そのまま使える「中小企業の情報セキュリティ基本方針＆生成AI安全利用ルール」ひな形（SCS★3・SECURITY ACTION対応）

#![forbid(unsafe_code)]

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum DmarcEnforcement {
    None,
    Quarantine,
    Reject,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct LiveSmeTelemetrySnapshot {
    pub public_policy_url_status_200: bool,
    pub total_active_accounts: u32,
    pub mfa_enforced_accounts: u32,
    pub lingering_retired_accounts: u32,
    pub spf_dns_lookup_count: u8,
    pub dmarc_policy: DmarcEnforcement,
    pub latest_immutable_snapshot_age_secs: u64,
    pub ai_zero_data_retention_enabled: bool,
    pub days_since_last_15min_drill: u16,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub enum PolicyDriftViolation {
    PublicPolicyPageUnreachable,
    MfaCoverageIncomplete { covered: u32, total: u32 },
    OrphanedRetiredAccountDetected { count: u32 },
    SpfLookupLimitExceeded { lookups: u8 },
    WeakDmarcPolicyNone,
    StaleImmutableBackup { age_secs: u64 },
    ShadowAiTrainingOptOutMissing,
    AnnualIncidentDrillOverdue { days: u16 },
}

/// Evaluates whether the live system configuration strictly satisfies every promise
/// made in the published SME Security & Generative AI Policy (0% Compliance Drift).
pub fn evaluate_policy_as_code_compliance(
    telemetry: &LiveSmeTelemetrySnapshot,
) -> Result<(), Vec<PolicyDriftViolation>> {
    let mut violations = Vec::new();

    if !telemetry.public_policy_url_status_200 {
        violations.push(PolicyDriftViolation::PublicPolicyPageUnreachable);
    }

    if telemetry.total_active_accounts == 0
        || telemetry.mfa_enforced_accounts < telemetry.total_active_accounts
    {
        violations.push(PolicyDriftViolation::MfaCoverageIncomplete {
            covered: telemetry.mfa_enforced_accounts,
            total: telemetry.total_active_accounts,
        });
    }

    if telemetry.lingering_retired_accounts > 0 {
        violations.push(PolicyDriftViolation::OrphanedRetiredAccountDetected {
            count: telemetry.lingering_retired_accounts,
        });
    }

    // RFC 7208 Section 4.6.4 limits SPF DNS-interactive mechanisms to at most 10
    if telemetry.spf_dns_lookup_count == 0 || telemetry.spf_dns_lookup_count > 10 {
        violations.push(PolicyDriftViolation::SpfLookupLimitExceeded {
            lookups: telemetry.spf_dns_lookup_count,
        });
    }

    if telemetry.dmarc_policy == DmarcEnforcement::None {
        violations.push(PolicyDriftViolation::WeakDmarcPolicyNone);
    }

    if telemetry.latest_immutable_snapshot_age_secs > 86_400 {
        violations.push(PolicyDriftViolation::StaleImmutableBackup {
            age_secs: telemetry.latest_immutable_snapshot_age_secs,
        });
    }

    if !telemetry.ai_zero_data_retention_enabled {
        violations.push(PolicyDriftViolation::ShadowAiTrainingOptOutMissing);
    }

    if telemetry.days_since_last_15min_drill > 365 {
        violations.push(PolicyDriftViolation::AnnualIncidentDrillOverdue {
            days: telemetry.days_since_last_15min_drill,
        });
    }

    if violations.is_empty() {
        Ok(())
    } else {
        Err(violations)
    }
}