# Stave


## search

- [Search the documentation](/search.md)

## docs

- [Documentation](/docs.md): Get Started
- [Explanation](/docs/explanation.md)
- [Air-Gapped Operation](/docs/explanation/air-gapped-analysis.md): What runs offline in Stave, what still needs network access, and recommended deployment patterns.
- [Architecture](/docs/explanation/architecture.md): The four-layer model and how it was discovered.
- [Blast Radius](/docs/explanation/blast-radius.md): Blast radius measures how far damage spreads when a control fails. A
- [Chain Discovery Architecture](/docs/explanation/chain-discovery-architecture.md): Overview
- [Compound Chains](/docs/explanation/compound-chains.md): Why compound risk exists and why chains are separate from controls.
- [Controls](/docs/explanation/controls-as-code.md): What controls are, how they differ from rules, and how Stave evaluates them.
- [Counterfactual Analysis Reports](/docs/explanation/counterfactual-analysis.md): Counterfactual analysis answers whether a given control would have prevented a past breach, turning post-incident review into evidence-based control prioritization.
- [Data Exfiltration Path](/docs/explanation/data-exfiltration.md): Data exfiltration path analysis answers: "How can data get out?"
- [Data Flow and I/O](/docs/explanation/data-flow.md): Per-command I/O model, permission policy, and overwrite protection.
- [Data Sovereignty](/docs/explanation/data-sovereignty.md): Data sovereignty analysis answers: "Is your data physically in the
- [Design Philosophy](/docs/explanation/design-philosophy.md): Stave is designed around open standards from the first release so teams can adopt it without platform lock-in.
- [Differentiation](/docs/explanation/differentiation.md): Stave is a static analysis tool that evaluates cloud infrastructure configurations against system invariants using CEL predicates and exports standardized facts (JSONL triples, SMT-LIB v2) for consumption by external reasoning engines. It operates on air-gapped snapshots with no cloud credentials, no API calls, and no network access.
- [Drift Detection](/docs/explanation/drift-detection.md): Drift detection answers the CISO's Tuesday question: "We were safe
- [Entitlement Entropy — Shadow Admin Finder](/docs/explanation/entitlement-entropy.md): Entitlement entropy detects privilege creep — the structural condition
- [Evidence Bundling](/docs/explanation/evidence-bundling.md): Evidence bundling answers: "How do I get compliance evidence out
- [Evidence-Driven Design](/docs/explanation/evidence-driven-design.md): Why every abstraction in Stave traces to real incident data.
- [Execution Safety](/docs/explanation/execution-safety.md): Stave's guarantees against dynamic code execution.
- [FAQ](/docs/explanation/faq.md): Frequently asked questions about Stave's approach, terminology, and how it differs from existing tools.
- [Files as the language boundary](/docs/explanation/files-as-the-boundary.md): Why Stave evaluates with CEL and exports facts to external reasoning engines through files on disk — not subprocess calls, not plug-ins. The architectural choice that makes the multi-engine surface tractable.
- [Security Guarantees](/docs/explanation/guarantees.md): Stave's compile-time and runtime security guarantees: offline operation, no credentials, determinism, no code execution, filesystem safety, sanitization, and supply-chain integrity.
- [How Stave Works](/docs/explanation/how-stave-works.md): Data flow through the Stave evaluation engine — inputs, schema validation, evaluation, and structured output.
- [Identity Blast Radius](/docs/explanation/identity-blast-radius.md): Why identity blast radius measures the damage surface of a single compromised credential, and how it differs from control-level blast radius.
- [KMS Concentration Risk](/docs/explanation/kms-concentration.md): KMS concentration risk answers: "If this one encryption key is
- [Lab Results](/docs/explanation/lab-results.md): Verified detection rates across four vendor lab suites — with links to detailed tutorials.
- [Why the Logic Trace Exists](/docs/explanation/logic-trace.md): The problem with black-box verdicts
- [Posture Score](/docs/explanation/posture-score.md): What the 0-100 score measures, how it is computed, and what it does not tell you.
- [Posture Trending](/docs/explanation/posture-trending.md): stave trend reads historical assessment output files and computes
- [The Reasoning Contract](/docs/explanation/reasoning-contract.md): Stave is the fact-producing substrate that any reasoning engine can target via a YAML spec format. Validated end-to-end with five independent paradigms (Z3, Soufflé, Clingo, Prolog, PRISM).
- [Recovery Isolation](/docs/explanation/recovery-isolation.md): Recovery isolation answers: "If your main account is compromised,
- [Release Integrity & Trust Model](/docs/explanation/release-security.md): How Stave releases are built, signed, and verified.
- [Secret Blast Radius](/docs/explanation/secret-blast-radius.md): Secret blast radius answers: "If this secret is compromised, how
- [Shadow Logic Detection](/docs/explanation/shadow-logic.md): Shadow logic detection answers: "Do your IAM policies accidentally
- [The Snapshot Model](/docs/explanation/snapshot-model.md): Why Stave evaluates local files rather than querying live cloud APIs.
- [Supply Chain Ingress](/docs/explanation/supply-chain-ingress.md): Supply chain ingress analysis answers: "Can an external CI/CD
- [System Invariants](/docs/explanation/system-invariants.md): What system invariants are, how they are expressed as code in Stave, and how they differ from OPA, IaC scanners, and CSPM tools.
- [Temporal Ghost Detection](/docs/explanation/temporal-ghost.md): Detect configuration references that were valid in a previous snapshot but invalid in the current one — deleted resources that leave dangling pointers.
- [Threat Model](/docs/explanation/threat-model.md): Stave's threat model: assets, trust boundaries, attacker profiles, controls, and residual risks.
- [Time Travel](/docs/explanation/time-travel.md): Why "evaluate, not guess" is the correct framing for security investigation.
- [Security and Trust](/docs/explanation/trust-and-security.md): Overview of Stave's security design and trust model.
- [Unauthenticated Reachability](/docs/explanation/unauthenticated-reachability.md): Unauthenticated reachability answers: "Can an anonymous principal
- [Vendor Trust Leash](/docs/explanation/vendor-trust-leash.md): Vendor trust leash analysis answers: "Which external companies can
- [Stave vs Scanners](/docs/explanation/vs-scanners.md): What scanners check versus what Stave checks — the trichotomy of cloud security tools.
- [Stave vs Vulnerable Labs](/docs/explanation/vs-vulnerable-labs.md): Attacker-centered labs versus defender-centered evaluation — and how they compose.
- [Z3 Question Catalogue](/docs/explanation/z3-question-catalogue.md): What kinds of cloud-security questions an SMT solver such as Z3 can answer, organised by attack stage. A starting point for tools that compose Stave's library API with libz3.
- [Stave and Z3](/docs/explanation/z3-solver.md): Stave's evaluator is in-process Google CEL. A small Go example under examples/ shows how to compose Stave's library API with libz3 to answer SAT/UNSAT questions. They are different shapes of analysis.
- [Getting Started](/docs/getting-started.md)
- [Add Stave to Your CI Pipeline](/docs/getting-started/add-to-ci.md): The finding you just fixed? Make sure it never comes back. A CI gate
- [What Stave Finds](/docs/getting-started/demo-output.md): Real stave apply output from a deliberately misconfigured AWS environment — compound chains, near-miss chains, and standard findings.
- [First Evaluation](/docs/getting-started/first-evaluation.md): Install Stave and run it against bundled demo data. No cloud credentials, no AWS account.
- [Time To First Finding](/docs/getting-started/first-finding.md): Run Stave against your own AWS environment. Pick the import path that matches what you already have.
- [Fix a Finding, Verify the Fix](/docs/getting-started/fix-and-verify.md): The remediation loop: explain → fix → re-snapshot → verify. Each
- [Installation](/docs/getting-started/installation.md): Install Stave in three progressive tiers. Tier 1 is the standalone Go binary; Tier 2 adds external reasoning engines; Tier 3 adds Neo4j visualisation.
- [Reading Chain Findings](/docs/getting-started/reading-chain-findings.md): Understand Stave's compound chain findings — what they mean, how to prioritize them, and how to break them.
- [Try Stave](/docs/getting-started/try-stave.md): Five ways to try Stave, from zero-install to full pipeline.
- [How-to Guides](/docs/how-to.md)
- [How to Run an IAM Security Assessment](/docs/how-to/assessments/iam-assessment.md): Evaluate AWS IAM configuration against 38 controls covering identity,
- [How to Evaluate Multi-Cloud Infrastructure](/docs/how-to/assessments/multi-cloud-evaluation.md): Stave evaluates any cloud provider and any service without engine changes.
- [How to Run an OpenSearch Security Assessment](/docs/how-to/assessments/opensearch-assessment.md): Evaluate AWS OpenSearch domain configuration against 12 controls
- [S3 Assessment Workflow](/docs/how-to/assessments/s3-assessment.md): This is the supported S3 MVP workflow for the current CLI surface.
- [End-to-End Template Testing](/docs/how-to/assessments/template-e2e-testing.md): Manual testing runbook for the template system. Run after implementing or modifying template commands.
- [How to Bisect a Violation](/docs/how-to/compliance/bisect-violation.md): Find the exact snapshot when a control first failed.
- [Compliance Workflow](/docs/how-to/compliance/compliance-workflow.md): End-to-end compliance workflow: discover what to collect, assess coverage gaps, evaluate against a compliance profile, and export evidence packages.
- [How to Verify an Evidence Archive](/docs/how-to/compliance/evidence-archive.md): Prove continuous monitoring over a compliance audit period.
- [HIPAA Compliance](/docs/how-to/compliance/hipaa-compliance.md): Evaluate S3 configurations against HIPAA Security Rule requirements using Stave's built-in HIPAA profile.
- [Contributing to Stave](/docs/how-to/contributing.md): Thank you for considering contributing to Stave. This document explains how to set up your development environment, run tests, and submit changes.
- [Authoring Controls](/docs/how-to/controls/control-authoring.md): How to write, test, and review custom Stave control definitions.
- [How to Create a Custom Compliance Profile](/docs/how-to/controls/custom-profile.md): Define your own compliance framework as a YAML file.
