Compliance & Policy Engine

Relevant source files

The following files were used as context for generating this wiki page:

• compliance/mapping.py
• compliance/templates/base.py
• core/policy.py
• apps/api/policies_router.py
• fixops-enterprise/src/services/mitre_compliance_analyzer.py
• compliance/templates/owasp.py
• fixops-enterprise/src/services/advanced_pentest_engine.py
• CLI_API_INVENTORY.md
• samples/api-examples/demo-scenarios/automation/yaml-playbooks.json
• tests/e2e/comprehensive_e2e_test.py

The Compliance & Policy Engine is a core component of the Fixops platform designed to automate the governance, risk assessment, and regulatory alignment of security findings. It provides a structured framework for defining security guardrails and mapping technical vulnerabilities to industry-standard compliance frameworks such as SOC2, PCI-DSS, and OWASP Top 10. By integrating business context with technical scan data, the engine enables automated decision-making—allowing, blocking, or deferring deployments based on predefined organizational policies.

The engine operates by ingesting normalized findings from various security tools, applying specialized compliance templates, and executing logic-based policies. This ensures that security teams can maintain continuous compliance throughout the software development life cycle (SDLC) while reducing manual review overhead through AI-powered consensus and automated remediation playbooks.

Architecture and Core Components

The Compliance & Policy Engine is architected as a multi-layered system that processes security data through ingestion, normalization, enrichment, and finally, policy evaluation.

Component Interaction Flow

This diagram illustrates the high-level data flow where technical scan results are combined with business context and threat intelligence to drive policy decisions and compliance reporting.
Sources: CLI_API_INVENTORY.md, fixops-enterprise/src/services/advanced_pentest_engine.py:1050-1085, samples/api-examples/demo-scenarios/automation/yaml-playbooks.json

Key Components

• Policy Evaluator (core/policy.py): The logic center that evaluates findings against registered policies. It supports different policy types such as guardrail and compliance.
• Compliance Templates (compliance/templates/): Pre-built rule sets for frameworks. For example, OWASPTemplate assesses findings against the OWASP Top 10 categories (A01-A10) using CWE ID mapping.
• Compliance Mapping Engine: Dynamically assigns findings to regulatory frameworks based on severity and technical characteristics (e.g., mapping authentication-related findings to HIPAA or GDPR).
• API Router (apps/api/policies_router.py): Provides endpoints for creating, listing, and evaluating policies programmatically.

Sources: compliance/templates/owasp.py:15-165, CLI_API_INVENTORY.md, tests/e2e/comprehensive_e2e_test.py:750-800

Policy Management and Evaluation

Policies are defined as JSON or YAML structures that specify conditions and actions. They allow organizations to define automated "Go/No-Go" decisions for CI/CD pipelines.

Policy Structure and Types

Policies generally fall into two categories:

1. Guardrails: Focus on immediate enforcement (e.g., blocking any critical vulnerability in a production environment).
2. Compliance: Focus on governance and audit requirements (e.g., requiring a manual review for high-severity findings).

Policy Attribute	Description	Example Value
name	Unique identifier for the policy	critical-vuln-block
policy_type	Category of enforcement	guardrail, compliance
rules.condition	Logical expression for evaluation	severity == 'critical'
rules.action	Action taken on match	block, review, alert

Sources: tests/e2e/comprehensive_e2e_test.py:750-800, samples/api-examples/demo-scenarios/automation/yaml-playbooks.json

Automated Evaluation Sequence

The engine provides a direct feedback loop to CI/CD systems, where the outcome of a policy evaluation determines the pipeline's exit status.
Sources: CLI_API_INVENTORY.md, tests/e2e/comprehensive_e2e_test.py:35-50

Compliance Framework Support

The engine includes specialized logic to map technical vulnerabilities to various regulatory and industry frameworks.

Supported Frameworks

The WorldClassPenTestEngine automatically generates mappings for the following:

• PCI-DSS: Mapped based on critical/high severity findings.
• SOC2: Governance alignment for infrastructure and application findings.
• HIPAA & GDPR: Targeted mapping for findings involving "auth" or "credential" keywords.
• NIST 800-53 & ISO 27001: General security control alignment.
• MITRE ATT&CK: Mapping findings to specific adversary techniques (e.g., T1190 for Exploit Public-Facing Application).

Sources: fixops-enterprise/src/services/advanced_pentest_engine.py:1050-1085, samples/api-examples/demo-scenarios/automation/yaml-playbooks.json

OWASP Top 10 Assessment

The OWASPTemplate implements specific logic to calculate a compliance score by checking findings against the 10 standard categories.

# Example of OWASP Category Mapping
OWASPRule(
    id="OWASP-A03",
    name="Injection",
    severity="critical",
    owasp_category="A03",
    cwe_ids=["CWE-89", "CWE-78", "CWE-79", "CWE-91"],
    checks=[
        "Verify SQL injection prevention (parameterized queries)",
        "Verify command injection prevention"
    ],
)

Sources: compliance/templates/owasp.py:50-65

Policy Automation and Playbooks

Fixops uses YAML-based playbooks to automate responses to compliance violations or detected vulnerabilities.

Pre-approved Actions

The engine supports over 25 automated actions, including:

• create_jira_ticket: Generate tracking issues for remediation.
• send_slack_notification: Alert security teams in real-time.
• update_deployment_gate: Dynamically block or allow releases.
• export_evidence_bundle: Create signed RSA-SHA256 evidence for auditors.

Sources: samples/api-examples/demo-scenarios/automation/yaml-playbooks.json

Example: Critical Vulnerability Response

A playbook can be triggered when a vulnerability exceeds a CVSS score of 9.0. It orchestrates a P1 Jira ticket creation, a Slack alert, and an immediate block on the deployment gate for the affected application.
Sources: samples/api-examples/demo-scenarios/automation/yaml-playbooks.json

API and CLI Interface

The engine is accessible via both a REST API and a CLI for local validation or pipeline integration.

Policy API Endpoints

Method	Endpoint	Description
GET	/api/v1/policies	List all registered policies.
POST	/api/v1/policies	Create a new security policy.
POST	/api/v1/policies/{id}/evaluate	Evaluate specific finding against a policy.
GET	/api/v1/audit/compliance/frameworks	List supported frameworks.

Sources: CLI_API_INVENTORY.md, apps/api/policies_router.py

CLI Commands

• python -m core.cli run --enable compliance: Executes the pipeline with compliance mapping enabled.
• python -m core.cli make-decision: Runs the engine and returns an exit code based on policy results.

Sources: CLI_API_INVENTORY.md

The Compliance & Policy Engine serves as the critical bridge between technical security findings and organizational risk tolerance. By providing automated mapping to frameworks and enforceable policy gates, it enables "Compliance as Code," ensuring that every deployment adheres to the security standards defined by the business. Over time, the engine's feedback loop and AI-powered consensus mechanisms refine these decisions, reducing false positives and accelerating remediation through automated playbooks.