Compliance reference — SOC 2 scope, RBAC, audit trail, SBOM, signing, retention.

RBAC block — .driftlock/config.yaml snippet

The block below is the canonical RBAC surface a platform team commits to their chart repo. The matrix above is the same data, declared oracle- side and enforced at the watcher / signing-controller tier. Copy it, set the role members, commit it to the chart repo, hand the diff to your compliance alongside the audit-trail retention window.

# .driftlock/config.yaml — RBAC surface the platform team owns.
# The matrix below locks down: admin grants every high-risk action,
# security-reviewer gets read + sign-off only, operator gets helm + knob
# diffs only, and bots / workloads are scoped to the action they were
# written for. Every deny is hard — no implicit allow.
rbac:
  version: 1
  roles:
    - id: role-admin
      identity: human
      members:
        - github:acme/platform-team
        - email:platform@acme.example
    - id: role-security-reviewer
      identity: human
      members:
        - github:acme/security-team
        - email:security@acme.example
    - id: role-operator
      identity: human
      members:
        - github:acme/sre-on-call
    - id: role-watcher-bot
      identity: automation
      members:
        - spiffe:spiffe://acme.example/ns/driftlock/sa/watcher
    - id: role-sandbox-runner
      identity: workload
      members:
        - spiffe:spiffe://acme.example/ns/driftlock/sa/sandbox-runner
    - id: role-signing-controller
      identity: workload
      members:
        - spiffe:spiffe://acme.example/ns/driftlock/sa/signing-controller

  grants:
    - role: role-admin
      actions: [chart.install, chart.upgrade, kms.rotate, rbac.set,
                egress.set, retention.set, sign.commit,
                approver.signoff, audit.read, sbom.read, sbom.emit]
      approval: none
    - role: role-security-reviewer
      actions: [audit.read, sbom.read, approver.signoff]
      approval: none
    - role: role-operator
      actions: [chart.install, chart.upgrade, egress.set,
                retention.set, approver.signoff, audit.read, sbom.read]
      approval: dual      # two-person rule — two operators sign
    - role: role-watcher-bot
      actions: [audit.read, sbom.read]
      approval: none
    - role: role-sandbox-runner
      actions: [audit.read, sbom.read, sbom.emit]
      approval: none
    - role: role-signing-controller
      actions: [audit.read, sbom.read, sign.commit]
      approval: none

  deny_overrides:
    # Hard deny on the key-rotation path for every non-admin identity.
    - action: kms.rotate
      except_roles: [role-admin]
    # Bots / workloads cannot mutate anything they don't already own.
    - action: rbac.set
      except_roles: [role-admin]

Sample SPDX 2.3 JSON

The block below is the SPDX 2.3 document emitted for one merged PR. The documentNamespace carries the SBOM sha256 in its path; the package checksums array signs the head SHA off. Reader tooling diffs the SPDX sha256 against the sbom field on the audit-trail row.

{
  "SPDXID": "SPDXRef-DOCUMENT",
  "spdxVersion": "SPDX-2.3",
  "dataLicense": "CC0-1.0",
  "SPDXID": "SPDXRef-DOCUMENT",
  "name": "acme/checkout-svc",
  "documentNamespace": "https://registry.internal/acme/checkout-svc/spdx/3f6e…",
  "creationInfo": {
    "created": "2026-08-08T13:21:02Z",
    "creators": ["Tool: driftlock-sbom-emitter-vX.Y.Z",
                 "Organization: acme"]
  },
  "packages": [
    {
      "SPDXID": "SPDXRef-Package-acme-checkout-svc",
      "name": "acme/checkout-svc",
      "versionInfo": "8f6c1d5b9c2f",
      "supplier": "Organization: acme",
      "downloadLocation": "git+https://github.com/acme/checkout-svc",
      "checksums": [{
        "algorithm": "SHA256",
        "checksumValue": "8f6c1d5b9c2f6c1d5b9c2f6c1d5b9c2f6c1d5b9c"
      }],
      "externalRefs": [
        { "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:github/acme/checkout-svc@8f6c1d5b9c2f" }
      ]
    }
  ],
  "relationships": [
    { "spdxElementId": "SPDXRef-DOCUMENT",
      "relatedSpdxElement": "SPDXRef-Package-acme-checkout-svc",
      "relationshipType": "DESCRIBES" }
  ]
}