- [Enable the Z3 Solver](/docs/how-to/controls/enable-z3-solver.md): Install libz3 and use Z3 with Stave. The Stave binary itself is built CGO_ENABLED=0 and has no Z3 dependency; Z3 is opt-in per-machine for the example provers and the SMT-LIB file pipeline.
- [Enabling and Disabling Controls](/docs/how-to/controls/enabling-disabling-invariants.md): How to control exactly which controls Stave evaluates.
- [How to Scaffold Controls with the Policy Forge](/docs/how-to/controls/policy-forge.md): Create a new security control with validated YAML and pass/fail test
- [How to use a reasoning engine with Stave facts](/docs/how-to/controls/reasoning-engines.md): Pick the right external reasoning engine for the question you have, export Stave's facts in the format the engine consumes, append a query, and read the verdict back.
- [How to Test Controls](/docs/how-to/controls/test-controls.md): Run embedded test cases to verify control behavior.
- [Create Observation Snapshots](/docs/how-to/getting-started/create-snapshots.md): Step-by-step recipes for producing obs.v0.1 observation snapshots from a live AWS account, from Terraform, or by hand.
- [Import AWS Config Snapshots](/docs/how-to/getting-started/import-config-snapshots.md): Use existing AWS Config delivery data as Stave input — no new credentials or collectors needed.
- [Recipes](/docs/how-to/getting-started/recipes.md): Multi-command workflow recipes for common Stave tasks.
- [Templates](/docs/how-to/getting-started/templates.md): A template packages a complete security assessment workflow — which controls to evaluate, which compound chains to run, and how to report findings — into a single command. You pick the job, configure your environment, and run.
- [Verify a Release](/docs/how-to/getting-started/verify-release.md): Step-by-step guide to verify Stave release integrity using checksums, Cosign, and provenance.
- [Atlantis Post-Plan Integration](/docs/how-to/integration/atlantis-integration.md): Evaluate Terraform plans for safety violations before atlantis apply.
- [Breach-Type Routing with Evaluation Context](/docs/how-to/integration/breach-routing.md): How to use the --context flag to filter control evaluation based on incident breach type.
- [Task: Build a Stave Observation Extractor](/docs/how-to/integration/building-extractors.md): Most users don't need this. For common AWS resources, the built-in
- [Running in CI/CD](/docs/how-to/integration/ci-cd-integration.md): How to integrate Stave into GitHub Actions, GitLab CI, and Jenkins pipelines.
- [MCP Server Integration](/docs/how-to/integration/mcp-server.md): Connect an AI agent (Claude Code, Cursor) to Stave via stave-mcp.
- [How to Block Unsafe Configs with a Pre-Commit Hook](/docs/how-to/integration/pre-commit-hook.md): Prevent unsafe cloud configurations from being committed to version
- [SARIF and GitHub Code Scanning](/docs/how-to/integration/sarif-code-scanning.md): Stave outputs SARIF (Static Analysis Results Interchange Format),
- [Scheduled Operation](/docs/how-to/integration/scheduled-operation.md): Run Stave on a schedule: cron + snapshot capture + diff between consecutive runs.
- [Integrating with Security Workflows](/docs/how-to/integration/security-workflows.md): How to use Stave alongside other security tools and incident response processes.
- [Bug Reproduction Guide](/docs/how-to/maintenance/bug-reports.md): How to write a minimal, deterministic bug reproduction for Stave.
- [Contributing to Stave](/docs/how-to/maintenance/contributing.md): Thank you for considering contributing to Stave. This document explains how to set up your development environment, run tests, and submit changes.
- [Common Issues](/docs/how-to/maintenance/troubleshooting.md): Troubleshooting guide for common Stave errors and unexpected behavior.
- [How to Detect Regressions](/docs/how-to/results/detect-regression.md): Identify controls that fail repeatedly in a pattern.
- [How to Generate an Executive Report](/docs/how-to/results/executive-report.md): Produce a single document aggregating all assessment dimensions.
- [Fix Verification](/docs/how-to/results/fix-verification.md): Verify a remediation closed the finding: remediate, re-snapshot, diff, confirmed.
- [Resource Ignore Lists](/docs/how-to/results/ignore-lists.md): How to suppress findings for intentionally configured resources using ignore lists.
- [Interpreting Findings](/docs/how-to/results/interpreting-findings.md): How to read findings and execute deterministic remediation planning.
- [How to Debug Unexpected Findings with the Logic Trace](/docs/how-to/results/logic-trace-debugging.md): Use the logic trace when Stave produces a finding you don't expect — or
- [Retroactive Evaluation](/docs/how-to/results/retroactive-evaluation.md): Run new controls against old snapshots to answer: were we exposed to this in March?
- [Sanitization](/docs/how-to/results/sanitization.md): How to share Stave outputs safely using --sanitize.
- [How to Compare Infrastructure State Between Two Dates](/docs/how-to/results/time-travel-comparison.md): Evaluate security posture at two points in time and see what changed.
- [Labs](/docs/labs.md): Hands-on labs validating Stave controls against real AWS misconfigurations.
- [HackerOne Case Studies](/docs/labs/case-studies.md): 30 real HackerOne bug bounty reports reconstructed as reasoning challenges, grouped by attack pattern.
- [What you just discovered](/docs/labs/case-studies-debrief.md): What the S3 reasoning challenge reveals about the gap between scanning and reasoning.
- [Challenge Setup](/docs/labs/case-studies-setup.md): Download 4 JSON files and try to answer 5 questions about S3 security — no Stave, no AWS account.
- [The audit log that watched the front door while the side door stayed open](/docs/labs/case-studies/aws-3021451.md): A CloudTrail reads as fully configured, yet ElastiCache calls through a non-production endpoint generate no log entries at all.
- [The two side doors the audit log was never told about](/docs/labs/case-studies/aws-3022516.md): A correctly configured trail still misses Amazon Forecast calls made through two non-production endpoints the service never delivers to CloudTrail.
- [The upload policy with no destination it would refuse](/docs/labs/case-studies/bcm-764243.md): A presigned POST policy uses an empty starts-with prefix, so any key in the bucket is a legal upload target — can you prove the write scope is unrestricted from the policy alone?
- [The subdomain that pointed at a name anyone could take](/docs/labs/case-studies/bime-121461.md): Reasoning that a live DNS record plus a claimable bucket name is a takeover primitive, even while the page returns a harmless 404.
- [The repository nobody deleted from the install guide](/docs/labs/case-studies/brave-1791558.md): An APT repository bucket was deleted but the DNS name and the community install guide still point at it — can you prove the reference is claimable from the static evidence alone?
- [The install guide that points at a bucket anyone can claim](/docs/labs/case-studies/brave-1835133.md): A 404 today, a trojaned RPM repository tomorrow — can you tell that a harmless dangling reference is one registration away from supply-chain compromise?
- [The metadata door that opened for anyone who asked](/docs/labs/case-studies/dod-2083771.md): Reasoning that an exposed Jenkins console plus IMDSv1 forms a single credential-theft path, not two independent low findings.
- [The government domain pointing at a name up for grabs](/docs/labs/case-studies/dod-918946.md): Reasoning that a dangling .gov CNAME is a high-trust takeover primitive while it still serves a harmless 404.
- [Public read was fine — public listing leaked the whole catalog](/docs/labs/case-studies/greenhouse-819278.md): Marketing assets are public by design, but the same grant also exposes the full inventory — separating intended exposure from disclosure.
- [The widget script that's one bucket registration from XSS](/docs/labs/case-studies/hackerone-1598347.md): A deleted widget bucket plus a live <script> tag — can you see that claiming the name turns a dead reference into attacker JavaScript on the parent domain?
- [The bucket that shipped attachments in the clear](/docs/labs/case-studies/hackerone-43280.md): Both HTTP and HTTPS serve the same objects — can you prove, from the policy alone, that nothing is leaking on the wire?
- [The subdomain an acquisition left pointing at nothing](/docs/labs/case-studies/ibm-2498255.md): A subsidiary's DNS outlived its bucket after a merger — can you tell that an inherited 404 is a branded takeover waiting for someone to claim the name?
- [The website endpoint that would serve anyone's index.html](/docs/labs/case-studies/khanacademy-1777077.md): Reasoning that a dangling website-hosting CNAME is a seamless takeover-and-session-theft primitive while it still returns a 404.
- [The Ingress that rewrote a neighbor's firewall](/docs/labs/case-studies/kubernetes-1238482.md): A controller reconciles security groups from annotations it never checks for ownership — can you spot the cross-tenant write before it happens?
- [The cluster admin keyed to an identifier that isn't a secret](/docs/labs/case-studies/kubernetes-1580493.md): An EKS aws-auth mapping uses the AccessKeyID as the identity and hands it system:masters — turning a public string into full cluster admin.
- [The bucket named private whose objects were public](/docs/labs/case-studies/mapbox-202725.md): Bucket-level config looks locked down, but per-object ACLs make individual objects public — catching exposure the bucket settings hide.
- [The static site that published its own .git history](/docs/labs/case-studies/mozilla-2383486.md): A public bucket serves static content but also exposes a synced .git directory — distinguishing harmless public files from a source-code leak.
- [The payment-processor bucket with two front doors and a fix that only closed one](/docs/labs/case-studies/omise-1474017.md): A CDN origin bucket is opened by both an ACL and a policy — can you tell from the config that fixing one path leaves the other wide open?
- [The bucket labelled internal that handed out a table of contents](/docs/labs/case-studies/shopify-1021906.md): A production API bucket tagged internal grants the public both read and list — can you tell from the config what an attacker can enumerate?
- [The address that pointed at a chair nobody was sitting in](/docs/labs/case-studies/shopify-1295497.md): An EC2 instance was terminated and its Elastic IP released, but the DNS A record still points at the old address — can you prove the record is dangling from the static evidence alone?
- [The public bucket that also handed out its own index](/docs/labs/case-studies/shopify-57505.md): A bucket meant to serve images publicly also grants public listing — telling whether the extra permission is intentional or a leak.
- [The merchant upload that could rewrite any other merchant](/docs/labs/case-studies/shopify-93691.md): A presigned POST policy scopes uploads to a prefix shared by all merchants — can you prove one merchant can overwrite another's files from the policy alone?
