Governance & Compliance in NAEOS: Built-In Policy, Audit, and SSO

Enterprise software projects face a growing list of governance requirements: policy enforcement, audit trails, access control, and regulatory compliance. Most teams bolt these on after the fact.

NAEOS embeds governance into the pipeline itself. Policies are evaluated at every stage, every action is audited with tamper-proof chains, and SSO integrations work out of the box.

Policy System

NAEOS ships with five built-in policy rules that run during the validation stage:

Custom Rules

You can define project-specific rules in Go:

import "github.com/NAEOS-foundation/naeos/internal/governance/policy"

rules := []policy.Rule{
    {
        RuleID:    "require-testing",
        Condition: "exists:testing",
        Priority:  1,
        Action:    "block",
    },
}

Rules support condition operators like exists, not_empty, contains, gt, lt, and in — making it possible to encode almost any organizational policy.

RBAC: Role-Based Access Control

NAEOS includes a hierarchical RBAC system with three built-in roles:

RBAC supports parent chains (role inheritance) and deny rules (explicit override that wins over allow):

naeos auth create-role devops \
  --parents developer,viewer \
  --allow pipeline.run,spec.read \
  --deny spec.delete

Four compliance templates are available: auditor, soc2_auditor, gdpr_admin, and hipaa_admin.

Audit Trail

Every pipeline execution, policy evaluation, and artifact generation is logged. The audit system supports three backends:

Standard Auditor

Sequential JSON log with timestamps and action metadata.

Hashed Chain Auditor

Each entry includes SHA256(previous_hash + payload). This creates a tamper-evident chain:

auditor := audit.NewHashedFileAuditor("audit.log")
defer auditor.Close()

auditor.Log(audit.Entry{
    Action:    "pipeline.run",
    Entity:    "spec:blog-platform",
    Subject:   "user:deploy-bot",
    Metadata:  map[string]any{"status": "completed"},
})

Verify the chain at any time:

naeos audit verify --file audit.log

Encrypted Auditor

Entries are encrypted with AES-256-GCM before writing to disk. Decrypt for review:

auditor := audit.NewEncryptedFileAuditor("audit.enc", encryptionKey)
reader := auditor.NewDecryptedReader()

Cloud Export

Export audit logs to AWS S3, Google Cloud Storage, or Azure Blob Storage:

naeos compliance cloud-export \
  --provider aws \
  --bucket naeos-audit-logs \
  --region us-east-1

Compliance Frameworks

NAEOS provides built-in compliance evaluation for three major frameworks:

Generate a compliance report:

naeos compliance report --framework soc2 --output report.pdf
naeos compliance report --framework hipaa --format json

SSO Integration

NAEOS supports three enterprise SSO protocols:

Configure SSO via CLI:

naeos auth sso configure \
  --provider oidc \
  --issuer-url https://accounts.google.com \
  --client-id your-client-id \
  --client-secret your-client-secret

The SSO registry supports multiple providers simultaneously, so you can mix OIDC for employees with SAML for partners.

Governance in CI/CD

Integrate governance checks into your CI pipeline:

# .github/workflows/ci.yml
- name: Validate Spec
  run: naeos validate --input-file spec.yaml

- name: Lint Spec
  run: naeos lint --input-file spec.yaml

- name: Audit
  run: naeos audit --input-file spec.yaml --output audit-report.json

- name: Compliance Check
  run: naeos compliance verify --framework soc2

What’s Next

Governance in NAEOS is evolving toward fully automated compliance monitoring. Upcoming features include:

• Real-time policy violation alerts via webhook
• Automated evidence collection for SOC 2 and HIPAA audits
• Multi-environment policy profiles (stricter rules for production)

For complete documentation, see the Governance docs and Security policy.