// =============================================================================
// Access Controls
// Categories: ACCESS_CONTROL, ADMISSION_CONTROL, ACCESS_AUTHORIZATION
// =============================================================================

import { ControlLibraryEntry } from '../../types'

export const ACCESS_CONTROLS: ControlLibraryEntry[] = [
  // ACCESS_CONTROL
  {
    id: 'TOM-AC-01',
    code: 'TOM-AC-01',
    category: 'ACCESS_CONTROL',
    type: 'TECHNICAL',
    name: { de: 'Elektronische Zutrittskontrolle', en: 'Electronic Access Control' },
    description: {
      de: 'Implementierung elektronischer Zugangskontrollsysteme (Chipkarten, Biometrie) zur Kontrolle des physischen Zutritts zu Räumlichkeiten mit IT-Systemen.',
      en: 'Implementation of electronic access control systems (chip cards, biometrics) to control physical access to premises with IT systems.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.7.2' },
      { framework: 'BSI_IT_GRUNDSCHUTZ', reference: 'ORP.4' },
    ],
    applicabilityConditions: [
      { field: 'architectureProfile.hostingModel', operator: 'IN', value: ['ON_PREMISE', 'PRIVATE_CLOUD', 'HYBRID'], result: 'REQUIRED', priority: 10 },
      { field: 'architectureProfile.hostingModel', operator: 'EQUALS', value: 'PUBLIC_CLOUD', result: 'NOT_APPLICABLE', priority: 20 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Zutrittskontrollkonzept', 'Protokolle des Zutrittskontrollsystems', 'Besucherregelungen'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'MEDIUM',
    tags: ['physical-security', 'access'],
  },
  {
    id: 'TOM-AC-02',
    code: 'TOM-AC-02',
    category: 'ACCESS_CONTROL',
    type: 'ORGANIZATIONAL',
    name: { de: 'Besuchermanagement', en: 'Visitor Management' },
    description: {
      de: 'Regelungen für den Empfang, die Begleitung und Registrierung von Besuchern in sicherheitsrelevanten Bereichen.',
      en: 'Regulations for receiving, accompanying and registering visitors in security-relevant areas.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.7.2' },
    ],
    applicabilityConditions: [
      { field: 'architectureProfile.hostingModel', operator: 'IN', value: ['ON_PREMISE', 'PRIVATE_CLOUD', 'HYBRID'], result: 'REQUIRED', priority: 10 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Besucherrichtlinie', 'Besucherbuch/Protokolle'],
    reviewFrequency: 'ANNUAL',
    priority: 'MEDIUM',
    complexity: 'LOW',
    tags: ['physical-security', 'visitors'],
  },
  {
    id: 'TOM-AC-03',
    code: 'TOM-AC-03',
    category: 'ACCESS_CONTROL',
    type: 'TECHNICAL',
    name: { de: 'Videoüberwachung', en: 'Video Surveillance' },
    description: {
      de: 'Installation von Videoüberwachungssystemen zur Kontrolle und Dokumentation des Zutritts zu sensiblen Bereichen.',
      en: 'Installation of video surveillance systems to control and document access to sensitive areas.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.7.4' },
    ],
    applicabilityConditions: [
      { field: 'riskProfile.protectionLevel', operator: 'IN', value: ['HIGH', 'VERY_HIGH'], result: 'RECOMMENDED', priority: 15 },
      { field: 'dataProfile.hasSpecialCategories', operator: 'EQUALS', value: true, result: 'RECOMMENDED', priority: 20 },
    ],
    defaultApplicability: 'OPTIONAL',
    evidenceRequirements: ['Videoüberwachungskonzept', 'Datenschutz-Folgenabschätzung für Videoüberwachung'],
    reviewFrequency: 'ANNUAL',
    priority: 'MEDIUM',
    complexity: 'MEDIUM',
    tags: ['physical-security', 'monitoring'],
  },
  {
    id: 'TOM-AC-04',
    code: 'TOM-AC-04',
    category: 'ACCESS_CONTROL',
    type: 'TECHNICAL',
    name: { de: 'Alarmanlage', en: 'Alarm System' },
    description: {