- [The upload token that trusted the path it was handed](/docs/labs/case-studies/shopify-94087.md): A presigned URL scoped one prefix too wide lets one tenant write into another tenant's space — isolation that lives in a single Resource string.
- [The remediation that fixed listing and left write wide open](/docs/labs/case-studies/shopify-94502.md): A partial fix removed public listing but left public read and public write via ACL — judging whether remediation is actually complete.
- [The drop box anyone could fill and one stranger could read](/docs/labs/case-studies/shopify-98819.md): Anonymous write via ACL plus cross-account read via policy form a data-injection pipeline that neither setting reveals on its own.
- [The test builds that shipped their own secrets to the public internet](/docs/labs/case-studies/slack-404822.md): A public bucket policy paired with a Public Access Block that blocks nothing — can you tell from the config whether the toggle protects anything?
- [The install command pointing at a bucket someone else could fill](/docs/labs/case-studies/tendermint-1397826.md): Reasoning that a dangling release-bucket CNAME referenced by install docs is a supply-chain takeover primitive while it still returns a 404.
- [The bucket that called itself confidential and then served itself to everyone](/docs/labs/case-studies/uber-361438.md): A bucket tagged confidential carries a policy that grants the whole internet read access — can you prove the contradiction from the static config alone?
- [The upload door that opened onto everyone's room](/docs/labs/case-studies/unikrn-254200.md): A presigned upload policy restricts keys to a prefix shared by every tenant — can you prove the prefix breaks tenant isolation from the policy alone?
- [The chat images anyone could browse, one key at a time](/docs/labs/case-studies/zomato-507097.md): A bucket of user chat images is open by both ACL and policy, with listing on — can you tell from the config that the privacy harm comes from enumeration, not just read?
- [The Five Questions](/docs/labs/case-study-questions.md): Five questions about S3 security to answer from static configuration — before you see what Stave finds.
- [Discovering Attack Chains](/docs/labs/chain-discovery.md): This tutorial walks through running chain discovery on a
- [Cognito Unauthenticated S3 Takeover](/docs/labs/cognito-unauthenticated-s3-takeover.md): Detect a Cognito identity pool whose guest role can read and write S3, read the findings, then learn the single most important Stave concept: it evaluates a captured snapshot, so a live fix is invisible until you re-capture.
- [Generate Compliance Evidence](/docs/labs/compliance-evidence.md): Your auditor wants evidence. Stave produces it deterministically — the
- [Cross-Account KMS Key Policy & CMK Isolation](/docs/labs/cross-account-kms-key-policy-isolation.md): Detect a KMS key whose policy opens broad, unconditioned cross-account access — a wildcard principal and an excessive sharing blast radius. Read all three findings, learn why exit 3 means success, and fix-then-recapture to green.
- [Stave Tutorial Demo](/docs/labs/docker-demo.md): 44 S3 security scenarios in Docker. No AWS credentials required.
- [Docker Scenarios](/docs/labs/docker-scenarios.md)
- [ACL Privilege Escalation](/docs/labs/docker-scenarios/acl-escalation.md): Buckets where ACL grants (WRITEACP, READACP, FULL_CONTROL) enable attackers to modify permissions, enumerate access, or gain complete control -- even when the bucket policy looks clean.
- [ACL-Based Public Write](/docs/labs/docker-scenarios/acl-write.md): User upload bucket where ACL grants write to any authenticated AWS user. The bucket policy looks clean — policy-only scanners miss this entirely.
- [Data Governance and Lifecycle](/docs/labs/docker-scenarios/data-governance.md): Backup bucket missing data classification, lifecycle rules, MFA delete, versioning, and Public Access Block -- a cascade of governance failures that compounds risk.
- [HIPAA Multi-Violation](/docs/labs/docker-scenarios/hipaa-compliance.md): PHI (Protected Health Information) bucket with multiple HIPAA compliance failures: no encryption at rest, no transport encryption, no KMS key management, no access logging, no versioning, no object lock, and no Public Access Block.
- [Public Read via Bucket Policy](/docs/labs/docker-scenarios/public-read.md): Internal analytics data exposed to the internet via Principal: "*" bucket policy with Public Access Block disabled.
- [Security Tool Bypass](/docs/labs/docker-scenarios/tool-blind-spot.md): Buckets that appear safe to tools relying on APIs the bucket policy denies, plus latent public read exposure masked only by Public Access Block.
- [Upload Policy Hardening](/docs/labs/docker-scenarios/upload-hardening.md): Signed upload policies that allow prefix-scoped keys or unrestricted content types, enabling object overwrite and stored XSS attacks.
- [From Steampipe to Stave](/docs/labs/from-steampipe-to-stave.md): You already collect cloud state with Steampipe. This guide turns that
- [HackerOne Case Challenges](/docs/labs/hackerone.md): 30 real HackerOne bug bounty cases as reasoning challenges — can you find the misconfiguration from static evidence?
- [Building Detection Metrics from Lab Results](/docs/labs/lab-metrics.md): Load CloudGoat lab findings and compute detection metrics, severity breakdowns, and assessment diffs using pkg/stave.
- [Lambda MicroVM Security Labs](/docs/labs/lambda-microvm.md): Eight self-contained labs for the Lambda MicroVM control family.
- [Lab 3B — Trust Policy Over-Broad sts:TagSession (sts:* wildcard)](/docs/labs/lambda-microvm/03b-overbroad-tagsession.md): A least-privilege MicroVM execution role whose trust policy grants sts:TagSession through an sts:* wildcard. The mirror of Lab 3 — there TagSession is missing; here it is present but granted over-broadly. One control fires; scope the actions and re-verify to zero.
- [Lab 1 — Baseline: A Compliant MicroVM](/docs/labs/lambda-microvm/baseline-compliant-microvm.md): Orient yourself in the Lambda MicroVM lab: the 16 built-in CTL.LAMBDA.MICROVM.* controls, the obs.v0.1 shape they read, and the capture → transform → evaluate loop. Build a compliant configuration and watch every control pass.
- [Lab 4 — Compound Path: Graph Reachability](/docs/labs/lambda-microvm/compound-path.md): The finding per-resource scanners structurally cannot see. A MicroVM role reaches a production secret through an assume-role hop — each hop passes its individual check. Soufflé and Z3 compute the reachability; remediation breaks the chain.
- [Lab 6 — Excessive Idle and Runtime](/docs/labs/lambda-microvm/excessive-idle-runtime.md): A MicroVM with maxIdleDurationSeconds and total runtime at the 8-hour ceiling. Two runtime controls fire; lower both within the org limit and re-verify. Shows an asserted signal the AWS API doesn't echo.
- [Lab 3 — Trust Policy Missing sts:TagSession](/docs/labs/lambda-microvm/missing-tagsession.md): A least-privilege MicroVM execution role whose trust policy lacks sts:TagSession. One control fires; add TagSession and re-verify to zero. Shows a single-control test in isolation.
- [Lab 2 — Over-privileged Execution Role](/docs/labs/lambda-microvm/overprivileged-execution-role.md): Plant an over-privileged MicroVM execution role (s3:*, secretsmanager:*, iam:PassRole) with a trust policy missing sts:TagSession, detect it with two built-in controls, remediate to least privilege, and re-verify to zero findings.
- [Lab 5 — Public Artifact Bucket](/docs/labs/lambda-microvm/public-artifact-bucket.md): The S3 bucket holding a MicroVM image's source (Dockerfile + code zip) has Block Public Access off and versioning disabled. Two supply-chain controls fire; enable PAB + versioning and re-verify to zero.
- [Lab 7 — Secrets Baked Into the Snapshot](/docs/labs/lambda-microvm/secrets-in-snapshot.md): An image whose init code loads a secret at module scope, so it's baked into the Firecracker memory snapshot and persists in every MicroVM launched from it. One control fires; defer secret loading to a runtime hook and re-verify.
- [Using Stave as a Go Library](/docs/labs/library-in-process.md): Run the full Stave pipeline in-process from your own Go program — no CLI, no JSON parsing.
- [Understanding Why Stave Reached a Verdict](/docs/labs/logic-trace.md): Learn how to use the Logic Trace to see the step-by-step reasoning behind
- [Now Run Stave](/docs/labs/now-run-stave.md): Run the same S3 fixtures through Stave and compare the findings to your answers.
- [Scaffolding Controls with the Policy Forge](/docs/labs/policy-forge.md): Learn how to create a new security control with test fixtures in under
- [Tutorial: Your first multi-engine analysis](/docs/labs/reasoning-engines.md): A guided walkthrough: take one snapshot, export Stave's fact base, run three different reasoning engines (CEL, Z3, Soufflé) against it, and read each verdict.
- [S3 Public Exposure & Long-Lived IAM Keys](/docs/labs/s3-public-exposure-long-lived-iam-keys.md): A hands-on walkthrough: capture a deployed public S3 bucket and a long-lived IAM access key as an obs.v0.1 snapshot, evaluate them with Stave's built-in controls, read every part of the findings, then remediate and re-verify.
- [S3 Ransomware Protection & Forensic Auditability](/docs/labs/s3-ransomware-protection-forensic-auditability.md): Detect a compliance-tagged backup bucket missing the three controls that decide whether you survive a ransomware deletion — versioning, Object Lock (WORM), and access logging. Read all three findings and fix-then-recapture to green.
- [SadCloud — Multi-Service Misconfiguration Sweep](/docs/labs/sadcloud-multi-service-validation.md): A hands-on walkthrough: deploy NCC Group's SadCloud — a deliberately-insecure, 22-service AWS lab — capture it as an obs.v0.1 snapshot, evaluate the whole estate with Stave's built-in controls, and read the scorecard (breadth, detection rate, and a compound attack chain) instead of a single finding.
- [Shadow Admin Compute Role Privilege Drift](/docs/labs/shadow-admin-compute-role-privilege-drift.md): Detect an EC2 backend role with service-wildcard admin grants AND a sibling role that has silently drifted past its unused-permission threshold. Read both findings, learn why exit code 3 means success, and fix-then-recapture to green.
- [Skill Track](/docs/labs/skill-track.md): Six guided exercises from build to production evaluation. Each builds on the previous.
- [Build & Verify](/docs/labs/skill-track/build-and-verify.md): Build Stave from source and verify the binary and control catalog work.
