AI security

Authpermit uses AI to investigate and secures the AI it — and you — run. The rule throughout: a model proposes, Authpermit checks, a person or policy decides. Console: AI → AI security (/app/ai-security).

Providers and sensitivity routing

The AI gateway calls your own provider (BYOK, key in the vault) or, with managed AI, the platform's: Anthropic first, then Gemini, then the offline stub, which never pretends to be a model. Every prompt is classified — public, internal, confidential (personal data) or restricted (secrets) — and the higher of what the caller declared and what Authpermit detected decides which providers may see it. Built in: restricted data never reaches an external provider; personal data reaches one only with PII redaction on; private and local models see anything. Secrets are masked for every external provider regardless. Set your own table with POST /api/v1/ai-security/routing (scope ai:manage). Each call's trace records the level and the providers routing skipped.

Evidence-first investigations

POST /api/v1/ai-security/investigations/run gathers an incident's record, attack story, ledger entries and its subjects' risk, and places each in the model's context as a labelled section with an evidence ref (E1, E2, …). The answer is structured — hypotheses with confidence and the evidence for and against, findings typed FACT / INFERENCE / RECOMMENDATION, unknowns, recommended capabilities — and Authpermit grounds it: references to evidence the model was never given are dropped, a fact without evidence becomes an inference, a hypothesis without support is capped at 30% confidence (50% when only untrusted content supports it). Cited ledger entries are linked to the investigation as evidence, and the investigation to its incident. Without a model the result is degraded and restates the evidence only.

Trust tiers and prompt injection

Context is trusted (Authpermit's policy, person-verified procedures), internal (Authpermit's own records) or untrusted (incident descriptions, reporter text, documents, anything supplied with the request). Blocks are escaped so content cannot forge a more trusted one; injection markers (instruction overrides, role changes, tool calls, disabling controls, exfiltration, hidden text) are detected by rules, demote internal content to untrusted, raise ai.injection.detected and a risk signal. A recommendation supported only by untrusted content, or from an injected context, is never actionable.

Proposals, approvals and lifecycle

An actionable recommendation becomes an approval (POST /api/v1/ai-security/investigations/{id}/propose); on a person's approval the capability runs under that person's authority. Every AI action is visible as ai.agent.action.proposed → authorized | denied → executed → verified; executed says what was requested, verified only follows a confirmed result.

Agents, delegations and containment

Every AI agent has an owner and a standing delegation recorded at creation. Time-boxed grants (POST /api/v1/ai-security/delegations/grant) carry who delegated which capabilities, for what purpose, until when (30 days at most); you can delegate only what you hold, and an agent delegates to another only when its owner allowed it. Containment is a command: POST /api/v1/ai-security/agents/{id}/disable stops an agent's key at once and suspends its delegations; POST /api/v1/ai-security/tools/disable takes a tool away from every AI caller of the organization, including already-approved tasks. Both are reversible; lifting needs a person.

The evaluation gate and memory

A brain version is activated only after its evaluation passes on the model it runs on now (POST /api/v1/ai-security/brains/{id}/evaluate, then /activate); a model change makes the last evaluation stale. An agent whose brains have not passed starts suspended. Procedural memory (how to do something) carries its source, confidence and evidence, and is trusted context only after a person verifies it.

AI incidents and posture

A security incident in AI Monitor (a security anomaly, unknown behaviour, a policy violation) becomes a security incident (category ai_security) through the event fabric, so there is one incident queue. GET /api/v1/ai-security/posture scores routing, redaction, model governance, the autonomy ceiling, brain evaluations, agent identity and least privilege, delegations, injection guards, monitoring and incident readiness, says what to fix, and records the gaps as risk on your AI.