplianceFrameworkSchema, DataClassificationSchema, DataClassificationPolicySchema, MaskingVisibilityRuleSchema, SecurityContextConfigSchema, SecurityEventCorrelationSchema } from '@objectstack/spec/system';
import type { ComplianceAuditRequirement, ComplianceEncryptionRequirement, ComplianceFramework, DataClassification, DataClassificationPolicy, MaskingVisibilityRule, SecurityContextConfig, SecurityEventCorrelation } from '@objectstack/spec/system';

// Validate data
const result = ComplianceAuditRequirementSchema.parse(data);

ComplianceAuditRequirement

Compliance framework audit event requirements

Properties

Property	Type	Required	Description
framework	`Enum<'gdpr' \| 'hipaa' \| 'sox' \| 'pci_dss' \| 'ccpa' \| 'iso27001'>`	✅	Compliance framework identifier
requiredEvents	`string[]`	✅	Audit event types required by this framework (e.g., "data.delete", "auth.login")
retentionDays	`number`	✅	Minimum audit log retention period required by this framework (in days)
alertOnMissing	`boolean`	optional (default: `true`)	Raise alert if a required audit event is not being captured

ComplianceEncryptionRequirement

Compliance framework encryption requirements

Properties

Property	Type	Required	Description
framework	`Enum<'gdpr' \| 'hipaa' \| 'sox' \| 'pci_dss' \| 'ccpa' \| 'iso27001'>`	✅	Compliance framework identifier
dataClassifications	`Enum<'pii' \| 'phi' \| 'pci' \| 'financial' \| 'confidential' \| 'internal' \| 'public'>[]`	✅	Data classifications that must be encrypted under this framework
minimumAlgorithm	`Enum<'aes-256-gcm' \| 'aes-256-cbc' \| 'chacha20-poly1305'>`	optional (default: `"aes-256-gcm"`)	Minimum encryption algorithm strength required
keyRotationMaxDays	`number`	optional (default: `90`)	Maximum key rotation interval required (in days)

ComplianceFramework

Compliance framework identifier

Allowed Values

gdpr
hipaa
sox
pci_dss
ccpa
iso27001

DataClassification

Data classification level

Allowed Values

pii
phi
pci
financial
confidential
internal
public

DataClassificationPolicy

Security policy for a specific data classification level

Properties

Property	Type	Required	Description
classification	`Enum<'pii' \| 'phi' \| 'pci' \| 'financial' \| 'confidential' \| 'internal' \| 'public'>`	✅	Data classification level
requireEncryption	`boolean`	optional (default: `false`)	Encryption required for this classification
requireMasking	`boolean`	optional (default: `false`)	Masking required for this classification
requireAudit	`boolean`	optional (default: `false`)	Audit trail required for access to this classification
retentionDays	`number`	optional	Data retention limit in days (for compliance)

MaskingVisibilityRule

Masking visibility and audit rule per data classification

Properties

Property	Type	Required	Description
dataClassification	`Enum<'pii' \| 'phi' \| 'pci' \| 'financial' \| 'confidential' \| 'internal' \| 'public'>`	✅	Data classification this rule applies to
defaultMasked	`boolean`	optional (default: `true`)	Whether data is masked by default
unmaskRoles	`string[]`	optional	Roles allowed to view unmasked data
auditUnmask	`boolean`	optional (default: `true`)	Log an audit event when data is unmasked
requireApproval	`boolean`	optional (default: `false`)	Require explicit approval before unmasking
approvalRoles	`string[]`	optional	Roles that can approve unmasking requests