- [First Findings](/docs/labs/skill-track/first-findings.md): Run Stave against a crafted observation and read your first findings.
- [Lab Validation](/docs/labs/skill-track/lab-validation.md): Deploy a known-vulnerable lab and confirm Stave detects the documented attack path.
- [Reasoning Engines](/docs/labs/skill-track/reasoning-engines.md): Export observation facts and derive compound chains with Z3, Souffle, or Prolog.
- [Snapshot Your Account](/docs/labs/skill-track/snapshot-your-account.md): Capture a read-only snapshot of your AWS account and evaluate it with Stave.
- [Write a Control](/docs/labs/skill-track/write-a-control.md): Author, test, and verify a custom control using the forge toolchain.
- [Writing Custom Controls](/docs/labs/writing-controls.md): Step-by-step guide to writing, testing, and deploying your own Stave controls.
- [Reference](/docs/reference.md)
- [Stave Verify — GitHub Action](/docs/reference/baseline-action.md): Run Stave's deterministic security verification on every Pull Request: findings go to the
- [CEL Predicate Reference](/docs/reference/cel-predicates.md): Complete reference for the Common Expression Language predicates used in control unsafe_predicate blocks.
- [Changelog](/docs/reference/changelog.md): All notable changes to this project will be documented in this file.
- [CLI Reference](/docs/reference/cli-reference.md): Complete reference for all Stave CLI commands.
- [stave](/docs/reference/cli-reference/stave.md): Root Stave command.
- [stave alias](/docs/reference/cli-reference/stave-alias.md): Manage command aliases
- [stave alias delete](/docs/reference/cli-reference/stave-alias-delete.md): Delete an alias
- [stave alias list](/docs/reference/cli-reference/stave-alias-list.md): List all aliases
- [stave alias set](/docs/reference/cli-reference/stave-alias-set.md): Create or update an alias
- [stave apply](/docs/reference/cli-reference/stave-apply.md): Run control evaluation after plan checks pass
- [stave attest](/docs/reference/cli-reference/stave-attest.md): Snapshot tamper detection via Ed25519 signatures
- [stave attest keygen](/docs/reference/cli-reference/stave-attest-keygen.md): Generate a new Ed25519 key pair for snapshot attestation
- [stave attest sign](/docs/reference/cli-reference/stave-attest-sign.md): Sign a snapshot's assets with an Ed25519 private key
- [stave attest verify](/docs/reference/cli-reference/stave-attest-verify.md): Verify an attested snapshot against a public key
- [stave bisect](/docs/reference/cli-reference/stave-bisect.md): Find when a control was first violated
- [stave bundle](/docs/reference/cli-reference/stave-bundle.md): Generate a sealed evidence bundle for air-gap GRC integration
- [stave bundle audit](/docs/reference/cli-reference/stave-bundle-audit.md): Assemble a compliance-period evidence package
- [stave capabilities](/docs/reference/cli-reference/stave-capabilities.md): Print supported input types and version constraints (default) or a user-facing catalog (subcommand)
- [stave capabilities catalog](/docs/reference/cli-reference/stave-capabilities-catalog.md): Print the user-facing capability catalog
- [stave capabilities catalog coverage](/docs/reference/cli-reference/stave-capabilities-catalog-coverage.md): Show per-service control coverage
- [stave capabilities catalog gaps](/docs/reference/cli-reference/stave-capabilities-catalog-gaps.md): Compare catalog against an external checklist
- [stave capabilities catalog inspect](/docs/reference/cli-reference/stave-capabilities-catalog-inspect.md): Show full metadata for a single control
- [stave capabilities catalog matrix](/docs/reference/cli-reference/stave-capabilities-catalog-matrix.md): Show taxonomy × service cross-product with gap cells
- [stave capabilities catalog stats](/docs/reference/cli-reference/stave-capabilities-catalog-stats.md): Print aggregate catalog statistics
- [stave capabilities catalog taxonomy](/docs/reference/cli-reference/stave-capabilities-catalog-taxonomy.md): List taxonomy categories with control counts
- [stave catalog](/docs/reference/cli-reference/stave-catalog.md): Print the user-facing capability catalog
- [stave catalog coverage](/docs/reference/cli-reference/stave-catalog-coverage.md): Show per-service control coverage
- [stave catalog gaps](/docs/reference/cli-reference/stave-catalog-gaps.md): Compare catalog against an external checklist
- [stave catalog inspect](/docs/reference/cli-reference/stave-catalog-inspect.md): Show full metadata for a single control
- [stave catalog matrix](/docs/reference/cli-reference/stave-catalog-matrix.md): Show taxonomy × service cross-product with gap cells
- [stave catalog stats](/docs/reference/cli-reference/stave-catalog-stats.md): Print aggregate catalog statistics
- [stave catalog taxonomy](/docs/reference/cli-reference/stave-catalog-taxonomy.md): List taxonomy categories with control counts
- [stave cel](/docs/reference/cli-reference/stave-cel.md): CEL expression tools
- [stave cel eval](/docs/reference/cli-reference/stave-cel-eval.md): Evaluate a CEL expression against observation assets
- [stave check](/docs/reference/cli-reference/stave-check.md): Compare before/after evaluations to check remediation
- [stave ci](/docs/reference/cli-reference/stave-ci.md): CI/CD policy and baseline commands
- [stave ci baseline](/docs/reference/cli-reference/stave-ci-baseline.md): Manage baseline findings for fail-on-new CI workflows
- [stave ci baseline check](/docs/reference/cli-reference/stave-ci-baseline-check.md): Compare evaluation findings against baseline and detect new findings
- [stave ci baseline save](/docs/reference/cli-reference/stave-ci-baseline-save.md): Save evaluation findings as baseline
- [stave ci diff](/docs/reference/cli-reference/stave-ci-diff.md): Compare two evaluations and report new findings
- [stave ci fix](/docs/reference/cli-reference/stave-ci-fix.md): Show machine-readable fix plan for a finding
- [stave ci fix-loop](/docs/reference/cli-reference/stave-ci-fix-loop.md): Run apply-before/apply-after/verify in one command
- [stave ci gate](/docs/reference/cli-reference/stave-ci-gate.md): Enforce CI failure policy modes from config or flags
- [stave compare](/docs/reference/cli-reference/stave-compare.md): Compare compliance posture between two frameworks
- [stave completion](/docs/reference/cli-reference/stave-completion.md): Generate shell completion scripts
- [stave compliance](/docs/reference/cli-reference/stave-compliance.md): Evaluate a snapshot against a compliance framework and report coverage
- [stave config](/docs/reference/cli-reference/stave-config.md): Configuration commands
- [stave config context](/docs/reference/cli-reference/stave-config-context.md): Named project context commands
- [stave config context create](/docs/reference/cli-reference/stave-config-context-create.md): Create or update a named context
- [stave config context delete](/docs/reference/cli-reference/stave-config-context-delete.md): Delete a context
- [stave config context list](/docs/reference/cli-reference/stave-config-context-list.md): List available contexts
- [stave config context show](/docs/reference/cli-reference/stave-config-context-show.md): Show selected context
- [stave config context use](/docs/reference/cli-reference/stave-config-context-use.md): Set active context
- [stave config delete](/docs/reference/cli-reference/stave-config-delete.md): Remove a project config key (reverts to default)
- [stave config env](/docs/reference/cli-reference/stave-config-env.md): Manage environment variables
- [stave config env list](/docs/reference/cli-reference/stave-config-env-list.md): List supported STAVE_* environment variables
- [stave config explain](/docs/reference/cli-reference/stave-config-explain.md): Explain resolved config values and sources
- [stave config get](/docs/reference/cli-reference/stave-config-get.md): Get a config value
- [stave config set](/docs/reference/cli-reference/stave-config-set.md): Set a project config value in stave.yaml
- [stave config show](/docs/reference/cli-reference/stave-config-show.md): Show effective project configuration and value sources
- [stave contract](/docs/reference/cli-reference/stave-contract.md): Inspect Stave's per-asset-type input contracts
- [stave contract show](/docs/reference/cli-reference/stave-contract-show.md): Show the agent-facing contract for an asset type
- [stave controls](/docs/reference/cli-reference/stave-controls.md): Work with control definitions
- [stave controls alias-explain](/docs/reference/cli-reference/stave-controls-alias-explain.md): Show expanded predicate for an alias
- [stave controls aliases](/docs/reference/cli-reference/stave-controls-aliases.md): List built-in semantic predicate aliases
- [stave controls explain](/docs/reference/cli-reference/stave-controls-explain.md): Explain a specific control
- [stave controls list](/docs/reference/cli-reference/stave-controls-list.md): List control IDs and names
- [stave controls quality](/docs/reference/cli-reference/stave-controls-quality.md): Analyze control catalog metadata completeness and coverage gaps
- [stave controls search](/docs/reference/cli-reference/stave-controls-search.md): Search the built-in control catalog
- [stave coverage](/docs/reference/cli-reference/stave-coverage.md): Analyze observation field coverage against control predicates
- [stave diagnose](/docs/reference/cli-reference/stave-diagnose.md): Diagnose evaluation inputs and results
- [stave diagnose explain](/docs/reference/cli-reference/stave-diagnose-explain.md): Generate guided remediation playbook for a finding
- [stave diagnose finding](/docs/reference/cli-reference/stave-diagnose-finding.md): Deep-dive analysis of a single finding
- [stave diagnose report](/docs/reference/cli-reference/stave-diagnose-report.md): Generate a plain-text report from evaluation output
- [stave diagnose trace](/docs/reference/cli-reference/stave-diagnose-trace.md): Trace predicate evaluation for a single control against a single asset
- [stave diff](/docs/reference/cli-reference/stave-diff.md): Compare two observation snapshots or control catalogs
- [stave discover](/docs/reference/cli-reference/stave-discover.md): Resolve AWS services to the data Stave needs (the collection manifest)
- [stave doctor](/docs/reference/cli-reference/stave-doctor.md): Check local environment readiness for Stave workflows
- [stave enforce](/docs/reference/cli-reference/stave-enforce.md): Generate deterministic enforcement templates from evaluation output
- [stave exempt](/docs/reference/cli-reference/stave-exempt.md): Manage risk acceptances (acknowledgments, exceptions, exemptions)
