add evidence-grounded ai assistance

2026-09-03 12:16:12 +02:00
parent c93dbd1ab4
commit c0909132f2
12 changed files with 352 additions and 2 deletions
@@ -136,4 +136,16 @@ Treat manually supplied business information, notes, and source references as po

 Pin or review base-image and dependency updates, scan images before release, use least-privilege GitHub tokens, and avoid printing environment values. CI may validate Compose with empty optional bootstrap variables and call unauthenticated health checks; it is not a substitute for authorization/tenant-isolation tests, provenance policy review, Argon2id parameter review, MFA testing, or a security assessment.

+## Phase 13 optional AI assistance security controls
+
+- AI is an optional, deny-by-default review aid. It may summarize or classify tenant-held evidence, but it is not an authority for facts, identity, ownership, deliverability, score/eligibility, CRM state, or contact permission. No AI path may send messages, probe SMTP, create campaigns, schedule follow-ups, merge records, acquire domains, or take autonomous CRM/outreach actions.
+- Provider configuration must use a server-side allowlist. Each primary or fallback provider requires an approved purpose/capability, model/version, tenant and data-class scope, processing/retention terms, region/egress policy, timeout/token/rate/cost budgets, health/circuit state, approval owner/expiry, and explicit operational enablement. Fallback may only preserve the same purpose, scope, redaction policy, evidence set, and authority; it must not silently broaden processing. Missing/expired approval, outage, quota, timeout, or policy failure fails closed to `unknown`/`unavailable`.
+- Keep provider credentials in a secret manager; never expose them to the browser or store them in prompts, responses, Compose, source, committed `.env`, logs, audit details, or error messages. Disable provider access immediately on suspected misuse or data leakage.
+- Minimize before transmission: send only bounded fields/evidence needed for the approved task; redact credentials, tokens, session data, secrets, raw page bodies, unnecessary personal/contact data, and unrelated tenant data. Enforce input/output size limits and log only a redacted request/policy fingerprint. Treat retrieved evidence and model output as untrusted input, including prompt-injection instructions; never invent facts or present invented facts as supported claims.
+- Every suggestion must cite tenant-scoped evidence IDs/source references and bind to a cryptographic evidence hash of the exact evidence snapshot, with observed time, uncertainty/conflict state, provider/model/version, and policy version. Hashing proves lineage to a snapshot, not source truth. Verify citations and hash equality server-side; a changed, missing, suppressed, stale, blocked, or conflicting input invalidates approval and requires re-review.
+- Approval is an explicit authorized human action, never an AI or retry side effect. Re-check tenant scope, suppression, permissions, evidence freshness/hash, provider approval, and policy version at approval time. Record proposal, citations/hash, actor, reason, before/after value, version, timestamp, rejection/expiry, and correlation/idempotency data in an append-oriented audit trail. Approval cannot create a verified fact or outreach authorization.
+- AI prompts/fingerprints, outputs, evidence snapshots/citations, approvals, caches, and audit events need separate retention classes, redaction rules, deletion/legal-hold semantics, tenant-keyed access, and readback/deletion verification. Retain only the minimum lineage needed to explain an approved result; do not retain full prompts or source content when a hash/reference suffices.
+- Suppression/do-not-contact is evaluated before AI input, generation, persistence, response, export, cache, queueing, and approval. Suppressed records remain visible as safety state, are never silently deleted, and cannot be revived by confidence, fallback, human approval, or later pipeline/outcome data.
+- Production requires provider/DPA/legal review, tenant-isolation and citation/hash tests, redaction and prompt-injection/hallucination evaluations, human-review and rollback semantics, immutable/tamper-evident audit, cost/rate monitoring, incident kill switch, retention/deletion jobs, and durable worker/retry idempotency. The current Compose stack has no configured AI provider and is not production-ready for AI processing.
+
 Report vulnerabilities privately to the repository maintainers; do not include live credentials or personal data in an issue.