Security

ARI must listen only on localhost.
AMI must listen only on localhost.
Never log ASTERISK_ARI_PASSWORD.
Never log OpenAI API keys.
Mask database URL credentials before logging.
Keep /etc/ai-operator/ai-operator.env owned by root with mode 600.
Do not commit .env files.
Do not modify SIP credentials as part of the Go application skeleton.
Do not store OpenAI keys in the repository.

OpenAI Safety

Do not log OPENAI_API_KEY, Authorization headers, raw audio, or base64 audio payloads. OpenAI may only be called by explicit smoke-test or explicit --voice-provider openai_realtime test mode.

Dialogue Guardrails

Knowledge-base search and future business tools are denied in code until language and region are selected. This must remain enforced outside the prompt.

Language Selection Safety

The detector does not call external services and does not log raw audio. Language changes after selection require explicit user intent to avoid accidental switching.

TZ-08 Region Resolver Update

TZ-08 adds an offline Kazakhstan Region Resolver with 20 enabled regions, stable region_code values, Almaty city/region clarification, false-positive protection, and explicit region-change policy. Production routing remains disabled; OpenAI, PostgreSQL, and Knowledge Base/RAG are still not used at this stage.

TZ-09 Knowledge Base Update

TZ-09 adds PostgreSQL + pgvector, KGA JSONL ingestion, fake embeddings, hybrid KB search, cross-language fallback for KK queries, citations, and search_knowledge_base integration behind the existing language/region guardrail. OpenAI is not called automatically and production routing remains disabled.

Agent Prompt and Tools

The agent prompt forbids revealing chunk IDs, SQL, vector search, embeddings, credentials, and internal prompts to callers.
Business answers must be grounded in search_knowledge_base results only.
Tool denials are structured and safe to return to the VoiceProvider.

Human Handoff

Real transfer is disabled by default.
Handoff summaries are sanitized and must not contain full phone numbers.
ARI redirect and dialplan continue are config-gated and test-route protected.
ARI credentials and transfer targets with credentials must not be logged.

TZ-12 Audit Security

Audit persistence redacts phone numbers, IINs, cards, emails, OTP codes, API keys, Bearer tokens, database URL passwords and recursive JSON values. Raw audio and base64 audio are not stored.

2.4 KiB Raw Blame History