- [stave exempt acknowledge](/docs/reference/cli-reference/stave-exempt-acknowledge.md): Add a formal risk acceptance
- [stave exempt asset](/docs/reference/cli-reference/stave-exempt-asset.md): Add a scope exclusion (exemption)
- [stave exempt except](/docs/reference/cli-reference/stave-exempt-except.md): Add an operational suppression
- [stave exempt export](/docs/reference/cli-reference/stave-exempt-export.md): Export risk register as OSCAL POA&M
- [stave exempt history](/docs/reference/cli-reference/stave-exempt-history.md): Show full audit trail including expired entries
- [stave exempt list](/docs/reference/cli-reference/stave-exempt-list.md): List all active risk acceptances
- [stave exempt remove](/docs/reference/cli-reference/stave-exempt-remove.md): Mark an acknowledgment as revoked
- [stave exempt suggest](/docs/reference/cli-reference/stave-exempt-suggest.md): Suggest exemptions for chronic/oscillating findings
- [stave exempt upcoming](/docs/reference/cli-reference/stave-exempt-upcoming.md): Show acceptances approaching expiry
- [stave exempt validate](/docs/reference/cli-reference/stave-exempt-validate.md): Validate the acceptance file
- [stave expand](/docs/reference/cli-reference/stave-expand.md): Show every control sharing a structural defect archetype
- [stave explain](/docs/reference/cli-reference/stave-explain.md): Explain how a control evaluates and which fields it needs
- [stave export](/docs/reference/cli-reference/stave-export.md): Export controls and compliance evidence
- [stave export changes](/docs/reference/cli-reference/stave-export-changes.md): Export remediation property changes from assessment findings
- [stave export compliance](/docs/reference/cli-reference/stave-export-compliance.md): Export compliance evidence package
- [stave export-controls](/docs/reference/cli-reference/stave-export-controls.md): Export the control catalog for external solver consumption
- [stave export ocsf](/docs/reference/cli-reference/stave-export-ocsf.md): Export findings as OCSF 1.1 Compliance Finding events
- [stave export oscal](/docs/reference/cli-reference/stave-export-oscal.md): Export findings as OSCAL 1.1.2 Assessment Results JSON
- [stave export-sir](/docs/reference/cli-reference/stave-export-sir.md): Export the Stave Intermediate Representation as JSON
- [stave export tickets](/docs/reference/cli-reference/stave-export-tickets.md): Export findings as canonical ticket records
- [stave features](/docs/reference/cli-reference/stave-features.md): Show what Stave does and deliberately does not do
- [stave fingerprint](/docs/reference/cli-reference/stave-fingerprint.md): Policy fingerprint diagnostics
- [stave fingerprint explain](/docs/reference/cli-reference/stave-fingerprint-explain.md): Show the policy fingerprint preimage and diagnosis
- [stave fmt](/docs/reference/cli-reference/stave-fmt.md): Format control and observation files deterministically
- [stave forge](/docs/reference/cli-reference/stave-forge.md): Author and test custom controls
- [stave forge chain](/docs/reference/cli-reference/stave-forge-chain.md): Author and validate custom chains
- [stave forge chain lint](/docs/reference/cli-reference/stave-forge-chain-lint.md): Validate chain YAML
- [stave forge lint](/docs/reference/cli-reference/stave-forge-lint.md): Static analysis for control YAML files
- [stave forge new](/docs/reference/cli-reference/stave-forge-new.md): Interactive control authoring wizard
- [stave forge paths](/docs/reference/cli-reference/stave-forge-paths.md): List available observation property paths from a snapshot
- [stave forge preview](/docs/reference/cli-reference/stave-forge-preview.md): Evaluate a predicate against a snapshot without writing files
- [stave forge scaffold](/docs/reference/cli-reference/stave-forge-scaffold.md): Generate test fixtures from a real snapshot
- [stave forge test](/docs/reference/cli-reference/stave-forge-test.md): Run fixture-based assertions against a control
- [stave gaps](/docs/reference/cli-reference/stave-gaps.md): Report which observation properties are absent + what they unlock
- [stave generate](/docs/reference/cli-reference/stave-generate.md): Generate starter artifacts
- [stave generate observation](/docs/reference/cli-reference/stave-generate-observation.md): Generate an observation template
- [stave graph](/docs/reference/cli-reference/stave-graph.md): Visualize control and asset relationships
- [stave graph coverage](/docs/reference/cli-reference/stave-graph-coverage.md): Show which controls cover which assets
- [stave graph export](/docs/reference/cli-reference/stave-graph-export.md): Export assessment as JSON, STIX 2.1, JSON-LD, or GraphML
- [stave help](/docs/reference/cli-reference/stave-help.md): Help about any command
- [stave inspect](/docs/reference/cli-reference/stave-inspect.md): Low-level security analysis primitives
- [stave inspect acl](/docs/reference/cli-reference/stave-inspect-acl.md): Analyze S3 ACL grants
- [stave inspect aliases](/docs/reference/cli-reference/stave-inspect-aliases.md): List predicate aliases with metadata
- [stave inspect compliance](/docs/reference/cli-reference/stave-inspect-compliance.md): Resolve compliance framework crosswalk
- [stave inspect exposure](/docs/reference/cli-reference/stave-inspect-exposure.md): Classify resource exposure vectors
- [stave inspect policy](/docs/reference/cli-reference/stave-inspect-policy.md): Analyze an S3 bucket policy document
- [stave inspect risk](/docs/reference/cli-reference/stave-inspect-risk.md): Score risk from policy statement context
- [stave lint](/docs/reference/cli-reference/stave-lint.md): Lint control files for design quality
- [stave map](/docs/reference/cli-reference/stave-map.md): ATT&CK tactic coverage and gap analysis
- [stave metrics](/docs/reference/cli-reference/stave-metrics.md): Write Prometheus scrape file for node_exporter
- [stave pack](/docs/reference/cli-reference/stave-pack.md): Concern packs — named control groupings and their data requirements
- [stave pack list](/docs/reference/cli-reference/stave-pack-list.md): List available concern packs and their control counts
- [stave pack show](/docs/reference/cli-reference/stave-pack-show.md): Show a pack's requirements manifest (AWS calls, signals, collector permissions)
- [stave packs](/docs/reference/cli-reference/stave-packs.md): Inspect built-in control packs
- [stave packs list](/docs/reference/cli-reference/stave-packs-list.md): List available built-in packs
- [stave packs show](/docs/reference/cli-reference/stave-packs-show.md): Show one built-in pack and its control IDs
- [stave path](/docs/reference/cli-reference/stave-path.md): Export attack path graph data from active chain findings
- [stave permissions](/docs/reference/cli-reference/stave-permissions.md): Query net effective permissions from a snapshot
- [stave permissions principal](/docs/reference/cli-reference/stave-permissions-principal.md): Resolve permissions for a specific principal ARN
- [stave permissions resource](/docs/reference/cli-reference/stave-permissions-resource.md): Show who has effective access to a resource
- [stave permissions summary](/docs/reference/cli-reference/stave-permissions-summary.md): Aggregate NEP metrics across all principals
- [stave plan](/docs/reference/cli-reference/stave-plan.md): Preview which controls will evaluate, by service and severity
- [stave profile](/docs/reference/cli-reference/stave-profile.md): Manage compliance profiles
- [stave profile create](/docs/reference/cli-reference/stave-profile-create.md): Generate a starter profile YAML
- [stave profile list](/docs/reference/cli-reference/stave-profile-list.md): List available compliance profiles
- [stave profile validate](/docs/reference/cli-reference/stave-profile-validate.md): Validate a profile file
- [stave prove](/docs/reference/cli-reference/stave-prove.md): Run Z3 SMT queries against a Stave assessment
- [stave readiness](/docs/reference/cli-reference/stave-readiness.md): Report what Stave can/can't evaluate given the supplied observations
- [stave report](/docs/reference/cli-reference/stave-report.md): Generate executive security posture report
- [stave sanitize](/docs/reference/cli-reference/stave-sanitize.md): Sanitize a snapshot for cross-boundary sharing
- [stave schemas](/docs/reference/cli-reference/stave-schemas.md): List all contract schemas
- [stave score](/docs/reference/cli-reference/stave-score.md): Compute security posture score (0-100)
- [stave scorecard](/docs/reference/cli-reference/stave-scorecard.md): Multi-framework compliance scorecard
- [stave search](/docs/reference/cli-reference/stave-search.md): Find catalog entries matching a free-form intent
- [stave snapshot](/docs/reference/cli-reference/stave-snapshot.md): Snapshot inspection commands
- [stave snapshot diff](/docs/reference/cli-reference/stave-snapshot-diff.md): Compare the latest two observation snapshots
- [stave status](/docs/reference/cli-reference/stave-status.md): Show project context and the next recommended command
- [stave telemetry](/docs/reference/cli-reference/stave-telemetry.md): Emit structured NDJSON telemetry from assessment output
- [stave test](/docs/reference/cli-reference/stave-test.md): Run embedded control test cases
- [stave transform](/docs/reference/cli-reference/stave-transform.md): Convert raw AWS CLI snapshots into obs.v0.1 observations (built-in jq)
- [stave trend](/docs/reference/cli-reference/stave-trend.md): Analyze compliance posture trends across assessment runs
- [stave trend forecast](/docs/reference/cli-reference/stave-trend-forecast.md): Project posture score trajectory with SLA breach warnings
- [stave trend oscillation](/docs/reference/cli-reference/stave-trend-oscillation.md): Classify violation oscillation patterns across assessment history
- [stave trend predict](/docs/reference/cli-reference/stave-trend-predict.md): Project compliance readiness achievement date
- [stave validate](/docs/reference/cli-reference/stave-validate.md): Validate inputs without evaluation
- [stave validate-mapping](/docs/reference/cli-reference/stave-validate-mapping.md): Validate a Steampipe→Stave mapping file before use
- [stave version](/docs/reference/cli-reference/stave-version.md): Print version and environment state
- [Command Reference](/docs/reference/command-reference.md): <!-- GENERATED by internal/tools/gencommanddocs — DO NOT EDIT.
- [OWASP Non-Human Identity Top 10 — Stave coverage](/docs/reference/compliance-owasp-nhi.md): The OWASP Non-Human Identity (NHI) Top 10
- [Configuration](/docs/reference/config-file.md): How Stave resolves settings from flags, project config, user config, and environment variables.
