PCI DSS requirement text was not retrieved and no PCI-specific requirement is recorded here - recorded as a refusal, not a gap
[minor] compliance
Fields
id
gotchas/sec-pci-dss-requirement-text-not-retrievedClass
compliance
Severity
minor
Concepts
pci-dsscomplianceaudit-trailretentionloggingscoperefusal
Symptom
A reader expects this slice to state which PCI DSS requirements apply to prompt and completion handling. It does not, because the standard text was not obtainable.
Root cause
The PCI DSS v4.0.1 document library establishes the current version (v4.0.1, June 2024, with a Summary of Changes and a Prioritized Approach framework), but the standard PDF sits behind an interactive licence agreement and returned only the licence text, not the requirements. Everything one would want to assert - the specific requirement numbers on retention of audit log history, on protecting stored account data, on masking PAN in logs, or on the defined scope of a system that merely TOUCHES cardholder data - would be recalled rather than sourced.
Workaround
If a deployment is in PCI scope, obtain the standard through the council's licensed access and record the requirement numbers against your own configuration. The structural point that IS sourced and does transfer: PCI scope follows the data, so an inference endpoint that receives, logs or embeds cardholder data is in scope even if it performs no payment function. For everything else, treat any unsourced PCI requirement number as unverified.
notes
EXPLICIT REFUSAL, recorded so the gap is visible rather than silently filled. AGENTS.md forbids inventing a figure or a URL, and PCI requirement numbers are exactly the kind of thing that reads as authoritative while being recalled from memory. Nothing in this slice asserts a PCI requirement. If a downstream agent needs this, the source to obtain is https://www.pcisecuritystandards.org/document_library/ with a completed licence agreement. SCHEME RECLASSIFIED (2026-10-04): was 'config'. Filed as compliance because it is an explicit refusal to state PCI DSS requirement text - the obligation, not a technical control, is what could not be retrieved.
Notes
EXPLICIT REFUSAL, recorded so the gap is visible rather than silently filled. AGENTS.md forbids inventing a figure or a URL, and PCI requirement numbers are exactly the kind of thing that reads as authoritative while being recalled from memory. Nothing in this slice asserts a PCI requirement. If a downstream agent needs this, the source to obtain is https://www.pcisecuritystandards.org/document_library/ with a completed licence agreement. SCHEME RECLASSIFIED (2026-10-04): was 'config'. Filed as compliance because it is an explicit refusal to state PCI DSS requirement text - the obligation, not a technical control, is what could not be retrieved.
Cross-references
This record references no other records — it is a leaf. It is cited by 0.