60 lines
3.1 KiB
Markdown
60 lines
3.1 KiB
Markdown
# AI Overview security boundary
|
|
|
|
AI Overview is an explicitly enabled server-side integration with the
|
|
company-managed LiteLLM gateway. It is disabled unless
|
|
`ASSESSOR_AI_MODE=litellm` and the HTTPS base URL, approved model alias, and API
|
|
key are all present in the backend environment.
|
|
|
|
## Trust boundary and transmitted data
|
|
|
|
The work LiteLLM service is an approved corporate processor outside the
|
|
ASSESSOR process. An explicit Generate or Regenerate action sends only the
|
|
versioned payload produced by `resultsToPrivacySafeExportJson`. ASSESSOR does
|
|
not send imported files, source tables, evidence records, reviews, unrestricted
|
|
environment observations, file paths, or storage keys. The gateway may retain
|
|
or route requests according to the company's own LiteLLM policy; that policy is
|
|
an operational prerequisite rather than something ASSESSOR can enforce.
|
|
|
|
The JSON is still untrusted assessment data. System instructions tell the model
|
|
not to follow embedded commands, URLs, scripts, prompts, or markup. Returned
|
|
content is parsed as inert JSON and validated against the local output contract,
|
|
length limits, exact roadmap phases, and the source rule IDs and environment
|
|
properties present in the transmitted payload. It is rendered only as React
|
|
text and never interpreted as HTML or Markdown.
|
|
|
|
## Network and secret controls
|
|
|
|
- The browser talks only to `/api/v1` on its own origin. Content Security Policy
|
|
remains `connect-src 'self'`; the LiteLLM origin and key never enter a browser
|
|
response.
|
|
- The backend accepts only an absolute HTTPS LiteLLM URL without embedded
|
|
credentials, query parameters, fragments, or a loopback host. The destination
|
|
comes only from server configuration, never from an API request.
|
|
- Requests use bearer authentication, reject redirects, have a configured
|
|
timeout, and enforce a maximum response size.
|
|
- The API key is read from the backend environment. It is not committed,
|
|
persisted, exported, or logged. Provider response bodies, prompts containing
|
|
assessment data, and intermediate summaries are not persisted or logged.
|
|
- Automated retries are disabled because a retry can create another paid and
|
|
externally processed request. An interrupted or failed run requires an
|
|
explicit new Generate action.
|
|
|
|
## Persistence and advisory status
|
|
|
|
Migration 024 stores append-only generation-run identities and their lifecycle
|
|
state. A successful run retains only the validated final result and technical
|
|
metadata: scope, input hash, prompt/output versions, model alias, timestamps,
|
|
call/token counts, and a bounded safe error summary when applicable. One queued
|
|
or running record is allowed per project/timeslot scope.
|
|
|
|
AI results are advisory. They never update findings, deterministic scores,
|
|
reviews, accepted-risk state, imports, or scanner processing data. A result is
|
|
marked stale when its privacy-safe input, model, prompt, or schema changes and
|
|
remains readable until the user explicitly regenerates it.
|
|
|
|
## Verification boundary
|
|
|
|
Automated tests use synthetic records and mocked LiteLLM responses. Live checks
|
|
must also use a synthetic project. Real tenant content must not be inspected,
|
|
logged, screenshotted, or sent merely to verify the integration.
|