- [Contract-First Schemas](/docs/reference/contracts.md): Stave uses contract-first JSON schemas so validation is deterministic,
- [Evaluation Engine Capabilities](/docs/reference/evaluation-engine-capabilities.md): What Stave's CEL-backed evaluation engine supports, what the shipped S3 / IAM / DocumentDB controls exercise, and what is retained as candidate code for future domains.
- [Evaluation Semantics](/docs/reference/evaluation-semantics.md): Deterministic evaluation behavior, predicate matching rules, and output semantics.
- [Evidence Packet](/docs/reference/evidence-packet-spec.md): Format specification for stave bundle audit — the compliance evidence package an auditor receives.
- [Exceptions Specification](/docs/reference/exempt-spec.md): File format and behavior for stave-acknowledgments.yaml — risk acceptances, exceptions, and exemptions.
- [Fact Export Reference](/docs/reference/fact-export.md): The on-disk formats Stave produces for external reasoning engines: JSON / JSONL / SMT-LIB v2. Schema, predicate vocabulary, closed-world semantics, exit codes.
- [Stave Terminology Glossary](/docs/reference/glossary.md): This glossary maps Stave's internal terminology to security industry standards
- [Loading Stave Graph Exports into Graph-Data-Science Libraries](/docs/reference/graph-libraries.md): Stave's graph export command produces vendor-neutral graph documents
- [HIPAA Per-Control CLI Evidence](/docs/reference/hipaa-cli.md): Per-control AWS CLI evidence commands, expected output shapes, and pass/fail observation JSON for HIPAA S3 controls.
- [HIPAA S3 Control Mapping](/docs/reference/hipaa-table.md): Mapping of HIPAA Security Rule sections to Stave S3 controls, with AWS CLI evidence and pass/fail observation shapes.
- [Minimum IAM Permissions for S3 Observation Collection](/docs/reference/iam-permissions.md): Stave evaluates local observation files. Users collect these observations
- [Identity Blast Radius Reference](/docs/reference/identity-blast-radius.md): Observation properties, controls, the identity_blast_radius chain, and example output for identity blast radius.
- [Integration Guide: Stave with Companion Tools](/docs/reference/integration-guide.md): Stave evaluates offline JSON snapshots — it never holds cloud
- [Cytoscape.js Graph Viewer](/docs/reference/integrations/cytoscape.md): Self-contained HTML viewer for Stave's security graph.
- [GraphML Export](/docs/reference/integrations/graphml.md): Convert Stave's graph-json to GraphML for desktop graph tools.
- [Amazon Neptune Integration](/docs/reference/integrations/neptune.md): Load Stave's security graph into Amazon Neptune for Gremlin-based
- [Controls Reference](/docs/reference/invariants-reference/_index.md): Complete listing of all Stave controls by service domain.
- [No Unauthorized Cross-Account Access](/docs/reference/invariants-reference/access-control/inv-s3-access-001.md): S3 bucket policies must not grant access to external AWS accounts.
- [No Wildcard Action Policies](/docs/reference/invariants-reference/access-control/inv-s3-access-002.md): S3 bucket policies must not use wildcard actions (s3:* or *).
- [No External Write Access](/docs/reference/invariants-reference/access-control/inv-s3-access-003.md): S3 buckets must not grant write or delete permissions to external AWS accounts.
- [No Authenticated-Users Read Access](/docs/reference/invariants-reference/access-control/inv-s3-auth-read-001.md): S3 buckets must not grant read access to all authenticated AWS users.
- [No Authenticated-Users Write Access](/docs/reference/invariants-reference/access-control/inv-s3-auth-write-001.md): S3 buckets must not grant write or delete access to all authenticated AWS users.
- [Public-Principal Policies Must Have Network Conditions](/docs/reference/invariants-reference/access-control/inv-s3-network-001.md): S3 bucket policies that grant access to Principal * must include network-scoping conditions.
- [Shared-Bucket Tenant Isolation Must Enforce Prefix](/docs/reference/invariants-reference/access-control/inv-s3-tenant-isolation-001.md): When a shared S3 bucket uses prefix-based tenant isolation, every app-signer identity must enforce the tenant prefix.
- [S3 Signed Upload Must Restrict Content Types](/docs/reference/invariants-reference/access-control/inv-s3-write-content-001.md): Signed upload policies must restrict allowed content types to prevent stored XSS.
- [S3 Signed Upload Must Bind To Exact Object Key](/docs/reference/invariants-reference/access-control/inv-s3-write-scope-001.md): Signed upload policies must restrict write permission to a single exact object key, not a prefix.
- [No Public ACL Modification](/docs/reference/invariants-reference/acl-escalation/inv-s3-acl-escalation-001.md): S3 bucket ACLs must not be writable by AllUsers or AuthenticatedUsers.
- [No FULL_CONTROL ACL Grants to Public](/docs/reference/invariants-reference/acl-escalation/inv-s3-acl-fullcontrol-001.md): S3 bucket ACLs must not grant FULL_CONTROL to AllUsers or AuthenticatedUsers.
- [No Public ACL Readability](/docs/reference/invariants-reference/acl-escalation/inv-s3-acl-recon-001.md): S3 bucket ACLs should not be readable by unauthenticated users.
- [Full Control Catalog](/docs/reference/invariants-reference/catalog.md): Browse by service
- [ACCOUNT controls (3)](/docs/reference/invariants-reference/catalog/account.md): CTL.ACCOUNT.DEPRECATED.SERVICE.001
- [ACM controls (8)](/docs/reference/invariants-reference/catalog/acm.md): CTL.ACM.ACME.SCOPE.WILDCARD.001
- [ACMPCA controls (1)](/docs/reference/invariants-reference/catalog/acmpca.md): CTL.ACMPCA.CROSSACCOUNT.001
- [AD controls (40)](/docs/reference/invariants-reference/catalog/ad.md): CTL.AD.ACCOUNT.DELEGATION.001
- [AMPLIFY controls (1)](/docs/reference/invariants-reference/catalog/amplify.md): CTL.AMPLIFY.APP.ACTIVE.001
- [APIGATEWAY controls (105)](/docs/reference/invariants-reference/catalog/apigateway.md): CTL.APIGATEWAY.ACCESSLOG.CMK.001
- [APIGW2 controls (2)](/docs/reference/invariants-reference/catalog/apigw2.md): CTL.APIGW2.AUTH.001
- [APPRUNNER controls (1)](/docs/reference/invariants-reference/catalog/apprunner.md): CTL.APPRUNNER.SERVICE.ACTIVE.001
- [APPSTREAM controls (2)](/docs/reference/invariants-reference/catalog/appstream.md): CTL.APPSTREAM.IMAGE.DEPRECATED.001
- [ATHENA controls (3)](/docs/reference/invariants-reference/catalog/athena.md): CTL.ATHENA.ENCRYPT.001
- [AUDITMANAGER controls (1)](/docs/reference/invariants-reference/catalog/auditmanager.md): CTL.AUDITMANAGER.ENABLED.001
- [AUTOSCALING controls (3)](/docs/reference/invariants-reference/catalog/autoscaling.md): CTL.AUTOSCALING.ELB.HEALTH.001
- [AZURE controls (141)](/docs/reference/invariants-reference/catalog/azure.md): CTL.AZURE.ACR.ADMIN.001
- [BACKUP controls (13)](/docs/reference/invariants-reference/catalog/backup.md): CTL.BACKUP.ENCRYPT.001
- [BATCH controls (3)](/docs/reference/invariants-reference/catalog/batch.md): CTL.BATCH.ESCALATION.CHAIN.001
- [BEANSTALK controls (3)](/docs/reference/invariants-reference/catalog/beanstalk.md): CTL.BEANSTALK.LOG.001
- [BEDROCK controls (47)](/docs/reference/invariants-reference/catalog/bedrock.md): CTL.BEDROCK.ACCESS.ADMIN.001
- [CFN controls (1)](/docs/reference/invariants-reference/catalog/cfn.md): CTL.CFN.PARAM.NOECHO.001
- [CISCO controls (30)](/docs/reference/invariants-reference/catalog/cisco.md): CTL.CISCO.ACL.EGRESS.001
- [CLOUD9 controls (2)](/docs/reference/invariants-reference/catalog/cloud9.md): CTL.CLOUD9.ENV.ACTIVE.001
- [CLOUDFLARE controls (29)](/docs/reference/invariants-reference/catalog/cloudflare.md): CTL.CLOUDFLARE.DNS.DANGLING.001
- [CLOUDFORMATION controls (9)](/docs/reference/invariants-reference/catalog/cloudformation.md): CTL.CLOUDFORMATION.DRIFT.001
- [CLOUDFRONT controls (72)](/docs/reference/invariants-reference/catalog/cloudfront.md): CTL.CLOUDFRONT.ACCESS.GEORESTRICTION.BLOCKLIST.001
- [CLOUDTRAIL controls (60)](/docs/reference/invariants-reference/catalog/cloudtrail.md): CTL.CLOUDTRAIL.ACCESS.LOGREAD.BROAD.001
- [CLOUDWATCH controls (67)](/docs/reference/invariants-reference/catalog/cloudwatch.md): CTL.CLOUDWATCH.ALARM.COMPOSITE.NOACTION.001
- [CODEBUILD controls (13)](/docs/reference/invariants-reference/catalog/codebuild.md): CTL.CODEBUILD.BUILDSPEC.USERCONTROLLED.001
- [CODECOMMIT controls (2)](/docs/reference/invariants-reference/catalog/codecommit.md): CTL.CODECOMMIT.ACCESS.001
- [CODEPIPELINE controls (5)](/docs/reference/invariants-reference/catalog/codepipeline.md): CTL.CODEPIPELINE.ARTIFACT.NOENCRYPT.001
- [COGNITO controls (113)](/docs/reference/invariants-reference/catalog/cognito.md): CTL.COGNITO.ADAPTIVE.AUTH.001
- [COMPLIANCE controls (1)](/docs/reference/invariants-reference/catalog/compliance.md): CTL.COMPLIANCE.OSCAL.REPORT.CURRENT.001
- [CONFIG controls (51)](/docs/reference/invariants-reference/catalog/config.md): CTL.CONFIG.ACCESS.DELETERECORDER.BROAD.001
- [DATACLASS controls (5)](/docs/reference/invariants-reference/catalog/dataclass.md): CTL.DATACLASS.PROD.UNTAGGED.001
- [DATASYNC controls (1)](/docs/reference/invariants-reference/catalog/datasync.md): CTL.DATASYNC.EXTERNAL.DESTINATION.001
