feat(controls): B3 — categorize the rest of needs_tooling (architectural + RBAC) #220

2026-07-21T12:51:04Z

sharang commented

2026-07-21 12:51:04 +00:00

Final slice of B — categorizes the remaining needs_tooling CRA controls so the whole 16-control bucket is accounted for.

cra-ai-2,3,4,5 (minimal attack surface, secure architecture, least-privilege, tamper protection) are design properties, not local code patterns → not_code_checkable (out of static-scan scope), each with a reviewer note.
cra-ai-12 (RBAC) is surface-checkable (authorization points) → added to the grounded surface pass; this was the one control the hybrid split had missed.

Final CRA coverage: covered 13 · needs_tooling 8 (all grounded-covered, gated) · not_code_checkable 19.

The 16 originally-needs_tooling controls are now fully categorized:
4 custom-semgrep (B1) + 8 grounded surface (B2/B3, gated) + 4 architectural (B3).

Green locally (clippy -D warnings, fmt, full suite; control-map 7→9 tests locking in the split).

🤖 Generated with Claude Code

Final slice of **B** — categorizes the remaining `needs_tooling` CRA controls so the whole 16-control bucket is accounted for. - **cra-ai-2,3,4,5** (minimal attack surface, secure architecture, least-privilege, tamper protection) are design properties, not local code patterns → **not_code_checkable** (out of static-scan scope), each with a reviewer note. - **cra-ai-12** (RBAC) is surface-checkable (authorization points) → added to the **grounded surface pass**; this was the one control the hybrid split had missed. **Final CRA coverage:** covered **13** · needs_tooling **8** (all grounded-covered, gated) · not_code_checkable **19**. The 16 originally-`needs_tooling` controls are now fully categorized: **4** custom-semgrep (B1) + **8** grounded surface (B2/B3, gated) + **4** architectural (B3). Green locally (clippy -D warnings, fmt, full suite; control-map 7→9 tests locking in the split). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

sharang added 1 commit 2026-07-21 12:51:04 +00:00

feat(controls): B3 — categorize the rest of needs_tooling (architectural + RBAC)

CI / Check (push) Skipped

CI / Check (pull_request) Successful in 5m41s

Details

CI / Detect Changes (pull_request) Skipped

Details

CI / Deploy Agent (pull_request) Skipped

Details

CI / Deploy Dashboard (pull_request) Skipped

Details

CI / Deploy Docs (pull_request) Skipped

Details

CI / Deploy MCP (pull_request) Skipped

Details

7cd4ffdaab

Closes out B's coverage of the 16 needs_tooling CRA controls:

- cra-ai-2,3,4,5 (minimal attack surface, secure architecture, least-privilege,
  tamper protection) are design properties, not local code patterns -> marked
  not_code_checkable (out of static-scan scope) with reviewer notes.
- cra-ai-12 (RBAC) is surface-checkable (authorization points) -> added to the
  grounded surface pass; note points to the gated grounded mechanism.

Final CRA coverage: covered 13 | needs_tooling 8 (all grounded-covered, gated) |
not_code_checkable 19. The 16 needs_tooling now fully categorized:
4 custom-semgrep (B1) + 8 grounded surface (B2/B3, gated) + 4 architectural (B3).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sharang merged commit a7ff36edf3 into main

2026-07-21 13:15:27 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#220