Security Model¶

AG2Trust is built with enterprise security requirements in mind. This document covers the security architecture and features.

Security Overview¶

┌─────────────────────────────────────────────────────────────┐
│                    Security Layers                           │
├─────────────────────────────────────────────────────────────┤
│  Edge: Cloudflare WAF, DDoS Protection                      │
├─────────────────────────────────────────────────────────────┤
│  Transport: TLS 1.2+, HTTPS everywhere                      │
├─────────────────────────────────────────────────────────────┤
│  Authentication: Firebase JWT, API Keys                      │
├─────────────────────────────────────────────────────────────┤
│  Authorization: RBAC, Resource isolation                     │
├─────────────────────────────────────────────────────────────┤
│  Data: KMS encryption, PII redaction                        │
├─────────────────────────────────────────────────────────────┤
│  Runtime: Container isolation, Network segmentation          │
└─────────────────────────────────────────────────────────────┘

Authentication¶

Dashboard Authentication¶

The AG2Trust Dashboard uses Firebase Authentication:

Email/password login
Google OAuth 2.0
Session management with secure tokens
Automatic token refresh

API Authentication¶

The Customer API uses API key authentication:

curl -H "X-API-Key: cust_xxx" https://agents.ag2trust.com/api/v1/...

API Key Security:

Measure	Implementation
Storage	Bcrypt hash (never plain text)
Caching	Redis cache with 5-minute TTL
Format	`cust_` prefix + 32+ character token
Revocation	Immediate effect

Authorization (RBAC)¶

Role Hierarchy¶

Owner (most privileged)
  └── Admin
      └── Member
          └── Viewer (least privileged)

Permission Matrix¶

Action	Owner	Admin	Member	Viewer
View resources	Yes	Yes	Yes	Yes
Create/edit agents	Yes	Yes	Yes	No
Manage teams	Yes	Yes	Yes	No
Manage users	Yes	Yes	No	No
Manage providers	Yes	Yes	No	No
Manage API keys	Yes	No	No	No
Billing access	Yes	No	No	No
Delete organization	Yes	No	No	No

Resource Isolation¶

All resources are scoped by organization (customer_id):

Agents belong to organizations, not users
Queries always filter by customer_id
Cross-organization access is impossible

Data Encryption¶

At Rest¶

Provider Credentials (API Keys):

┌─────────────────────────────────────────────┐
│         KMS Envelope Encryption              │
│                                              │
│  1. Generate random DEK (AES-256)           │
│  2. Encrypt credential with DEK             │
│  3. Wrap DEK with KMS master key            │
│  4. Store: encrypted_credential + wrapped_DEK│
└─────────────────────────────────────────────┘

Database:

PostgreSQL with encrypted connections (SSL required)
Managed database with automatic encryption at rest

In Transit¶

Connection	Encryption
Client → Cloudflare	TLS 1.2+
Cloudflare → Origin	TLS 1.2+ (Full Strict)
Backend → Database	SSL required
Backend → Redis	Internal network
Agent → LLM Provider	TLS 1.2+

PII Protection¶

Audit Log Redaction¶

The Audit Service automatically redacts PII before logging:

Input:  "My email is john@example.com and SSN is 123-45-6789"
Output: "My email is [EMAIL] and SSN is [US_SSN]"

Detected PII Types:

Email addresses
Phone numbers
US Social Security Numbers
Credit card numbers
IP addresses
Names (when detectable)

Implementation¶

AG2Trust uses Microsoft Presidio for PII detection and redaction:

# Redaction happens in audit-service before database storage
# Original messages are NOT stored

Container Security¶

Agent Isolation¶

Each agent runs in an isolated Docker container:

Security measures:
  - Non-root user execution
  - Read-only /app directory
  - Write access only to /workspace
  - Resource limits (memory, CPU)
  - No privileged capabilities

Network Segmentation¶

┌─────────────────────────────────────────┐
│           ag2trust-internal              │
│  (Redis, PostgreSQL - no internet)       │
├─────────────────────────────────────────┤
│           ag2trust-public                │
│  (LLM API access only)                   │
└─────────────────────────────────────────┘

