name = "soc2-context"
version = "0.1.0"
description = "SOC 2 TSC alignment for the context-pipeline slice: CC6.1 access restriction, CC6.6 boundary protection, C1.1 confidentiality redaction (mapping: compliance/mappings/soc2.toml)"
extends = "strict-redaction"

[context]
max_context_tokens = 16000
# Evidence window for a typical Type II reporting period.
audit_retention_days = 365
# CC6.6: external-boundary tools denied; path jail covers the read side.
deny_tools = ["ctx_url_read"]

[redaction]
# C1.1: confidential information beyond credentials — personal and
# financial identifiers commonly present in customer-data codebases.
date_of_birth = '(?i)\b(dob|date[ _-]?of[ _-]?birth)\b[ :=#]*\d{1,4}[-/.]\d{1,2}[-/.]\d{1,4}'
national_id = '\b\d{3}-\d{2}-\d{4}\b'
iban = '\b[A-Z]{2}\d{2}[A-Z0-9]{11,30}\b'
payment_card = '\b\d{4}[ -]?\d{4}[ -]?\d{4}[ -]?\d{1,7}\b'