      de: 'Einbruchmeldeanlage zum Schutz der Räumlichkeiten außerhalb der Betriebszeiten.',
      en: 'Intrusion detection system to protect premises outside business hours.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'BSI_IT_GRUNDSCHUTZ', reference: 'INF.1' },
    ],
    applicabilityConditions: [
      { field: 'architectureProfile.hostingModel', operator: 'IN', value: ['ON_PREMISE', 'PRIVATE_CLOUD', 'HYBRID'], result: 'RECOMMENDED', priority: 10 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Alarmkonzept', 'Wartungsprotokolle'],
    reviewFrequency: 'ANNUAL',
    priority: 'MEDIUM',
    complexity: 'MEDIUM',
    tags: ['physical-security', 'intrusion-detection'],
  },
  {
    id: 'TOM-AC-05',
    code: 'TOM-AC-05',
    category: 'ACCESS_CONTROL',
    type: 'ORGANIZATIONAL',
    name: { de: 'Schlüsselmanagement', en: 'Key Management' },
    description: {
      de: 'Dokumentierte Verwaltung und Ausgabe von physischen Schlüsseln mit Nachverfolgbarkeit.',
      en: 'Documented management and distribution of physical keys with traceability.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.7.2' },
    ],
    applicabilityConditions: [
      { field: 'architectureProfile.hostingModel', operator: 'IN', value: ['ON_PREMISE', 'PRIVATE_CLOUD', 'HYBRID'], result: 'REQUIRED', priority: 10 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Schlüsselausgabeprotokoll', 'Schlüsselverwaltungsrichtlinie'],
    reviewFrequency: 'ANNUAL',
    priority: 'MEDIUM',
    complexity: 'LOW',
    tags: ['physical-security', 'keys'],
  },
  {
    id: 'TOM-AC-06',
    code: 'TOM-AC-06',
    category: 'ACCESS_CONTROL',
    type: 'ORGANIZATIONAL',
    name: { de: 'Besuchermanagement (erweitert)', en: 'Visitor Management (Extended)' },
    description: {
      de: 'Erweitertes Besuchermanagement mit Voranmeldung, Identitaetspruefung, Begleitpflicht und zeitlich begrenztem Zugang zu sicherheitsrelevanten Bereichen.',
      en: 'Extended visitor management with pre-registration, identity verification, escort requirement and time-limited access to security-relevant areas.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.7.2' },
    ],
    applicabilityConditions: [
      { field: 'riskProfile.protectionLevel', operator: 'IN', value: ['HIGH', 'VERY_HIGH'], result: 'REQUIRED', priority: 20 },
      { field: 'dataProfile.hasSpecialCategories', operator: 'EQUALS', value: true, result: 'RECOMMENDED', priority: 15 },
    ],
    defaultApplicability: 'OPTIONAL',
    evidenceRequirements: ['Besuchermanagement-Richtlinie', 'Besucherprotokolle', 'Zonenkonzept'],
    reviewFrequency: 'ANNUAL',
    priority: 'MEDIUM',
    complexity: 'LOW',
    tags: ['physical-security', 'visitors', 'extended'],
  },

  // ADMISSION_CONTROL
  {
    id: 'TOM-ADM-01',
    code: 'TOM-ADM-01',
    category: 'ADMISSION_CONTROL',
    type: 'TECHNICAL',
    name: { de: 'Multi-Faktor-Authentifizierung', en: 'Multi-Factor Authentication' },
    description: {
      de: 'Implementierung einer Zwei- oder Mehr-Faktor-Authentifizierung für den Systemzugang zu kritischen Systemen und Daten.',
      en: 'Implementation of two- or multi-factor authentication for system access to critical systems and data.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.9.4.2' },
      { framework: 'BSI_IT_GRUNDSCHUTZ', reference: 'ORP.4' },
    ],
    applicabilityConditions: [
      { field: 'dataProfile.hasSpecialCategories', operator: 'EQUALS', value: true, result: 'REQUIRED', priority: 30 },
      { field: 'dataProfile.processesMinors', operator: 'EQUALS', value: true, result: 'REQUIRED', priority: 25 },
      { field: 'riskProfile.protectionLevel', operator: 'IN', value: ['HIGH', 'VERY_HIGH'], result: 'REQUIRED', priority: 20 },