Agents are dual-homed:
- Internal: Redis messaging
- Public: LLM API calls only

Rate Limiting¶

Defense-in-depth rate limiting:

Layer	Location	Limits
Edge	Cloudflare	100 req/10s per IP
Proxy	Nginx	10/s burst 20
Application	Backend	Varies by endpoint
Agent	Runtime	5 tool calls/min

Audit Logging¶

Agent Audit Logs¶

All agent interactions are logged:

{
  "timestamp": "2025-01-15T10:30:00Z",
  "agent_id": "uuid",
  "customer_id": "uuid",
  "event_type": "message",
  "content": "[REDACTED]",
  "tokens_used": 150,
  "model": "gpt-4o"
}

Note: Content is PII-redacted before storage.

Compliance Audit Logs¶

System events for compliance:

{
  "timestamp": "2025-01-15T10:30:00Z",
  "event_type": "user_login",
  "actor_id": "user-uuid",
  "customer_id": "uuid",
  "ip_address": "[REDACTED]",
  "details": {...}
}

Retention¶

Log Type	Default Retention	Configurable
Agent audit logs	90 days	30-365 days
Compliance logs	7 years	No

Configure retention in Settings > Data Retention.

Data Subject Rights¶

Right	Implementation
Access	Export your data via Settings
Erasure	Delete organization removes all data
Portability	Export in machine-readable format
Rectification	Edit via Dashboard

Data Retention¶

Configurable retention periods (30-365 days)
Automatic cleanup job runs daily
Compliance audit logs retained for 7 years

Data Processing¶

All data processed within your chosen region
No data sharing with third parties (except LLM providers)
LLM providers receive only message content (no PII metadata)

Security Best Practices¶

For Administrators¶

Use strong passwords and unique credentials
Rotate API keys regularly
Limit user roles to minimum necessary
Monitor audit logs for unusual activity
Configure retention per compliance requirements

For Developers¶

Never expose API keys in client-side code
Use environment variables for credentials
Validate webhook signatures for authenticity
Implement retry logic with exponential backoff
Handle rate limits gracefully

For System Prompts¶

# Good: Set boundaries
You must never:
- Share internal information
- Execute harmful commands
- Bypass safety guidelines

# Avoid: No boundaries
You are a helpful assistant (no constraints)

Incident Response¶

Reporting Security Issues¶

If you discover a security vulnerability:

Do not disclose publicly
Email: security@ag2trust.com
Include detailed description
We'll respond within 24 hours

Security Updates¶

Critical patches deployed immediately
Security advisories published as needed
Customers notified of relevant issues

Compliance¶

Current¶

GDPR compliant (EU data protection)
PII redaction in audit logs
Configurable data retention
Audit trail for all actions

Roadmap¶

SOC 2 Type II (planned)
HIPAA BAA (planned)
ISO 27001 (planned)

Security Architecture Diagram¶

                    Internet
                        │
                        ▼
              ┌─────────────────┐
              │   Cloudflare    │
              │  WAF + DDoS     │
              └────────┬────────┘
                       │ TLS
                       ▼
              ┌─────────────────┐
              │     Nginx       │
              │  Rate Limiting  │
              └────────┬────────┘
                       │
         ┌─────────────┼─────────────┐
         │             │             │
         ▼             ▼             ▼
    ┌─────────┐  ┌─────────┐  ┌─────────┐
    │ Backend │  │Customer │  │  Admin  │
    │   API   │  │   API   │  │  Panel  │
    └────┬────┘  └────┬────┘  └────┬────┘
         │            │            │
         └─────────┬──┴────────────┘
                   │
    ┌──────────────┼──────────────┐
    │              │              │
    ▼              ▼              ▼
┌───────┐    ┌─────────┐    ┌─────────┐
│ Redis │    │Postgres │    │   KMS   │
│(intern│    │  (SSL)  │    │(encrypt)│
└───────┘    └─────────┘    └─────────┘
    │
    ▼
┌─────────────────────────────────────┐
│         Agent Containers             │
│  (isolated, non-root, rate-limited) │
└─────────────────────────────────────┘