# Criterion

URL: /business/nouns/criterion · Id: `noun:criterion`

> A Criterion is one requirement of an outside framework, such as SOC 2 or GDPR, that one or more Controls satisfy.

A Criterion is one requirement of an outside framework, such as SOC 2 or GDPR, that one or more [Controls](/business/nouns/control) satisfy.

## Properties
| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `framework` | `string` | Yes | One of `soc2`, `iso27001`, `hipaa`, or `gdpr`. |
| `ref` | `string` | Yes | The framework’s own reference, such as `CC8.1`. |
| `text` | `text` | Yes | The requirement, paraphrased. |

## Object
```json
{
  "$id": "https://api.sb/patentpad.com/criteria/criterion_1",
  "$type": "Criterion",
  "framework": "soc2",
  "ref": "Example ref",
  "text": "Example text"
}
```

## Relationships
None.

## Verbs
| Verb | Description | Subject | Event | Class |
| --- | --- | --- | --- | --- |
| <a id="get"></a>[Criterion.get](/business/nouns/criterion/get) | Returns one Criterion by id. Inherited from [Noun](/business/nouns/noun). | None. | None. | Read: `try`, `do` |
| <a id="list"></a>[Criterion.list](/business/nouns/criterion/list) | Returns Criteria, newest first, one page at a time. Inherited from [Noun](/business/nouns/noun). | None. | None. | Read: `try`, `do` |

A Criterion is kept forever and never edited: it has no `update` or `delete`.

## Permissions
Which Access level may call each Verb. One-way Verbs wait their delay window.

| Operation | `owner` | `admin` | `member` | `viewer` |
| --- | --- | --- | --- | --- |
| `Criterion.get` | Yes | Yes | Yes | Yes |
| `Criterion.list` | Yes | Yes | Yes | Yes |

## Call it

**Ask**

```text
Show me the latest criterion.
```

**API**

```bash
curl https://api.sb/shiftnote.app/criteria/criterion_1 \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY"
```

```json
{
  "api": "https://api.sb/shiftnote.app",
  "$type": "Criterion",
  "$id": "https://api.sb/shiftnote.app/criteria/criterion_1",
  "criterion": {
    "$id": "https://api.sb/shiftnote.app/criteria/criterion_1",
    "$type": "Criterion",
    "framework": "soc2",
    "ref": "Example ref",
    "text": "Example text"
  },
  "links": {
    "self": "https://api.sb/shiftnote.app/criteria/criterion_1",
    "up": "https://api.sb/shiftnote.app/criteria"
  }
}
```

**SDK**

```ts
import { $ } from 'startup-builder'

const criterion = await $.Criterion.get({ id: 'criterion_1' })
```

**CLI**

```bash
npx startup-builder do Criterion.get --json '{"id":"criterion_1"}'
```

**MCP**

```json
{
  "name": "do",
  "arguments": {
    "code": "return await $.Criterion.get({ id: 'criterion_1' })"
  }
}
```

## Example
SOC 2 CC8.1 asks that changes be authorized, tested and approved before they reach production. [Change approval](/systems/trust-and-governance/controls/change-approval) satisfies it, and the same Control satisfies ISO 27001 A.8.32.