Çekirdek veri varlıkları ve ilişkileri
| Nesne | Kimlik ve kritik alanlar |
|---|
| AiAsset | asset_id, tenant_id, owner_id, provider, region, risk_class, env, version, last_seen |
| ModelVersion | model_id, artifact_hash, registry_uri, tokenizer, license, released_by, status |
| Agent | agent_id, principal_id, owner, delegation_scope, tool_ids, purpose, ttl_policy |
| Tool / MCPServer | tool_id, server_id, schema_hash, oauth_audience, permission_set, publisher |
| RAGDocument | doc_id, source_id, content_hash, sensitivity, acl, collection_id, revision |
| Policy | policy_id, scope, priority, effect, approved_by, version_hash, exception_ttl |
| PolicyDecision | decision_id, trace_id, subject_id, action, resource, effect, reason, occurred_at |
| SecurityEvent | event_id, correlation_id, severity, detector, confidence, evidence_ref |
| SecurityFinding | finding_id, attack_surface, risk, owner, due_at, proof, status |
| TestCampaign | campaign_id, authorized_scope, dataset_version, model_version, asr, false_positive |
| Incident | incident_id, severity, containment, timeline, case_owner, custody_ref |
| EvidenceBundle | bundle_id, hash, signed_by, retention, encryption_key_ref, access_log |
Örnek Policy Decision API (mantıksal)
POST /api/v1/policy/evaluate
{
"tenant_id": "tenant-42",
"trace_id": "trace-1001",
"subject": {"type":"agent", "id":"agent-201", "delegated_by":"user-99"},
"action": "mcp.tool.invoke",
"resource": {"tool_id":"erp.payment.create"},
"context": {"amount":75000, "currency":"TRY", "data_class":"restricted"}
}
// Response
{
"decision_id":"dec-5501", "effect":"require_approval",
"policy_version":"sha256:...", "reason_codes":["HIGH_IMPACT_ACTION"],
"approval": {"ttl_seconds":900, "approver_role":"finance-manager"}
}
Örnek olay envelope
{
"event_id":"evt-2918", "occurred_at":"2026-10-21T12:34:56Z",
"tenant_id":"tenant-42", "trace_id":"trace-1001",
"agent_id":"agent-201", "model_id":"model-17",
"policy_version":"sha256:...", "severity":"high",
"detector":"prompt-injection-signal", "decision":"deny",
"evidence_ref":"evidence://bundle-381",
"redaction_profile":"restricted"
}
API sürümleme ve olay bütünlüğü
- Schema evolution: additive fields first; breaking değişiklikler için versioned endpoint ve consumer contract test.
- İdempotency key: dış sistemde ödeme, silme, sınırlama gibi etkili işlemler için zorunlu.
- Olay kimliği ve korelasyon: trace_id, session_id, parent_action_id ve tenant_id korunur.
- Sensitive logging: prompt/response ham metni varsayılan olarak kapalı; maskelenmiş/erişim kontrollü seçici kayıt.
- Audit integrity: kanıt hash, zaman damgası, anahtar yönetimi ve değişiklik geçmişi ilişkilendirilir.
