CerbiStream.GovernanceAnalyzer 1.1.34

CerbiStream Governance Analyzer

🛡️ What is CerbiStream Governance Analyzer?

A high-performance Roslyn analyzer that enforces your organization’s structured-logging governance rules at build-time – before code reaches production. It supports customizable config files, flexible placement, and actionable diagnostics.

• Prevents PII leakage and missing telemetry fields
• Guarantees encryption settings for sensitive profiles
• Emits build errors with clear CERBI-IDs your CI pipeline can fail on

Zero code changes required. Add the NuGet package, define a governance profile, and compile.

🤔 For Stakeholders

Cerbi helps your teams log securely, consistently, and in compliance with privacy laws.

Cerbi is a seatbelt for your logs: invisible until something goes wrong — and essential when it does.

🚀 Quick-start

# Add to your project
$ dotnet add package CerbiStream.GovernanceAnalyzer

🧱 Now Powered by Cerbi.Governance.Core

As of v1.1.6, this analyzer depends on Cerbi.Governance.Core, a shared library containing:

• Governance config models (LogProfile, GovernanceMode, etc.)
• Plugin interface (ICustomGovernancePlugin)
• Runtime validator (GovernanceHelper.TryValidate(...))
• Developer attributes (CerbiTopic, CerbiGovernanceConfig)

These are now decoupled and precompiled, improving analyzer stability and cross-runtime reuse.

📂 Define Your Governance File

Create a profile (e.g. Configs/my_profile.json):

{
  "EnforcementMode": "Strict",
  "LoggingProfiles": {
    "default": {
      "RequireTopic": true,
      "AllowedTopics": ["Auth", "Payments"],
      "FieldSeverities": {
        "userId": "Required",
        "password": "Forbidden"
      },
      "EncryptionSettings": {
        "Mode": "AES",
        "FieldSeverity": "Required"
      },
      "AllowRelax": true
    }
  }
}

🔍 Declare Config File in Your App

[assembly: Cerbi.Governance.CerbiGovernanceConfig("Configs/my_profile.json")]

✅ Place this at the top of any .cs file (before the namespace) or in Properties/AssemblyInfo.cs

📄 Real-world Examples

// ✅ Valid structured log
logger.LogInformation(new Dictionary<string, object>
{
    ["Topic"] = "Auth",
    ["userId"] = "user-123"
});

// 🚫 Missing required field 'email'
logger.LogInformation(new Dictionary<string, object>
{
    ["userId"] = "abc-123"
});

// ✅ Relaxed log entry (valid only if profile allows it)
logger.LogInformation(new Dictionary<string, object>
{
    ["Topic"] = "Payments",
    ["GovernanceRelaxed"] = true,
    ["userId"] = "abc-123"
});

// ✅ Class-level [CerbiTopic] declaration
[CerbiTopic("Payments")]
public class PaymentService
{
    public void Charge()
    {
        _logger.LogInformation(new Dictionary<string, object> {
            ["userId"] = "abc-001"
        }); // Implied Topic = "Payments"
    }
}

✨ Relaxation works only if the profile allows it via "AllowRelax": true.

🗂️ Diagnostics

🛀 Config Path Options

[assembly: Cerbi.Governance.CerbiGovernanceConfig("Configs/gdpr-profile.json")]

The path is relative to the file being analyzed, not to the build output.

🕱️ Multi-Profile Support

Logs are matched to governance profiles using:

• Topic field in the log itself
• [CerbiTopic("...")] on the class or method

The analyzer enforces the matched profile's rules.

🏉 Plugin & Reload Support

• Runtime enforcement supported via GovernanceHelper.TryValidate(...)
• Plugins enabled via ICustomGovernancePlugin
• Reloads governance config on file change (for runtime only)

⚠️ Limitations

• ❌ Build-time analyzers require the JSON config to be local and use precompiled models
• ✅ Runtime validation (via CerbiStream) supports remote configs (e.g., Blob, GitHub)
• Analyzer supports only 1 config per project (via [CerbiGovernanceConfig(...)])
• Governance logic is now resolved via Cerbi.Governance.Core

📁 Package Info

📢 Support & Contact

• License: MIT
• Email: hello@cerbi.io
• Website: https://cerbi.io

Secure • Structured • Compliant CerbiStream Governance Analyzer — © Cerbi LLC 2025