audit-and-governance

Overview

Governance has two parts: verify compliance with standards (audit), then communicate findings clearly (reporting). This skill covers both — from license checks and data regulations to generating structured reports with severity-classified findings.

When to Use

• Before releasing software (license compliance check)
• When handling personal data (GDPR, CCPA, HIPAA)
• After a development session (session report)
• During /audit invocation

Process

1. License Compliance

npx license-checker --production --onlyAllow "MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC"

• Verify all production dependencies use compatible licenses
• Flag GPL dependencies in proprietary projects (viral license)
• Document any license exceptions in docs/adrs/

2. Data Handling

If the application handles personal data:

• Data collection minimized (collect only what's needed)
• User consent obtained before collection
• Data retention policy defined and deletion mechanism exists
• Data encrypted in transit and at rest
• Access logs maintained

3. Security Standards Mapping

• OWASP Top 10 → codehands:security-and-hardening
• OWASP LLM Top 10 → references/owasp-llm-top10.md
• SOC2 → Access controls, audit logs, change management
• ISO 27001 → Information security management

4. Generate Report

Collect data then output in chosen format (Markdown default, JSON for CI, HTML for dashboards):

# CodeHands Audit Report — YYYY-MM-DD

## Session Summary
- Skills activated: [list] | Tasks: [count] | Human decisions: [count]

## Code Quality
- Tests: [passed]/[total] | Coverage: [%] | Build: [pass/fail]

## Security
- Vulnerabilities: [critical]/[high]/[medium]/[low]
- Secrets scan: [clean/findings]

## Compliance
- License check: [pass/fail] | Data handling: [compliant/needs review]

## Recommendations
- [Prioritized action items]

Save to .codehands/audit/YYYY-MM-DD-report.md.

Common Rationalizations

Rationalization	Reality
"Compliance is just bureaucracy"	Compliance requirements exist because of real incidents. Non-compliance has legal and financial consequences.
"Nobody reads audit reports"	Reports are read during incidents, compliance reviews, and retrospectives. They're insurance.
"Our project is too small for compliance"	License violations and data handling issues affect projects of all sizes.

Red Flags

• No license check on dependencies
• Personal data collected without documented purpose
• No audit trail for sensitive operations
• Session ending without recording outcomes

Verification

• License compliance verified (no incompatible licenses)
• Data handling meets applicable regulations
• Report generated with all applicable sections
• Report saved to .codehands/audit/
• Recommendations actionable and prioritized

See Also

• codehands:security-and-hardening — Code-level security
• codehands:agent-security — Agent behavior compliance
• codehands:verification-before-completion — Quality data source