Completeness Matrix

Completeness means every risk domain maps to a preset requirement, generated artifact, validator, CI gate, and evidence output.

Risk Domain	Preset Section	Generated Artifact	Validator	CI Gate	Evidence Output
Prompt injection	AI / LLM Risk	threat model, abuse cases	sicario verify	Sicario verify	gate summary
Broken access control	Security Requirements	tests, threat model	test suite	CI test	test report
Hardcoded secret	Secrets / Credential Handling	gate summary	secret pattern scan (SICARIO-HARDCODED-SECRET)	secret scan	gate summary
Hardcoded cloud/provider credential	Secrets / Credential Handling	gate summary	shipped rules 041-043 (SICARIO-HARDCODED-AWS-KEY, SICARIO-HARDCODED-PROVIDER-TOKEN, SICARIO-PRIVATE-KEY-MATERIAL)	secret scan	gate summary
Finding flood hides secret-scan results	Secrets / Credential Handling	gate summary	per-file/per-rule output caps with mandatory SICARIO-FINDINGS-TRUNCATED overflow finding	Sicario verify	gate summary + scan_coverage
Invalid or unreadable rule file weakens gate	Rule engine	gate summary	SICARIO-RULE-INVALID / SICARIO-RULE-UNREADABLE critical findings; sicario verify --validate-rules	Sicario verify	gate summary
Gate runs with zero rules loaded	Rule engine	gate summary	fail-closed SICARIO-NO-RULES-LOADED critical finding	Sicario verify	gate summary
Rule source redirected via SICARIO_ASSET_ROOT	Rule engine	gate summary	SICARIO-ASSET-ROOT-OVERRIDE finding	Sicario verify	scan_coverage.asset_root
Shipped rule overridden or disabled by project rule	Rule engine	gate summary	override recording with impact / original_severity (visibility control)	Sicario verify	scan_coverage.overrides
Missing data classification	Data Classification	data-classification.md	sicario verify	Sicario verify	spec-run evidence
Missing tagging discipline	Tagging Discipline	tagging-taxonomy.md	sicario verify	Sicario verify	spec-run evidence
Unsafe external write	External System Access	human approval record	plan review	Sicario review	evidence index
Unpinned dependency	Supply Chain	SBOM/provenance note	dependency scan	SCA	SBOM/evidence
Missing threat model	Threat Model	threat-model.md	sicario verify	Sicario verify	gate summary
Missing security tests	Tasks	tasks.md	sicario verify	Sicario verify	gate summary
Cloud public exposure	Cloud / IaC Risk	IaC scan report	IaC scanner	IaC scan	evidence index
Excessive IAM privilege	Cloud / IaC Risk	cloud risk template	IaC/policy scan	policy-as-code	evidence index
Missing cloud logging	Cloud / IaC Risk	cloud risk template	IaC/policy scan	policy-as-code	evidence index
No data residency decision	Cloud / IaC Risk	cloud risk template	plan review	Sicario review	evidence index
Untagged cloud/resource ownership	Tagging Plan	tagging taxonomy, IaC tags	policy-as-code / review	IaC scan	evidence index
Cost runaway risk	Cloud / IaC Risk	cloud risk template	plan review	Sicario review	evidence index
Missing audit evidence	Evidence Outputs	evidence-index.md	sicario verify	Sicario verify	evidence index
Missing selected-framework traceability	Compliance / Control Applicability	control maps	sicario verify	Sicario verify	evidence index
Unbounded security exception	Risk register	exception register	sicario verify	Sicario verify	risk evidence
Model/tool overreach	AI / Tool Boundary	AI risk evidence	AI-system profile	Sicario verify	spec-run evidence
Unbounded orchestration	Fleet / Orchestration Risk	workflow/state graph	sicario verify	Sicario verify	spec-run evidence
Unsafe retries or duplicate work	Fleet / Orchestration Risk	retry/idempotency tests	test suite	CI test	test report
Poison messages or stuck workflows	Orchestration Design	dead-letter evidence	sicario verify / tests	Sicario verify	evidence index
Autonomous remediation overreach	Human Approval Points	approval record	plan review	Sicario review	approval evidence
Documentation drift	Docs impact	docs-impact.md, docs-site	docs build	docs CI	docs build log
Diagram drift	Diagram impact	Mermaid source	diagram source check	docs CI	evidence index
Missing well-architected review	Architecture / Security Decision Record	plan.md	sicario verify	Sicario verify	gate summary