Compliance profiles (GY.C1)

A profile is a framework this install opts into: CMMC 2.0, FedRAMP-aligned Moderate, FedRAMP-aligned High / DoD IL5, ISO/IEC 27001, SOC 2, TPN, or privacy. MOD supports the controls a profile maps to; it never certifies, validates, or attests that an install meets a framework.

Profiles build on the declared environment (compliance.declared_environment, GY.C0). Declaring an environment records intent and lists the controls it needs; activating a profile goes further and locks the platform settings that profile requires.

What a profile locks

Each profile carries a map of required settings with the control id the entry supports (mapping data, not a claim). For example the cmmc profile requires, among others:

Setting	Requirement	Control it supports
auth.mfa_required_for_admins / auth.mfa_required_for_all	true	CMMC AC.L2-3.1.8
auth.sso_session_idle_seconds	≤ 900	NIST AC-12
auth.sso_session_max_lifetime_seconds	≤ 28800	NIST AC-12
auth.login_banner_text	non-empty	NIST AC-8
egress.sealed_mode	true	NIST SC-7
labels.block_external_llm	true	NIST AC-3
access_review.schedule_enabled	true	NIST AC-2

The full map (7 profiles, all control ids) lives in CORE/API/services/compliance_profiles.py (PROFILE_REQUIRED_SETTINGS) and is rendered live by GET /v1/platform/compliance/profiles.

Locks (paid editions)

With a profile active, the single platform-settings write path (PATCH/DELETE /v1/platform/settings/{key}) refuses a write that weakens a required setting:

• Weakening (e.g. turning auth.mfa_required_for_all off while cmmc is active) → 409 with {"setting", "profile", "required"} and a compliance_profile_lock_rejected audit row. The value is not changed.
• Strengthening (e.g. tightening the idle timeout below the required bound) → always allowed.
• Reverting a locked setting to a weaker env/default → 409 the same way.

On the CE (open-source) edition nothing is enforced: profiles are a needs list only. The same routes report per-profile pass/fail either way; enforced in the response says which mode you are in.

API (platform admin; auditor read)

All under /v1/platform/compliance/. Reads are open to a platform admin or a time-boxed auditor (GY.C16); writes are platform-admin only.

• GET /profiles — active + available profiles; per profile each required setting with its current value and pass/fail.
• PUT /profiles — set the active list ({"profiles": ["cmmc", "iso27001"]}). Never auto-changes a setting: the response lists the settings currently weaker than required (weaker_settings) so you (or the upgrade-time preview→apply flow) apply them explicitly through the normal audited write path.
• GET /status — the check summary: active profiles, total/passing checks, and the settings currently weaker than required.

Working with a lock

1. GET /v1/platform/compliance/profiles — see which settings fail (pass: false) for each active profile.
2. Apply the required values (they strengthen, so they are never refused).
3. To deactivate a profile, PUT /v1/platform/compliance/profiles without it. Locks lift immediately; settings keep their current values — nothing is silently weakened.