{
  "schemaVersion": "artifactDefinition.v2",
  "definitionId": "UAI.artifactDefinition.v2",
  "artifactId": "UAI",
  "title": "Users and Access Inventory",
  "artifactType": "Inventory",
  "format": "xlsx",
  "productTier": "Premium",
  "definitionRole": "contract",
  "sourceModel": {
    "body": "canonical human-readable register maintained in the Artifact Candidate page",
    "jsonDefinition": "machine-readable contract and validation model",
    "jsonExample": "curated realistic example data fixture"
  },
  "purpose": "Define the required structure for maintaining an auditable inventory of users, accounts, access rights, privileged access, approvals, MFA status, access reviews, revocations and evidence.",
  "sections": [
    {
      "order": 1,
      "id": "title_page",
      "title": "Title Page",
      "contentType": "metadata",
      "required": true,
      "hint": null
    },
    {
      "order": 2,
      "id": "abstract",
      "title": "Abstract",
      "contentType": "narrative",
      "required": true,
      "hint": {
        "text": "Use UAI to keep access assignments visible, approved, reviewed and revoked when no longer needed.",
        "bookReference": "Volume 2, S-07-01-00 Asset Management & Information Classi"
      }
    },
    {
      "order": 3,
      "id": "document_control",
      "title": "Document Control",
      "contentType": "control_table",
      "required": true,
      "hint": null
    },
    {
      "order": 4,
      "id": "instructions",
      "title": "Instructions",
      "contentType": "ordered_list",
      "required": true,
      "hint": {
        "text": "Maintain one row per user-account or access assignment so reviews can identify stale, excessive or missing access evidence.",
        "bookReference": "Volume 2, S-07-01-00 Asset Management & Information Classi"
      },
      "intro": "Complete the Working sheets using the example tabs as a model. Follow the workbook usage rules below."
    },
    {
      "order": 5,
      "id": "users_access_inventory",
      "title": "Users and access inventory",
      "contentType": "register_table",
      "required": true,
      "minimumExampleRows": 6,
      "columns": [
        {
          "name": "Account ID",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "User or Role",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Department or Team",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "System",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Access Level",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Privileged Access",
          "type": "boolean",
          "required": "yes",
          "valueSet": "std.boolean",
          "options": [
            "Yes",
            "No"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select Yes or No."
          }
        },
        {
          "name": "Business Justification",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Approver",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "MFA Status",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Start Date",
          "type": "date",
          "required": "yes"
        },
        {
          "name": "End Date",
          "type": "date",
          "required": "yes"
        },
        {
          "name": "Last Review Date",
          "type": "date",
          "required": "yes"
        },
        {
          "name": "Review Result",
          "type": "select",
          "required": "yes",
          "valueSet": "domain.reviewResult",
          "options": [
            "Pass",
            "Pass with observations",
            "Fail",
            "Deferred"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Evidence Reference",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Status",
          "type": "select",
          "required": "yes",
          "valueSet": "domain.status.generic",
          "options": [
            "Draft",
            "In Progress",
            "Under Review",
            "Approved",
            "Closed",
            "Deferred"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Notes",
          "type": "text",
          "required": "yes"
        }
      ],
      "hint": {
        "text": "Each access row should show who has access, to what, why, who approved it, when it was reviewed and whether revocation is complete.",
        "bookReference": "Volume 2, S-07-01-00 Asset Management & Information Classi"
      }
    },
    {
      "order": 6,
      "id": "access_review_decision",
      "title": "Access review decision",
      "contentType": "decision_table",
      "required": true,
      "fields": [
        {
          "name": "Review result",
          "type": "select",
          "required": "yes",
          "valueSet": "domain.reviewResult",
          "options": [
            "Pass",
            "Pass with observations",
            "Fail",
            "Deferred"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Access records reviewed",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Privileged records",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Revocations pending",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Open exceptions",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Reviewed by",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Decision date",
          "type": "date",
          "required": "yes"
        },
        {
          "name": "Evidence reference",
          "type": "text",
          "required": "yes"
        }
      ],
      "hint": {
        "text": "Close with a review decision so access exceptions and pending revocations remain visible until resolved.",
        "bookReference": "Volume 2, S-07-01-00 Asset Management & Information Classi"
      }
    },
    {
      "order": 7,
      "id": "external_references",
      "title": "References",
      "contentType": "reference_table",
      "required": true
    }
  ],
  "validationRules": [
    "JSON Example must contain definitionRef pointing to UAI.artifactDefinition.v2.",
    "JSON Example register sections must contain schemaRef pointing to the matching definition section.",
    "Access rows must include user or role, system, access level, justification, approver, MFA status, review date, review result, evidence reference and status.",
    "Revoked access must include an end date or documented follow-up.",
    "Privileged access rows must include explicit approval and review evidence.",
    "Body must render the contract schema and the example data.",
    "No standalone Book reference section and no generic Sample placeholders are allowed."
