ISO/IEC 42001

inkog -path ./agents -output json \
  | jq '[.server_findings[] | select(.compliance_mapping.iso_42001_clauses) | {id: .pattern_id, iso: .compliance_mapping.iso_42001_clauses}]'

# Generate risk assessment report
inkog scan ./agents -output json > risk-assessment.json
 
# Extract risk summary
cat risk-assessment.json | jq '{
  total_risks: .all_findings | length,
  critical: [.all_findings[] | select(.severity == "CRITICAL")] | length,
  high: [.all_findings[] | select(.severity == "HIGH")] | length,
  risk_categories: [.all_findings[].pattern] | unique
}'

# Track objectives over time
inkog scan . -output json | jq '{
  date: now | strftime("%Y-%m-%d"),
  critical_count: .critical_count,
  high_count: .high_count,
  files_scanned: .files_scanned,
  compliant: (.critical_count == 0)
}' >> objectives-tracking.jsonl

# Inkog detects unvalidated inputs
# Finding: "User input directly in LLM prompt"
# Remediation: Implement input validation
 
def compliant_handler(user_input):
    validated = sanitize_input(user_input)
    validate_format(validated)
    return process_query(validated)

# Inkog detects unsafe output handling
# Finding: "LLM output used without validation"
# Remediation: Validate before use
 
def compliant_output_handler(llm_response):
    parsed = parse_response(llm_response)
    validated = validate_output_schema(parsed)
    sanitized = sanitize_for_display(validated)
    return sanitized

# GitHub Actions for continuous monitoring
name: ISO 42001 Compliance Scan
 
on:
  schedule:
    - cron: '0 0 * * *'  # Daily
  push:
    branches: [main]
 
jobs:
  compliance-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Run Inkog Scan
        run: |
          npx -y @inkog-io/cli scan . -output json > compliance-report.json
 
      - name: Check Compliance
        run: |
          CRITICAL=$(jq '[.server_findings[] | select(.severity == "CRITICAL")] | length' compliance-report.json)
          if [ "$CRITICAL" -gt 0 ]; then
            echo "Non-compliant: $CRITICAL critical findings"
            exit 1
          fi
          echo "Compliant: No critical findings"
 
      - name: Archive Evidence
        uses: actions/upload-artifact@v4
        with:
          name: iso42001-evidence-${{ github.run_number }}
          path: compliance-report.json

# Track improvement over releases
for version in v1.0 v1.1 v1.2; do
  git checkout $version
  inkog scan . -output json | jq "{
    version: \"$version\",
    total: .findings_count,
    critical: .critical_count,
    high: .high_count
  }"
done | jq -s '.'

[
  {"version": "v1.0", "total": 15, "critical": 3, "high": 5},
  {"version": "v1.1", "total": 8, "critical": 1, "high": 3},
  {"version": "v1.2", "total": 4, "critical": 0, "high": 2}
]

# Generate scan results
inkog -path ./agents -output json > scan-results.json
 
# View summary
cat scan-results.json | jq '{
  files_scanned: .files_scanned,
  findings_count: .findings_count,
  critical_count: .critical_count,
  high_count: .high_count
}'