# yaml-language-server: $schema=../.claude/skills/compliance-swarm/.compliance/config.schema.yml

# Bootstrap config for Accounted itself. Threshold starts at "critical" so the
# advisory PR check warns loudly without blocking merges. Tighten to "high"
# once findings are triaged and suppressions are in place.

enabled_skills:
  - oss-license-compliance
  - owasp-asvs-v5-compliance
  - iso-27001-2022-compliance
  - soc2-cicd-compliance
  - gdpr-cicd-compliance

asvs_level: L2
soc2_categories: [security, confidentiality]
severity_threshold_to_block: critical
llm_provider: bedrock
llm_model: eu.anthropic.claude-sonnet-5

# Add suppressions here as triage progresses. Each rule needs a justification
# and (for ISO/SOC 2 controls) a risk_id pointing at a Risk Register entry.
suppressions: []