azure-audit

Secure, local-first Azure audit framework operated from OpenCode TUI.

Engineers clone this repository, open it in OpenCode, and run a small set of repo-local slash commands. The framework collects read-only Azure evidence, generates traceable findings, and produces governance artifacts that management and customer stakeholders can review with confidence.

Supported Operating Model

1. This framework is operated from OpenCode TUI.
2. Repo-local slash commands are the primary interface.
3. Underlying scripts and schemas are implementation detail, not the operator workflow.

Quick Start In OpenCode TUI

1. /prepare What it does: checks workstation and repository readiness for an audit run. What it produces: a readiness summary with blockers and the next recommended commands. Details: docs/setup.md and docs/operator-flow.md

Typical first use: start here immediately after opening the repository in OpenCode.

2. /authenticate /subscriptions/<subscription-id> What it does: verifies Azure authentication context and confirms the target scope is readable. What it produces: a preflight-style readiness result for live audit execution. Example: /authenticate /subscriptions/11111111-2222-3333-4444-555555555555 Use this when you want to confirm the current Azure account can safely read the exact subscription you plan to audit. Details: docs/operator-flow.md, docs/onboarding-wizard.md, and docs/onboarding-manual-portal.md

Typical first live audit: run this after /prepare and before any live collection.

3. /framework-pack install dutch sme What it does: selects a framework pack such as Dutch SME, enterprise, or healthcare. What it produces: installed framework-pack metadata used by governance outputs. Details: docs/operator-flow.md and docs/governance-evidence.md

Typical first selection: start with the Dutch SME pack unless you already know you need the enterprise or healthcare variant.

4. /audit /subscriptions/<subscription-id> What it does: runs the audit workflow, collects evidence, generates findings, and writes governance outputs. What it produces: run artifacts under reports/runs and governance artifacts under reports/governance Example: /audit /subscriptions/11111111-2222-3333-4444-555555555555 Use this after /authenticate succeeds for the same scope. Details: docs/evidence-collection.md, docs/governance-evidence.md, and docs/operator-flow.md

Typical first live run: use the exact same scope you authenticated in step 2.

5. /audit fixture What it does: runs the same workflow against repository fixtures so the operator can learn the flow safely before using live Azure scope. What it produces: fixture-backed evidence, findings, and governance artifacts. Details: docs/evidence-collection.md

Typical first dry run: use this before touching a customer subscription.

Default Audit Baseline

Before any framework pack is installed, the repository already audits against a built-in baseline.

This core baseline is intended to give operators a usable default for Azure posture review and to give management a consistent minimum trust model across all runs.

The default baseline covers:

1. Microsoft Well-Architected Framework What it is used for: findings are mapped into the core WAF pillars so results can be grouped into security, reliability, cost optimization, operational excellence, and performance efficiency themes. Details: docs/waf-mapping-contract.md

2. CIS Azure-aligned hardening references What it is used for: the framework uses CIS Azure benchmark-aligned references in its security posture interpretation so configuration gaps can be discussed against a recognizable hardening baseline. Details: docs/security-architecture.md

3. SOC 2-oriented governance evidence indexing What it is used for: governance bundles index checks and artifacts in a way that supports control-review conversations with management, customers, and auditors. Details: docs/governance-evidence.md and docs/governance-model.md

4. Read-only and provenance controls What it is used for: every run is grounded in least-privilege access, deterministic evidence records, integrity hashes, and report provenance so outputs can be reviewed and challenged. Details: docs/identity-safety-controls.md, docs/evidence-traceability.md, and docs/report-provenance.md

Use this baseline when you want a solid default Azure audit without adding market- or sector-specific framework packs.

Installable Packs

Framework packs are installable control bundles for the initial target market.

Pack command	Audience	Coverage focus	Target geography
/framework-pack install dutch sme	Dutch SME operators and suppliers	WAF, GDPR, ISO 27001, NIS2, CIS Azure	Netherlands / Dutch SME market
/framework-pack install dutch enterprise	Enterprise suppliers and internal platform teams	WAF, GDPR, ISO 27001, ISO 27017, ISO 27018, NIS2, CIS Azure	Netherlands / Dutch enterprise market
/framework-pack install dutch healthcare	Healthcare providers and processors	WAF, GDPR, ISO 27001, ISO 27701, NEN 7510, CIS Azure	Netherlands / Dutch healthcare market

Use /framework-pack list to see the available choices from inside OpenCode.

Other Installables

Framework packs are not the only reusable installable assets in this repository.

Other installable components include:

1. Cloud platform modules such as Azure and AWS overlays
2. Local-app platform modules for frontend/API workflows
3. Additive frontend and backend overlays for implementation guidance

See docs/module-catalog.md for the full installable module and overlay catalog.

What The Framework Produces

1. Evidence records and run manifests under reports/runs
2. Onboarding provisioning and verification artifacts under reports/onboarding
3. Governance evidence bundles under reports/governance
4. Platform quality status described in docs/platform-quality-scorecard.md
5. Report manifests for integrity and provenance review

Why Management Can Trust It

1. It is local-first. OpenCode with local Ollama models is the standard operating path, so the framework does not depend on external AI SaaS for core analysis.

2. It is read-only by design. The audit identity is least-privilege and intended for evidence collection, not remediation.

3. It is evidence-backed. Findings are tied to deterministic evidence records and run manifests with integrity hashes.

4. It is reviewable. Governance bundles and report provenance artifacts make it easier to inspect what was checked, what was produced, and what release generated it.

5. It keeps humans in charge. AI assists analysis and synthesis, but final interpretation and remediation decisions remain with human reviewers.

See docs/security-architecture.md, docs/identity-safety-controls.md, and docs/report-provenance.md.

Framework Coverage

Included by default:

1. Microsoft Well-Architected Framework mapping for findings
2. SOC 2-oriented control evidence indexing in governance bundles
3. CIS Azure benchmark-aligned security references

Installable framework packs can add or emphasize Dutch market control sets such as WAF, GDPR, ISO 27001, ISO 27017, ISO 27018, ISO 27701, NIS2, NEN 7510, and related overlays.

Operator Documentation

1. docs/setup.md
2. docs/operator-flow.md
3. docs/onboarding-wizard.md
4. docs/onboarding-manual-portal.md
5. docs/customer-onboarding-checklist.md
6. docs/evidence-collection.md
7. docs/evidence-traceability.md
8. docs/governance-evidence.md
9. docs/report-provenance.md
10. docs/security-architecture.md
11. docs/azure-audit-scope.md

Maintainer Documentation

1. docs/workflow.md
2. docs/navigation-by-goal.md
3. docs/azure-audit-implementation-plan.md
4. AGENTS.md