- [DMS controls (7)](/docs/reference/invariants-reference/catalog/dms.md): CTL.DMS.GHOST.TARGET.S3.001
- [DNS controls (3)](/docs/reference/invariants-reference/catalog/dns.md): CTL.DNS.DANGLING.001
- [DOCUMENTDB controls (18)](/docs/reference/invariants-reference/catalog/documentdb.md): CTL.DOCUMENTDB.AUDIT.PARAM.OFF.001
- [DYNAMODB controls (38)](/docs/reference/invariants-reference/catalog/dynamodb.md): CTL.DYNAMODB.ACCESS.EXPORT.001
- [EBS controls (3)](/docs/reference/invariants-reference/catalog/ebs.md): CTL.EBS.AMI.DEREGPROTECTION.001
- [EC2 controls (110)](/docs/reference/invariants-reference/catalog/ec2.md): CTL.EC2.AMI.BLOCKPUBLIC.001
- [ECR controls (10)](/docs/reference/invariants-reference/catalog/ecr.md): CTL.ECR.ENCRYPT.CMK.001
- [ECS controls (53)](/docs/reference/invariants-reference/catalog/ecs.md): CTL.ECS.ALARM.FAILEDLAUNCH.001
- [EFS controls (14)](/docs/reference/invariants-reference/catalog/efs.md): CTL.EFS.AP.POSIX.001
- [EKS controls (115)](/docs/reference/invariants-reference/catalog/eks.md): CTL.EKS.ACCESSENTRY.CLUSTERADMIN.BROAD.001
- [ELASTICACHE controls (11)](/docs/reference/invariants-reference/catalog/elasticache.md): CTL.ELASTICACHE.AUTH.001
- [ELB controls (80)](/docs/reference/invariants-reference/catalog/elb.md): CTL.ELB.ACCESSLOG.PERMISSION.001
- [EMR controls (7)](/docs/reference/invariants-reference/catalog/emr.md): CTL.EMR.ENCRYPT.001
- [EVENTBRIDGE controls (97)](/docs/reference/invariants-reference/catalog/eventbridge.md): CTL.EVENTBRIDGE.ALARM.APIDEST.5XX.001
- [EVS controls (1)](/docs/reference/invariants-reference/catalog/evs.md): CTL.EVS.ENVIRONMENT.ACTIVE.001
- [EXPOSURE controls (11)](/docs/reference/invariants-reference/catalog/exposure.md): CTL.EXPOSURE.ANON.001
- [FIREHOSE controls (1)](/docs/reference/invariants-reference/catalog/firehose.md): CTL.FIREHOSE.GHOST.S3.001
- [FMS controls (2)](/docs/reference/invariants-reference/catalog/fms.md): CTL.FMS.ADMIN.001
- [GCP controls (72)](/docs/reference/invariants-reference/catalog/gcp.md): CTL.GCP.ACCESSCONTEXT.PERIMETER.001
- [GCS controls (7)](/docs/reference/invariants-reference/catalog/gcs.md): CTL.GCS.ENCRYPT.001
- [GHOST controls (2)](/docs/reference/invariants-reference/catalog/ghost.md): CTL.GHOST.TEMPORAL.PERMISSION.001
- [GITHUB controls (22)](/docs/reference/invariants-reference/catalog/github.md): CTL.GITHUB.ORG.MFA.001
- [GLACIER controls (2)](/docs/reference/invariants-reference/catalog/glacier.md): CTL.GLACIER.POLICY.CROSSACCOUNT.001
- [GLOBALACCELERATOR controls (1)](/docs/reference/invariants-reference/catalog/globalaccelerator.md): CTL.GLOBALACCELERATOR.EXISTS.001
- [GLUE controls (13)](/docs/reference/invariants-reference/catalog/glue.md): CTL.GLUE.CATALOG.ENCRYPT.001
- [GRAFANA controls (1)](/docs/reference/invariants-reference/catalog/grafana.md): CTL.GRAFANA.AUTH.001
- [GUARDDUTY controls (19)](/docs/reference/invariants-reference/catalog/guardduty.md): CTL.GUARDDUTY.ECS.RUNTIME.001
- [GUARDRAIL controls (1)](/docs/reference/invariants-reference/catalog/guardrail.md): CTL.GUARDRAIL.INCOMPLETE.001
- [IAM controls (307)](/docs/reference/invariants-reference/catalog/iam.md): CTL.IAM.ACCOUNT.INACTIVE.001
- [INSPECTOR controls (3)](/docs/reference/invariants-reference/catalog/inspector.md): CTL.INSPECTOR.COVERAGE.001
- [K8S controls (68)](/docs/reference/invariants-reference/catalog/k8s.md): CTL.K8S.APISERVER.ADM.CTRL.001
- [KINESIS controls (4)](/docs/reference/invariants-reference/catalog/kinesis.md): CTL.KINESIS.ENCRYPT.001
- [KMS controls (47)](/docs/reference/invariants-reference/catalog/kms.md): CTL.KMS.ALARM.CREATEGRANT.001
- [LAKEFORMATION controls (2)](/docs/reference/invariants-reference/catalog/lakeformation.md): CTL.LAKEFORMATION.ADMIN.COUNT.001
- [LAMBDA controls (91)](/docs/reference/invariants-reference/catalog/lambda.md): CTL.LAMBDA.ALARM.DURATION.001
- [LIFECYCLE controls (1)](/docs/reference/invariants-reference/catalog/lifecycle.md): CTL.LIFECYCLE.STAGING.STALE.001
- [LIGHTSAIL controls (5)](/docs/reference/invariants-reference/catalog/lightsail.md): CTL.LIGHTSAIL.ACCESS.KEY.001
- [M365 controls (73)](/docs/reference/invariants-reference/catalog/m365.md): CTL.M365.ADMIN.CALENDAR.001
- [MACIE controls (4)](/docs/reference/invariants-reference/catalog/macie.md): CTL.MACIE.CLASSIFICATION.001
- [MEDIASTORE controls (1)](/docs/reference/invariants-reference/catalog/mediastore.md): CTL.MEDIASTORE.POLICY.PUBLIC.001
- [META controls (1)](/docs/reference/invariants-reference/catalog/meta.md): CTL.META.OBSERVATION.STALE.001
- [MODEL controls (2)](/docs/reference/invariants-reference/catalog/model.md): CTL.MODEL.FORMAT.INSECURE.001
- [MQ controls (3)](/docs/reference/invariants-reference/catalog/mq.md): CTL.MQ.ACTIVEMQ.EOL.001
- [MSK controls (10)](/docs/reference/invariants-reference/catalog/msk.md): CTL.MSK.AUTH.MTLS.001
- [MWAA controls (2)](/docs/reference/invariants-reference/catalog/mwaa.md): CTL.MWAA.ENV.ACTIVE.001
- [NEPTUNE controls (20)](/docs/reference/invariants-reference/catalog/neptune.md): CTL.NEPTUNE.AUDIT.PARAM.OFF.001
- [NETFIREWALL controls (13)](/docs/reference/invariants-reference/catalog/netfirewall.md): CTL.NETFIREWALL.DEFAULT.FRAG.001
- [OPENSEARCH controls (132)](/docs/reference/invariants-reference/catalog/opensearch.md): CTL.OPENSEARCH.ACCESS.POLICY.001
- [ORG controls (60)](/docs/reference/invariants-reference/catalog/org.md): CTL.ORG.ACCOUNT.ALTERNATECONTACTS.001
- [QUICKSIGHT controls (2)](/docs/reference/invariants-reference/catalog/quicksight.md): CTL.QUICKSIGHT.DATASOURCE.ENCRYPT.001
- [RAM controls (3)](/docs/reference/invariants-reference/catalog/ram.md): CTL.RAM.EXTERNAL.001
- [RDS controls (73)](/docs/reference/invariants-reference/catalog/rds.md): CTL.RDS.ALARM.CONNECTIONS.001
- [RECYCLEBIN controls (2)](/docs/reference/invariants-reference/catalog/recyclebin.md): CTL.RECYCLEBIN.EBS.RETENTION.001
- [REDSHIFT controls (26)](/docs/reference/invariants-reference/catalog/redshift.md): CTL.REDSHIFT.AUDIT.LOGDESTINATION.001
- [ROUTE53 controls (50)](/docs/reference/invariants-reference/catalog/route53.md): CTL.ROUTE53.CROSSACCOUNT.PRIVATEASSOC.001
- [S3 controls (148)](/docs/reference/invariants-reference/catalog/s3.md): CTL.S3.ACCEL.001
- [S3EXPRESS controls (6)](/docs/reference/invariants-reference/catalog/s3express.md): CTL.S3EXPRESS.ACCESS.EXTERNAL.001
- [S3TABLES controls (3)](/docs/reference/invariants-reference/catalog/s3tables.md): CTL.S3TABLES.ACCESS.EXTERNAL.001
- [S3VECTORS controls (3)](/docs/reference/invariants-reference/catalog/s3vectors.md): CTL.S3VECTORS.ACCESS.EXTERNAL.001
- [SAGEMAKER controls (41)](/docs/reference/invariants-reference/catalog/sagemaker.md): CTL.SAGEMAKER.DOMAIN.AUTH.001
- [SECRET controls (3)](/docs/reference/invariants-reference/catalog/secret.md): CTL.SECRET.BLAST.001
- [SECRETS controls (31)](/docs/reference/invariants-reference/catalog/secrets.md): CTL.SECRETS.ALARM.ACCESS.FAILURE.001
- [SECRETSMANAGER controls (5)](/docs/reference/invariants-reference/catalog/secretsmanager.md): CTL.SECRETSMANAGER.ACCESS.001
- [SECURITYHUB controls (7)](/docs/reference/invariants-reference/catalog/securityhub.md): CTL.SECURITYHUB.AUTOENABLE.001
- [SECURITYLAKE controls (2)](/docs/reference/invariants-reference/catalog/securitylake.md): CTL.SECURITYLAKE.ENABLED.001
- [SERVERLESSREPO controls (1)](/docs/reference/invariants-reference/catalog/serverlessrepo.md): CTL.SERVERLESSREPO.POLICY.PUBLIC.001
- [SERVICECATALOG controls (1)](/docs/reference/invariants-reference/catalog/servicecatalog.md): CTL.SERVICECATALOG.CONSTRAINT.001
- [SES controls (3)](/docs/reference/invariants-reference/catalog/ses.md): CTL.SES.IDENTITY.DKIM.001
- [SHIELD controls (6)](/docs/reference/invariants-reference/catalog/shield.md): CTL.SHIELD.ADVANCED.001
- [SNS controls (39)](/docs/reference/invariants-reference/catalog/sns.md): CTL.SNS.ALARM.DELETETOPIC.001
- [SQS controls (37)](/docs/reference/invariants-reference/catalog/sqs.md): CTL.SQS.ALARM.AGE.001
- [SSM controls (13)](/docs/reference/invariants-reference/catalog/ssm.md): CTL.SSM.DOCUMENT.PUBLIC.001
- [STEPFUNCTIONS controls (113)](/docs/reference/invariants-reference/catalog/stepfunctions.md): CTL.STEPFUNCTIONS.ACTIVITY.ZOMBIE.001
- [TAGS controls (1)](/docs/reference/invariants-reference/catalog/tags.md): CTL.TAGS.CREDENTIAL.PATTERN.001
- [TRANSFER controls (2)](/docs/reference/invariants-reference/catalog/transfer.md): CTL.TRANSFER.EXTERNAL.DESTINATION.001
- [VPC controls (104)](/docs/reference/invariants-reference/catalog/vpc.md): CTL.VPC.BPA.ACCOUNT.001
- [VSPHERE controls (35)](/docs/reference/invariants-reference/catalog/vsphere.md): CTL.VSPHERE.ESX.ACCEPTANCE.001
- [WAF controls (17)](/docs/reference/invariants-reference/catalog/waf.md): CTL.WAF.CLASSIC.DEPRECATED.001
- [WORKSPACES controls (1)](/docs/reference/invariants-reference/catalog/workspaces.md): CTL.WORKSPACES.ENCRYPT.001
- [Referenced S3 Buckets Must Exist And Be Owned](/docs/reference/invariants-reference/compliance/inv-s3-bucket-takeover-001.md): Any externally referenced S3 bucket must exist and be owned by your account.
