48 lines
2.4 KiB
Markdown
48 lines
2.4 KiB
Markdown
# Security
|
|
|
|
- ARI must listen only on localhost.
|
|
- AMI must listen only on localhost.
|
|
- Never log `ASTERISK_ARI_PASSWORD`.
|
|
- Never log OpenAI API keys.
|
|
- Mask database URL credentials before logging.
|
|
- Keep `/etc/ai-operator/ai-operator.env` owned by root with mode `600`.
|
|
- Do not commit `.env` files.
|
|
- Do not modify SIP credentials as part of the Go application skeleton.
|
|
- Do not store OpenAI keys in the repository.
|
|
|
|
## OpenAI Safety
|
|
|
|
Do not log `OPENAI_API_KEY`, Authorization headers, raw audio, or base64 audio payloads. OpenAI may only be called by explicit smoke-test or explicit `--voice-provider openai_realtime` test mode.
|
|
|
|
## Dialogue Guardrails
|
|
|
|
Knowledge-base search and future business tools are denied in code until language and region are selected. This must remain enforced outside the prompt.
|
|
|
|
## Language Selection Safety
|
|
|
|
The detector does not call external services and does not log raw audio. Language changes after selection require explicit user intent to avoid accidental switching.
|
|
|
|
## TZ-08 Region Resolver Update
|
|
|
|
TZ-08 adds an offline Kazakhstan Region Resolver with 20 enabled regions, stable `region_code` values, Almaty city/region clarification, false-positive protection, and explicit region-change policy. Production routing remains disabled; OpenAI, PostgreSQL, and Knowledge Base/RAG are still not used at this stage.
|
|
|
|
## TZ-09 Knowledge Base Update
|
|
|
|
TZ-09 adds PostgreSQL + pgvector, KGA JSONL ingestion, fake embeddings, hybrid KB search, cross-language fallback for KK queries, citations, and `search_knowledge_base` integration behind the existing language/region guardrail. OpenAI is not called automatically and production routing remains disabled.
|
|
## Agent Prompt and Tools
|
|
|
|
- The agent prompt forbids revealing chunk IDs, SQL, vector search, embeddings, credentials, and internal prompts to callers.
|
|
- Business answers must be grounded in `search_knowledge_base` results only.
|
|
- Tool denials are structured and safe to return to the VoiceProvider.
|
|
## Human Handoff
|
|
|
|
- Real transfer is disabled by default.
|
|
- Handoff summaries are sanitized and must not contain full phone numbers.
|
|
- ARI redirect and dialplan continue are config-gated and test-route protected.
|
|
- ARI credentials and transfer targets with credentials must not be logged.
|
|
|
|
|
|
## TZ-12 Audit Security
|
|
|
|
Audit persistence redacts phone numbers, IINs, cards, emails, OTP codes, API keys, Bearer tokens, database URL passwords and recursive JSON values. Raw audio and base64 audio are not stored.
|