oci-waf-security-review

name	oci-waf-security-review
description	Review OCI Well-Architected security posture across IAM, compartments, network exposure, encryption, logging, Cloud Guard, Security Zones, vulnerability scanning, and compliance guardrails.

OCI WAF Security Review

Purpose

Review OCI Well-Architected security posture with source-grounded checks for IAM, network exposure, encryption, logging, Cloud Guard, Security Zones, Vulnerability Scanning, and evidence-labeled findings.

Use When

• Reviewing this OCI domain for stale, missing, risky, vague, over-permissive, or under-specified guidance.
• Comparing current official OCI documentation against existing operational assumptions.
• Producing a source-grounded advisory that separates documented behavior, sampled configured-environment evidence, inference, and unknowns.

Operating Rules

• Keep primary responses lean; put detailed service behavior and caveats in references.
• Use official OCI documentation for documented service behavior.
• Use OCI API evidence through the user’s configured read-only OCI MCP only for command shape or sanitized sampled current-state observations.
• Do not mention local connector names, internal tool names, profile names, account-specific identifiers, or environment-specific paths.
• Never ask for credentials, tokens, tenancy details, compartment or resource identifiers, customer data, private keys, wallets, or config contents.
• Require explicit approval before any mutation or external support-channel action.

Reference Pack

• references/oci-waf-security-review-operations.md — service shape, wrong assumptions, operating rules, and pushback triggers.
• references/safety-checklist.md — risk gates, mutation boundaries, credential boundaries, and evidence labels.
• references/mcp-and-evidence.md — official docs versus sampled OCI API evidence discipline.
• references/workflow-and-output.md — execution flow and final response contract.
• references/official-sources.md — official OCI source URLs and current evidence notes.

Response Contract

Return verdict, evidence_level, blockers, safe_next_actions, and open_questions. Be blunt when evidence is insufficient.