  ],
  "enrichment": {
    "source": "Contract.json",
    "method": "curated-json",
    "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects."
  },
  "editorialStandard": {
    "isoAnchors": [
      {
        "label": "ISO/IEC 27001:2022",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Normative source this artifact implements or cites."
      },
      {
        "label": "ISO/IEC 27001:2022 8.1",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Operational planning and control this register evidences."
      },
      {
        "label": "ISO/IEC 27001:2022 7.5",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Documented information: identify, review and cite this workbook by version."
      }
    ],
    "bookSources": [
      {
        "series": "ISO 27001 for Software Companies",
        "volume": 2,
        "volumeTitle": "Implementation & Certification",
        "chapterId": "S-07-01-00",
        "chapterTitle": "Asset Management & Information Classi",
        "primary": true,
        "role": "Primary operating chapter for this companion artifact.",
        "href": "https://www.amazon.com/s?k=ISO+27001+for+Software+Companies+Implementation+and+Certification"
      },
      {
        "series": "ISO 27001 for Software Companies",
        "volume": 1,
        "volumeTitle": "Building the ISMS",
        "chapterId": "S-00-03-00",
        "chapterTitle": "Planning, Risk & Objectives (Clause 6)",
        "primary": false,
        "role": "Documented information, review and version discipline.",
        "href": "https://www.amazon.com/dp/9789908983448"
      }
    ],
    "acronyms": [
      {
        "abbr": "ISMS",
        "longForm": "Information Security Management System"
      },
      {
        "abbr": "SaaS",
        "longForm": "Software as a Service"
      },
      {
        "abbr": "CIA",
        "longForm": "Confidentiality, Integrity, and Availability"
      },
      {
        "abbr": "CI/CD",
        "longForm": "Continuous Integration / Continuous Delivery"
      },
      {
        "abbr": "CI",
        "longForm": "Continuous Integration"
      },
      {
        "abbr": "CD",
        "longForm": "Continuous Delivery"
      },
      {
        "abbr": "COO",
        "longForm": "Chief Operating Officer"
      },
      {
        "abbr": "CTO",
        "longForm": "Chief Technology Officer"
      },
      {
        "abbr": "HR",
        "longForm": "Human Resources"
      },
      {
        "abbr": "JSON",
        "longForm": "JavaScript Object Notation"
      },
      {
        "abbr": "MFA",
        "longForm": "Multi-Factor Authentication"
      }
    ],
    "must": [
      "Keep one live row per record on Working sheets. Do not merge several cases into one row.",
      "Example sheets must contain realistic Arcfield rows for every required sheet. Empty required cells are not an example."
    ],
    "mustNot": [
      "Do not invent live rows in the renderer. Example data lives in the Example JSON.",
      "Do not treat Ex example tabs as working sheets. Do not put live data on system sheets."
    ],
    "softwareCompanyAdaptations": [
      "Use Arcfield as the worked example (cover variant A).",
      "Name SaaS, CI/CD, privileged access or supplier interfaces in example rows where they affect this register."
    ],
    "exampleWorkbook": {
      "workedExampleOrg": "Arcfield",
      "requiredSheets": [
        "users_access_inventory",
        "access_review_decision"
      ],
      "minExampleRows": 6,
      "coverFromExample": true
    }
  },
  "editorialContractId": "editorial.xlsx.register.v1",
  "contentContractId": "content.register.inventory.v1"
}