Assessor_2.0/docs/AI_OVERVIEW_SECURITY.md

AI Overview security boundary

AI Overview is an explicitly enabled server-side integration with the company-managed LiteLLM gateway. It is disabled unless ASSESSOR_AI_MODE=litellm and the HTTPS base URL, approved model alias, and API key are all present in the backend environment.

Trust boundary and transmitted data

The work LiteLLM service is an approved corporate processor outside the ASSESSOR process. An explicit Generate or Regenerate action sends only the versioned payload produced by resultsToPrivacySafeExportJson. ASSESSOR does not send imported files, source tables, evidence records, reviews, unrestricted environment observations, file paths, or storage keys. The gateway may retain or route requests according to the company's own LiteLLM policy; that policy is an operational prerequisite rather than something ASSESSOR can enforce.

The JSON is still untrusted assessment data. System instructions tell the model not to follow embedded commands, URLs, scripts, prompts, or markup. Returned content is parsed as inert JSON and validated against the local output contract, length limits, exact roadmap phases, and the source rule IDs and environment properties present in the transmitted payload. It is rendered only as React text and never interpreted as HTML or Markdown.

Network and secret controls

• The browser talks only to /api/v1 on its own origin. Content Security Policy remains connect-src 'self'; the LiteLLM origin and key never enter a browser response.
• The backend accepts only an absolute HTTPS LiteLLM URL without embedded credentials, query parameters, fragments, or a loopback host. The destination comes only from server configuration, never from an API request.
• Requests use bearer authentication, reject redirects, have a configured timeout, and enforce a maximum response size.
• The API key is read from the backend environment. It is not committed, persisted, exported, or logged. Provider response bodies, prompts containing assessment data, and intermediate summaries are not persisted or logged.
• Automated retries are disabled because a retry can create another paid and externally processed request. An interrupted or failed run requires an explicit new Generate action.

Persistence and advisory status

Migration 024 stores append-only generation-run identities and their lifecycle state. A successful run retains only the validated final result and technical metadata: scope, input hash, prompt/output versions, model alias, timestamps, call/token counts, and a bounded safe error summary when applicable. One queued or running record is allowed per project/timeslot scope.

AI results are advisory. They never update findings, deterministic scores, reviews, accepted-risk state, imports, or scanner processing data. A result is marked stale when its privacy-safe input, model, prompt, or schema changes and remains readable until the user explicitly regenerates it.

Verification boundary

Automated tests use synthetic records and mocked LiteLLM responses. Live checks must also use a synthetic project. Real tenant content must not be inspected, logged, screenshotted, or sent merely to verify the integration.