update first - 84

2026-06-30 02:21:39 +09:00
commit 07ac1bdcdd
561 changed files with 88164 additions and 0 deletions
@@ -0,0 +1,95 @@
+version: 1.0
+description: AI Governance Approval Workflow
+
+workflow:
+
+  name: casan_level4_agent_action_approval
+
+  steps:
+
+    - id: STEP-001
+      name: Submit Prompt
+      actor: developer
+      action: submit_prompt
+      output: prompt_received
+
+    - id: STEP-002
+      name: Security Validation
+      actor: system
+      action: validate_security
+      input: prompt_received
+      output: security_checked
+      fail_action: block
+
+    - id: STEP-003
+      name: Risk Assessment
+      actor: system
+      action: evaluate_risk
+      input: security_checked
+      output: risk_level
+
+    - id: STEP-004
+      name: Approval Decision
+      actor: architect
+      condition:
+        - if: risk_level == "high"
+          action: require_approval
+        - if: risk_level == "medium"
+          action: optional_approval
+        - if: risk_level == "low"
+          action: auto_approve
+
+    - id: STEP-005
+      name: LLM Execution
+      actor: system
+      condition: approved == true
+      action: call_llm
+      output: response
+
+    - id: STEP-006
+      name: Audit Logging
+      actor: system
+      action: log_event
+      input: all
+      output: audit_record
+
+approval_roles:
+
+  developer:
+    can_submit: true
+    can_approve: false
+
+  architect:
+    can_submit: false
+    can_approve: true
+
+  system:
+    can_execute: true
+
+rules:
+
+  high_risk:
+    required_approver: architect
+    timeout: 10m
+    default_decision: deny
+    non_interactive_override:
+      env_decision: CASAN_APPROVAL_DECISION
+      env_approver: CASAN_APPROVER
+
+  medium_risk:
+    required_approver: optional
+    timeout: 5m
+    default_decision: auto_approve_with_audit
+
+  low_risk:
+    auto_approve: true
+
+notifications:
+
+  on_approval_required:
+    channel: log
+    message: "Approval required for high-risk action"
+
+  on_denied:
+    channel: log
+    message: "Request denied"
@@ -0,0 +1,60 @@
+version: 1.0
+description: Immutable Audit Log Configuration
+
+audit:
+
+  enabled: true
+  mode: append_only_hash_chain   # immutable evidence with previous_record_hash + record_hash
+
+  log_fields:
+    - timestamp
+    - trace_id
+    - user
+    - action
+    - input_hash
+    - output_hash
+    - status
+    - approval_status
+    - risk_level
+
+  event_types:
+    - prompt_submitted
+    - prompt_blocked
+    - llm_called
+    - output_generated
+    - output_blocked
+    - approval_requested
+    - approval_granted
+    - approval_denied
+    - policy_violation
+
+  storage:
+    type: file
+    path: ".specify/logs/audit/audit.jsonl"
+
+  retention:
+    days: 90
+
+  integrity:
+    hash_algorithm: sha256
+    chain_fields:
+      - previous_record_hash
+      - record_hash
+    tamper_evidence: true
+
+actions:
+
+  log:
+    level: info
+
+  alert:
+    level: high
+    notify: true
+
+compliance:
+
+  standards:
+    - OWASP_LLM_TOP10
+    - NIST_AI_RMF
+    - ISO_42001
+``
@@ -0,0 +1,98 @@
+version: 1.0
+description: AI Risk Registry (Governance + Security Mapping)
+
+risks:
+
+  - id: RISK-001
+    name: Prompt Injection
+    category: security
+    severity: high
+    likelihood: high
+    impact: high
+    detection:
+      source: prompt-filter
+    mitigation:
+      - block malicious pattern
+      - validate input
+    owner: security_team
+
+  - id: RISK-002
+    name: Data Leakage
+    category: data
+    severity: high
+    likelihood: medium
+    impact: high
+    detection:
+      source: output-policy
+    mitigation:
+      - output filtering
+      - redact sensitive data
+    owner: ai_team
+
+  - id: RISK-003
+    name: PII Exposure
+    category: privacy
+    severity: high
+    likelihood: medium
+    impact: high
+    detection:
+      source: pii-rules
+    mitigation:
+      - mask PII
+      - block if critical
+    owner: compliance_team
+
+  - id: RISK-004
+    name: Hallucination Output
+    category: quality
+    severity: medium
+    likelihood: high
+    impact: medium
+    detection:
+      source: evaluation-harness
+    mitigation:
+      - flag uncertain output
+      - human review
+    owner: ai_team
+
+  - id: RISK-005
+    name: Unauthorized Tool Usage
+    category: security
+    severity: high
+    likelihood: low
+    impact: high
+    detection:
+      source: tool-harness
+    mitigation:
+      - whitelist tools
+      - enforce permission
+    owner: platform_team
+
+risk_levels:
+
+  high:
+    action: require_approval
+
+  medium:
+    action: log_and_monitor
+
+  low:
+    action: allow
+
+reporting:
+
+  enabled: true
+  frequency: daily
+  output: ".specify/governance/risk-report.md"
+
+review:
+
+  cycle: weekly
+  owner: architect
+
+auto_update:
+  enabled: true
+  trigger: new_action_type_detected
+  script: .specify/scripts/powershell/update-risk-registry.ps1
+  default_risk_for_unknown_action: high
+  note: "Unknown actions default to high-risk (fail-secure). Run update-risk-registry.ps1 to register."