- [CDN S3 Origins Must Not Be Dangling](/docs/reference/invariants-reference/compliance/inv-s3-dangling-origin-001.md): CloudFront distributions must not reference S3 origins that do not exist.
- [Public Buckets Must Not Expose VCS Artifacts](/docs/reference/invariants-reference/compliance/inv-s3-repo-artifact-001.md): Publicly accessible S3 buckets must not contain .git/ or .svn/ directories.
- [Encryption at Rest Required](/docs/reference/invariants-reference/encryption/inv-s3-encrypt-001.md): S3 buckets must have server-side encryption enabled.
- [Transport Encryption Required](/docs/reference/invariants-reference/encryption/inv-s3-encrypt-002.md): S3 buckets must enforce HTTPS via a deny policy on aws:SecureTransport=false.
- [PHI Buckets Must Use SSE-KMS with Customer-Managed Key](/docs/reference/invariants-reference/encryption/inv-s3-encrypt-003.md): S3 buckets tagged with data-classification=phi must use SSE-KMS encryption with a customer-managed key.
- [Sensitive Data Requires KMS Encryption](/docs/reference/invariants-reference/encryption/inv-s3-encrypt-004.md): S3 buckets with non-public data classification must use SSE-KMS encryption with a customer-managed key.
- [Data Classification Tag Required](/docs/reference/invariants-reference/lifecycle-governance/inv-s3-governance-001.md): S3 buckets must have a data-classification tag to enable sensitivity-gated safety checks.
- [Retention-Tagged Buckets Must Have Lifecycle Rules](/docs/reference/invariants-reference/lifecycle-governance/inv-s3-lifecycle-001.md): S3 buckets tagged with data-retention must have at least one enabled lifecycle rule.
- [PHI Buckets Must Not Expire Data Before Minimum Retention](/docs/reference/invariants-reference/lifecycle-governance/inv-s3-lifecycle-002.md): PHI buckets must not have lifecycle expiration before 2190 days (6 years HIPAA minimum).
- [Compliance-Tagged Buckets Must Have Object Lock Enabled](/docs/reference/invariants-reference/lifecycle-governance/inv-s3-lock-001.md): Buckets tagged with a compliance framework must have S3 Object Lock enabled for WORM protection.
- [PHI Buckets Must Use COMPLIANCE Mode Object Lock](/docs/reference/invariants-reference/lifecycle-governance/inv-s3-lock-002.md): PHI buckets with Object Lock must use COMPLIANCE mode, not GOVERNANCE mode.
- [PHI Object Lock Retention Must Meet Minimum Period](/docs/reference/invariants-reference/lifecycle-governance/inv-s3-lock-003.md): PHI buckets with Object Lock must have retention of at least 2190 days (6 years HIPAA minimum).
- [Versioning Required](/docs/reference/invariants-reference/lifecycle-governance/inv-s3-version-001.md): S3 buckets must have versioning enabled to protect against accidental deletion.
- [Backup Buckets Must Have MFA Delete Enabled](/docs/reference/invariants-reference/lifecycle-governance/inv-s3-version-002.md): S3 buckets tagged with backup=true must have MFA delete enabled to prevent unauthorized permanent deletion.
- [Access Logging Required](/docs/reference/invariants-reference/logging/inv-s3-log-001.md): S3 buckets must have server access logging enabled.
- [No Public Write via ACL](/docs/reference/invariants-reference/public-access/inv-s3-acl-write-001.md): S3 bucket ACLs must not grant write access to AllUsers or AuthenticatedUsers.
- [Public Access Block Must Be Enabled](/docs/reference/invariants-reference/public-access/inv-s3-controls-001.md): S3 buckets must have the public access block fully enabled with all four settings.
- [Complete Data Required for Safety Assessment](/docs/reference/invariants-reference/public-access/inv-s3-incomplete-001.md): S3 bucket safety cannot be proven when policy or ACL data is missing from the snapshot.
- [No Public S3 Bucket Read](/docs/reference/invariants-reference/public-access/inv-s3-public-001.md): S3 buckets must not allow public read access via policy or ACL.
- [No Public S3 Buckets With Sensitive Data](/docs/reference/invariants-reference/public-access/inv-s3-public-002.md): S3 buckets tagged with sensitive data classifications must not allow any public access.
- [No Public Write Access](/docs/reference/invariants-reference/public-access/inv-s3-public-003.md): S3 buckets must not allow public write or delete access.
- [No Public Read via ACL](/docs/reference/invariants-reference/public-access/inv-s3-public-004.md): S3 bucket ACLs must not grant read access to AllUsers or AuthenticatedUsers for PHI data.
- [No Latent Public Read Exposure](/docs/reference/invariants-reference/public-access/inv-s3-public-005.md): S3 buckets must not have latent public read exposure masked only by Public Access Block.
- [No Latent Public Bucket Listing](/docs/reference/invariants-reference/public-access/inv-s3-public-006.md): S3 buckets must not have a latent public listing exposure masked only by Public Access Block.
- [No Public Read via Policy](/docs/reference/invariants-reference/public-access/inv-s3-public-007.md): S3 bucket policies must not grant public read access via Principal * with read actions.
- [No Public List via Policy](/docs/reference/invariants-reference/public-access/inv-s3-public-008.md): S3 bucket policies must not grant anonymous object listing via Principal * with list actions.
- [No Public S3 Bucket Listing](/docs/reference/invariants-reference/public-access/inv-s3-public-list-001.md): S3 buckets must not allow anonymous listing of objects.
- [Anonymous S3 Listing Must Be Explicitly Intended](/docs/reference/invariants-reference/public-access/inv-s3-public-list-002.md): Anonymous bucket listing increases exposure surface and must be explicitly tagged as intended.
- [Protected Prefixes Must Not Be Publicly Readable](/docs/reference/invariants-reference/public-access/inv-s3-public-prefix-001.md): S3 bucket prefixes marked as protected must not be publicly readable.
- [No Public Website Hosting with Public Read](/docs/reference/invariants-reference/public-access/inv-s3-website-public-001.md): S3 buckets with static website hosting enabled must not also have public read access.
- [Observation Contract](/docs/reference/observation-contract.md): Stable contract for observation snapshots used by Stave.
- [Observation Export Schema](/docs/reference/observation-export-schema.md): Field-by-field reference for the S3 observation property groups produced by Stave's export and transform tooling.
- [Operator Contract](/docs/reference/operator-contract.md): Three commands verify correctness after any change:
- [Output and Severity](/docs/reference/output-and-severity.md): How to read evaluation output, severity, remediation, and fix plans.
- [Output Formats](/docs/reference/output-formats.md): Stave supports multiple output formats for different use cases.
- [Unified Security Record Schema](/docs/reference/schema.md): Version "1" — increment on breaking changes.
- [Control Schema — ctrl.v1](/docs/reference/schema-ctrl.md): Reference for the ctrl.v1 control definition schema.
- [Diagnose Schema — diagnose.v1](/docs/reference/schema-diagnose.md): Reference for Stave diagnose output contract diagnose.v1.
- [Observation Schema — obs.v0.1](/docs/reference/schema-obs.md): Reference for the obs.v0.1 observation snapshot schema.
- [Output Schema — out.v0.1](/docs/reference/schema-out.md): Reference for Stave evaluation output contract out.v0.1.
- [Scope and Limits](/docs/reference/scope-and-support.md): What Stave covers, what is out of scope, and known technical limitations.
- [Security Policy](/docs/reference/security-policy.md): Scope
- [Severity Thresholds](/docs/reference/severity-thresholds.md): How severity levels work and how to tune duration thresholds.
- [Stability and Versioning](/docs/reference/stability.md): Stave's stability commitments, schema versioning, and dependency policy.