# Worked example only. qonto-assistant owns its live declaration; this file
# makes no claim that this cadence is currently emitted or observed.
schema_version: "0.1"
declaration_id: qonto-assistant.audit.example
source: qonto-assistant
stream_id: qonto-assistant.audit
sources:
  - source_id: qonto-assistant.audit.allow
    event_class: audit.allow
    form: expected-rate
    window: PT24H
    expected_min: 1
    drop_below: finding
    extensions:
      netkingdom:
        evidence_class: attributive
        completeness_claimed: false
        example_only: true
  - source_id: qonto-assistant.audit.deny
    event_class: audit.deny
    form: heartbeat-or-reconciliation
    heartbeat:
      event_class: audit.heartbeat
      interval: PT24H
      assertion: nothing-to-report
      missing: finding
    reconciliation:
      compare_local: source_transition_counts.audit.deny
      compare_observed: evidence_counts.audit.deny
      divergence: finding
      undrained_local: lag-not-divergence
    extensions:
      netkingdom:
        evidence_class: load-bearing
        rate_monitoring: forbidden
        completeness_claimed: true