feat(controls): B3 — categorize the rest of needs_tooling (architectural + RBAC) (#220)

2026-07-21 13:15:27 +00:00
parent 4ef257bfe2
commit a7ff36edf3
3 changed files with 43 additions and 10 deletions
@@ -47,6 +47,17 @@ pub const SURFACES: &[Surface] = &[
            "ratelimit",
        ],
    },
+    Surface {
+        control_id: "cra-ai-12", // Rollenbasierte Autorisierung (RBAC)
+        terms: &[
+            "authorize",
+            "permission",
+            "role",
+            "rbac",
+            "require_role",
+            "has_role",
+        ],
+    },
    Surface {
        control_id: "cra-ai-24", // Security-Logging
        terms: &["login", "authorize", "permission", "role", "admin", "audit"],
@@ -196,10 +207,11 @@ mod tests {

    #[test]
    fn surfaces_cover_the_absence_based_controls() {
-        assert_eq!(SURFACES.len(), 7);
+        assert_eq!(SURFACES.len(), 8);
        for id in [
            "cra-ai-6",
            "cra-ai-11",
+            "cra-ai-12",
            "cra-ai-24",
            "cra-ai-27",
            "cra-ai-28",