Code Governance

curl -X POST https://api.airaproof.com/api/v1/policies \
  -H "Authorization: Bearer $AIRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "AI Agent Governance",
    "mode": "ai",
    "priority": 100,
    "ai_models": ["claude-opus-4-8"],
    "ai_prompt": "Review code implementing an AI agent. Enforce:\n\n1. No system prompt leakage — prompts must never be returned to users or logged in full\n2. No prompt injection — user input must never be concatenated into system prompts\n3. No unbounded tool access — agents must have an explicit tool allowlist, not wildcard\n4. No cross-tenant data — all queries must filter by tenant ID\n5. No PII in LLM context — mask email, phone, SSN, address before sending to LLM\n6. No destructive auto-execution — refunds, cancellations, deletes must require confirmation\n7. No third-party data sharing without consent check\n8. Idempotency on all mutations\n9. Audit trail on every tool call\n10. Token/cost tracking on LLM calls\n\nDo NOT flag: UI code, test files, config constants.",
    "conditions": [
      {"field": "action_type", "op": "eq", "value": "pr_code_scan"},
      {"field": "agent_id", "op": "contains", "value": "acme/agent-platform"}
    ],
    "decision": "deny"
  }'

system_prompt_leakage (Critical)

debug_prompt() returns the full system prompt including internal
refund policy and escalation thresholds. System prompts must
never be exposed to users.

unbounded_tool_access (Critical)

AVAILABLE_TOOLS = ["*"] grants the agent access to every
registered tool. Use an explicit allowlist of permitted tools.

pii_in_llm_context (Critical)

Full customer email, phone, address, and payment method are
sent to the LLM unmasked. PII must be redacted before
inclusion in LLM prompts.

destructive_auto_execution (Critical)

_process_refund() executes immediately without confirmation.
Destructive operations must require explicit user confirmation
before the agent executes them.

PR opened or pushed
       |
Fetch diff (added lines only)
       |
Run matching policies (highest priority first):
  - content_scan -> regex + NER (instant)
  - ai -> one LLM reviews the actual diff
  - consensus -> N LLMs review, majority-vote merge
       |
Verify PR description (automatic)
       |
Merge violations, deduplicate by (file, line)
Skip lines already commented from previous pushes
       |
Post PR review with inline comments
REQUEST_CHANGES if violations, COMMENT if clean
Dismiss old blocking reviews when violations are fixed

curl -X POST https://api.airaproof.com/api/v1/policies \
  -H "Authorization: Bearer $AIRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "HIPAA Compliance",
    "mode": "ai",
    "priority": 100,
    "ai_models": ["claude-opus-4-8"],
    "ai_prompt": "Review for HIPAA PHI violations:\n\n1. No PHI in logs (names, DOB, SSN, diagnoses, medications)\n2. No PHI in error messages\n3. No PHI over HTTP — must use HTTPS\n4. No plaintext PHI storage — encrypt at rest\n5. Access control on patient records\n6. Minimum necessary — only access needed PHI fields\n7. Audit trail on every PHI access\n8. Cache TTL on PHI — no indefinite caching",
    "conditions": [
      {"field": "action_type", "op": "eq", "value": "pr_code_scan"},
      {"field": "agent_id", "op": "contains", "value": "acme/patient-portal"}
    ],
    "decision": "deny"
  }'

pii_in_logs (Critical)

Patient SSN and diagnosis logged via logger.info(). PHI must
never appear in logs — log only de-identified references.

curl -X POST https://api.airaproof.com/api/v1/policies \
  -H "Authorization: Bearer $AIRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Legal Data Protection",
    "mode": "ai",
    "priority": 100,
    "ai_models": ["claude-opus-4-8"],
    "ai_prompt": "Review code handling legal documents:\n\n1. No privilege leakage to logs, analytics, or third-party APIs\n2. Document classification check before sharing\n3. No unreviewed sharing with external APIs (LLMs, search)\n4. Retention compliance — no hard deletes without retention check\n5. Access logging on every document access\n6. Encryption at rest\n7. Tenant isolation — cross-client access is a violation",
    "conditions": [
      {"field": "action_type", "op": "eq", "value": "pr_code_scan"},
      {"field": "agent_id", "op": "contains", "value": "acme/legal-platform"}
    ],
    "decision": "deny"
  }'

privilege_sent_to_llm (Critical)

Document content sent to OpenAI API without checking privilege
status. Attorney-client content must never reach third parties.

curl -X POST https://api.airaproof.com/api/v1/policies \
  -H "Authorization: Bearer $AIRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Financial Compliance",
    "mode": "ai",
    "priority": 100,
    "ai_models": ["claude-opus-4-8"],
    "ai_prompt": "Review for SOX and PCI-DSS compliance:\n\n1. Decimal for money — not float\n2. Audit trail on every transaction\n3. Dual authorization on high-value operations\n4. No full card numbers or CVVs in logs or storage\n5. Separation of duties — no self-approval\n6. Reconciliation events on financial mutations\n7. Explicit currency codes on all amounts\n8. Idempotency keys on payment operations",
    "conditions": [
      {"field": "action_type", "op": "eq", "value": "pr_code_scan"},
      {"field": "agent_id", "op": "contains", "value": "acme/payments"}
    ],
    "decision": "deny"
  }'

float_for_money (Critical)

Using float for monetary amount. Floating point causes rounding
errors. Use Decimal for financial calculations.

curl -X POST https://api.airaproof.com/api/v1/policies \
  -H "Authorization: Bearer $AIRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "PLAT-847 DOD",
    "mode": "ai",
    "priority": 95,
    "ai_models": ["claude-opus-4-8"],
    "conditions": [
      {"field": "action_type", "op": "eq", "value": "pr_code_scan"},
      {"field": "agent_id", "op": "contains", "value": "acme/backend#42"}
    ],
    "ai_prompt": "Verify these requirements are implemented:\n\n1. Session creation with configurable TTL\n2. Session refresh extends TTL\n3. Revoke session and revoke-all\n4. Encryption at rest\n5. Rate limiting (max 10/hour)\n6. Audit log on create and revoke",
    "decision": "deny"
  }'