      { field: 'companyProfile.role', operator: 'EQUALS', value: 'PROCESSOR', result: 'REQUIRED', priority: 15 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['MFA-Konfigurationsdokumentation', 'Nutzerstatistiken zur MFA-Nutzung'],
    reviewFrequency: 'QUARTERLY',
    priority: 'CRITICAL',
    complexity: 'MEDIUM',
    tags: ['authentication', 'mfa', 'identity'],
  },
  {
    id: 'TOM-ADM-02',
    code: 'TOM-ADM-02',
    category: 'ADMISSION_CONTROL',
    type: 'TECHNICAL',
    name: { de: 'Passwortrichtlinien', en: 'Password Policies' },
    description: {
      de: 'Durchsetzung technischer Passwortrichtlinien (Mindestlänge, Komplexität, regelmäßiger Wechsel, Historie).',
      en: 'Enforcement of technical password policies (minimum length, complexity, regular changes, history).',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.9.4.3' },
    ],
    applicabilityConditions: [],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['Passwortrichtlinie', 'Technische Konfiguration'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'LOW',
    tags: ['authentication', 'passwords'],
  },
  {
    id: 'TOM-ADM-03',
    code: 'TOM-ADM-03',
    category: 'ADMISSION_CONTROL',
    type: 'TECHNICAL',
    name: { de: 'Single Sign-On (SSO)', en: 'Single Sign-On (SSO)' },
    description: {
      de: 'Zentralisierte Authentifizierung über SSO zur Verbesserung der Sicherheit und Benutzerfreundlichkeit.',
      en: 'Centralized authentication via SSO to improve security and usability.',
    },
    mappings: [{ framework: 'ISO27001_ANNEX_A', reference: 'A.9.2.4' }],
    applicabilityConditions: [
      { field: 'companyProfile.size', operator: 'IN', value: ['MEDIUM', 'LARGE', 'ENTERPRISE'], result: 'RECOMMENDED', priority: 10 },
    ],
    defaultApplicability: 'OPTIONAL',
    evidenceRequirements: ['SSO-Konfigurationsdokumentation', 'Integrierte Anwendungsliste'],
    reviewFrequency: 'ANNUAL',
    priority: 'MEDIUM',
    complexity: 'HIGH',
    tags: ['authentication', 'sso', 'identity'],
  },
  {
    id: 'TOM-ADM-04',
    code: 'TOM-ADM-04',
    category: 'ADMISSION_CONTROL',
    type: 'TECHNICAL',
    name: { de: 'Automatische Bildschirmsperre', en: 'Automatic Screen Lock' },
    description: {
      de: 'Automatische Sperrung von Arbeitsplätzen nach Inaktivität mit erforderlicher Re-Authentifizierung.',
      en: 'Automatic locking of workstations after inactivity with required re-authentication.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.11.2.8' },
    ],
    applicabilityConditions: [],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['GPO/MDM-Konfiguration', 'Richtliniendokumentation'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'LOW',
    tags: ['workstation', 'security'],
  },
  {
    id: 'TOM-ADM-05',
    code: 'TOM-ADM-05',
    category: 'ADMISSION_CONTROL',
    type: 'TECHNICAL',
    name: { de: 'Kontosperrung nach Fehlversuchen', en: 'Account Lockout After Failed Attempts' },
    description: {
      de: 'Automatische temporäre Sperrung von Benutzerkonten nach mehreren fehlgeschlagenen Anmeldeversuchen.',
      en: 'Automatic temporary locking of user accounts after multiple failed login attempts.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.9.4.2' },
    ],
    applicabilityConditions: [],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['Konfigurationsdokumentation', 'Protokollierung der Sperrereignisse'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'LOW',
    tags: ['authentication', 'brute-force-protection'],
  },
  {
    id: 'TOM-ADM-06',
    code: 'TOM-ADM-06',
    category: 'ADMISSION_CONTROL',
    type: 'TECHNICAL',
    name: { de: 'Endpoint Detection & Response (EDR)', en: 'Endpoint Detection & Response (EDR)' },
