validate_compliance
Validate architecture compliance with HIPAA, PCI-DSS, SOC 2, FedRAMP, and GDPR. Runs encryption, logging, and access control checks. Returns pass/fail per check, evidence, and remediation hints. Optionally includes AWS Well-Architected.
Instructions
Validate an architecture against compliance frameworks.
Returns one result object per framework with pass/fail status per check, evidence (which components triggered the rule), and remediation hints.
When to use: You have a proposed architecture and need to know whether
it satisfies HIPAA / PCI-DSS / SOC 2 / FedRAMP / GDPR before proceeding.
Use security_scan for anti-pattern detection (weak auth, public
buckets, etc.) which is framework-agnostic.
Behavior: Pure computation — no LLM, no network. Evaluates the spec statically against 30+ rules. Does not access or modify any cloud resources.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| spec_json | Yes | ArchSpec to validate. Checks are run against the declared components, connections, and provider settings — no cloud API access required. | |
| frameworks | Yes | List of compliance framework slugs to validate against. Each framework runs 5-7 checks (encryption, logging, access control, etc.). Values: 'hipaa', 'pci-dss', 'soc2', 'fedramp', 'gdpr'. | |
| well_architected | No | When True, additionally runs the AWS Well-Architected Framework pillar checks (multi-AZ, auto-scaling, backup, monitoring, SPOF detection, cost optimization). Independent of the `frameworks` list. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |