audit-labs/gh-attest

 1-- Access-review facts are org-scoped and about a person or team, not a
 2-- repository, so the repo column can't identify them. `subject` holds the
 3-- entity the fact is about: a member login, or "team-slug:login" for team
 4-- membership.
 5ALTER TABLE snapshots ADD COLUMN subject TEXT;
 6
 7-- Polled access state uses its own resource names so it doesn't collide with
 8-- the webhook event trail (`member_access`, `team`), which records changes
 9-- rather than current state. These are inventory for access review, so they
10-- are informational rather than pass/fail.
11INSERT INTO control_mappings (resource, status, framework, control_id, posture, rationale) VALUES
12  ('org_member', NULL, 'soc2', 'CC6.2', 'informational', 'Organization access inventory — subject to periodic access review'),
13  ('org_member', NULL, 'iso27001', 'A.5.18', 'informational', 'Access rights inventory'),
14  ('team_member', NULL, 'soc2', 'CC6.3', 'informational', 'Team-based access inventory'),
15  ('team_member', NULL, 'iso27001', 'A.5.18', 'informational', 'Access rights inventory');