    description: {
      de: 'Einsatz von EDR-Loesungen zur Erkennung und Abwehr von Bedrohungen auf Endgeraeten in Echtzeit.',
      en: 'Deployment of EDR solutions for real-time threat detection and response on endpoints.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.12.2.1' },
      { framework: 'BSI_IT_GRUNDSCHUTZ', reference: 'OPS.1.1.4' },
    ],
    applicabilityConditions: [
      { field: 'riskProfile.protectionLevel', operator: 'IN', value: ['HIGH', 'VERY_HIGH'], result: 'REQUIRED', priority: 25 },
      { field: 'companyProfile.size', operator: 'IN', value: ['LARGE', 'ENTERPRISE'], result: 'RECOMMENDED', priority: 10 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['EDR-Konfiguration', 'Bedrohungsberichte', 'Incident-Response-Statistiken'],
    reviewFrequency: 'QUARTERLY',
    priority: 'HIGH',
    complexity: 'HIGH',
    tags: ['endpoint', 'edr', 'threat-detection'],
  },

  // ACCESS_AUTHORIZATION
  {
    id: 'TOM-AZ-01',
    code: 'TOM-AZ-01',
    category: 'ACCESS_AUTHORIZATION',
    type: 'TECHNICAL',
    name: { de: 'Rollenbasierte Zugriffskontrolle (RBAC)', en: 'Role-Based Access Control (RBAC)' },
    description: {
      de: 'Implementierung eines rollenbasierten Berechtigungssystems zur Steuerung des Datenzugriffs nach dem Need-to-Know-Prinzip.',
      en: 'Implementation of a role-based permission system to control data access according to the need-to-know principle.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.9.2.3' },
      { framework: 'BSI_IT_GRUNDSCHUTZ', reference: 'ORP.4' },
    ],
    applicabilityConditions: [],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['Berechtigungskonzept', 'Rollenmatrix', 'Berechtigungsaudits'],
    reviewFrequency: 'SEMI_ANNUAL',
    priority: 'CRITICAL',
    complexity: 'MEDIUM',
    tags: ['authorization', 'rbac', 'access'],
  },
  {
    id: 'TOM-AZ-02',
    code: 'TOM-AZ-02',
    category: 'ACCESS_AUTHORIZATION',
    type: 'ORGANIZATIONAL',
    name: { de: 'Berechtigungsverwaltungsprozess', en: 'Authorization Management Process' },
    description: {
      de: 'Dokumentierter Prozess für Beantragung, Genehmigung und Entzug von Zugriffsberechtigungen.',
      en: 'Documented process for requesting, approving and revoking access permissions.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.9.2.2' },
    ],
    applicabilityConditions: [],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['Berechtigungsanträge', 'Genehmigungsprotokolle', 'Prozessdokumentation'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'LOW',
    tags: ['authorization', 'process'],
  },
  {
    id: 'TOM-AZ-03',
    code: 'TOM-AZ-03',
    category: 'ACCESS_AUTHORIZATION',
    type: 'TECHNICAL',
    name: { de: 'Privileged Access Management (PAM)', en: 'Privileged Access Management (PAM)' },
    description: {
      de: 'Spezielle Kontrollen für privilegierte Konten (Admins) mit Aufzeichnung, zeitlicher Begrenzung und Genehmigungsworkflows.',
      en: 'Special controls for privileged accounts (admins) with recording, time limits and approval workflows.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.9.2.3' },
    ],
    applicabilityConditions: [
      { field: 'riskProfile.protectionLevel', operator: 'IN', value: ['HIGH', 'VERY_HIGH'], result: 'REQUIRED', priority: 20 },
      { field: 'dataProfile.hasSpecialCategories', operator: 'EQUALS', value: true, result: 'REQUIRED', priority: 25 },
      { field: 'companyProfile.size', operator: 'IN', value: ['LARGE', 'ENTERPRISE'], result: 'RECOMMENDED', priority: 10 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['PAM-Konfiguration', 'Sitzungsaufzeichnungen', 'Audit-Logs'],
    reviewFrequency: 'QUARTERLY',
    priority: 'CRITICAL',
    complexity: 'HIGH',
