= "iso42001-aligned"
= "0.1.0"
= "ISO/IEC 42001 Annex A alignment: enforced responsible-use process (A.9.2/A.9.4), operation logging expectation, data filtering before use (A.7.4) (mapping: compliance/mappings/iso42001.toml)"
= "strict-redaction"
[]
# A.9.2: the pack itself is the enforced process definition — cap and
# retention make the expectations explicit and reviewable.
= 16000
= 365
# A.9.4: out-of-intended-use surface denied; violations are recorded.
= ["ctx_url_read"]
[]
# A.7.4: regulated identifiers controlled before context use.
= '(?i)\b(dob|date[ _-]?of[ _-]?birth)\b[ :=#]*\d{1,4}[-/.]\d{1,2}[-/.]\d{1,4}'
= '\b\d{3}-\d{2}-\d{4}\b'
= '\b[A-Z]{2}\d{2}[A-Z0-9]{11,30}\b'
= '\b\d{4}[ -]?\d{4}[ -]?\d{4}[ -]?\d{1,7}\b'
[]
# A.7.4 — data filtering before use (GL #675): regulated identifiers are
# redacted out of inbound context; prompt-injection is flagged for review.
= "redact"
= "warn"
[]
# A.9.4 — out-of-scope action control (GL #676): block agent writes/actions
# carrying detected secrets or PII; bound the write/action rate.
= true
= 240