    tags: ['authorization', 'pam', 'privileged'],
  },
  {
    id: 'TOM-AZ-04',
    code: 'TOM-AZ-04',
    category: 'ACCESS_AUTHORIZATION',
    type: 'ORGANIZATIONAL',
    name: { de: 'Regelmäßige Berechtigungsrezertifizierung', en: 'Regular Authorization Recertification' },
    description: {
      de: 'Periodische Überprüfung aller Zugriffsberechtigungen durch die jeweiligen Vorgesetzten.',
      en: 'Periodic review of all access permissions by respective supervisors.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. d' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.9.2.5' },
    ],
    applicabilityConditions: [],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['Rezertifizierungsprotokolle', 'Prozessdokumentation'],
    reviewFrequency: 'SEMI_ANNUAL',
    priority: 'HIGH',
    complexity: 'MEDIUM',
    tags: ['authorization', 'review'],
  },
  {
    id: 'TOM-AZ-05',
    code: 'TOM-AZ-05',
    category: 'ACCESS_AUTHORIZATION',
    type: 'TECHNICAL',
    name: { de: 'Datenklassifizierung und Label', en: 'Data Classification and Labeling' },
    description: {
      de: 'Technische Umsetzung einer Datenklassifizierung mit entsprechenden Zugriffssteuerungen.',
      en: 'Technical implementation of data classification with corresponding access controls.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.8.2' },
    ],
    applicabilityConditions: [
      { field: 'dataProfile.hasSpecialCategories', operator: 'EQUALS', value: true, result: 'REQUIRED', priority: 25 },
      { field: 'riskProfile.protectionLevel', operator: 'IN', value: ['HIGH', 'VERY_HIGH'], result: 'RECOMMENDED', priority: 15 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Klassifizierungsschema', 'Label-Konfiguration'],
    reviewFrequency: 'ANNUAL',
    priority: 'MEDIUM',
    complexity: 'HIGH',
    tags: ['classification', 'labeling'],
  },
  {
    id: 'TOM-AZ-06',
    code: 'TOM-AZ-06',
    category: 'ACCESS_AUTHORIZATION',
    type: 'TECHNICAL',
    name: { de: 'API-Zugriffskontrolle', en: 'API Access Control' },
    description: {
      de: 'Implementierung von Authentifizierungs- und Autorisierungsmechanismen fuer APIs (OAuth 2.0, API-Keys, Rate Limiting).',
      en: 'Implementation of authentication and authorization mechanisms for APIs (OAuth 2.0, API keys, rate limiting).',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.9.4.1' },
    ],
    applicabilityConditions: [
      { field: 'architectureProfile.hostingModel', operator: 'IN', value: ['PUBLIC_CLOUD', 'HYBRID'], result: 'REQUIRED', priority: 20 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['API-Security-Konzept', 'OAuth-Konfiguration', 'Rate-Limiting-Regeln'],
    reviewFrequency: 'QUARTERLY',
    priority: 'HIGH',
    complexity: 'MEDIUM',
    tags: ['authorization', 'api', 'oauth'],
  },
  {
    id: 'TOM-AZ-07',
    code: 'TOM-AZ-07',
    category: 'ACCESS_AUTHORIZATION',
    type: 'ORGANIZATIONAL',
    name: { de: 'Regelmaessiger Berechtigungsreview', en: 'Regular Permission Review' },
    description: {
      de: 'Systematische Ueberpruefung und Bereinigung von Zugriffsberechtigungen in regelmaessigen Abstaenden durch die jeweiligen Fachverantwortlichen.',
      en: 'Systematic review and cleanup of access permissions at regular intervals by the respective department heads.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. d' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.9.2.5' },
    ],
    applicabilityConditions: [],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['Review-Protokolle', 'Berechtigungsaenderungslog', 'Freigabedokumentation'],
    reviewFrequency: 'SEMI_ANNUAL',
    priority: 'HIGH',
    complexity: 'LOW',
    tags: ['authorization', 'review', 'permissions'],
  },
]
