Security and Governance

Security is built around data sovereignty, access control, auditability, source-grounded answers, OCR review gates, and government communication policy.

Data sovereignty

All document storage, vector DB, model inference, OCR, observability, and prompt management run in client-controlled Huawei Cloud. Delivered operation must not depend on external SaaS or data egress.

Access model

The working roles are admin, operator, and user, with ABAC attributes such as department and document classification refining document-level visibility.

Audit log

The audit log stores actor ID, action, entity type, entity ID, request ID, metadata, and timestamp. It records policy, query, answer, and review events so operational teams can inspect how a response was produced.

Policy Guard

The Government Policy Guard filters every /query and /query/stream answer for anti-SARA, anti-jailbreak, and government communication policy compliance. The explicitly ungrounded POST /generate primitive is an authenticated raw model call outside this guard (ADR-0050).

Detection is deterministic word rules, not a model judge. Anti-SARA requires a protected-group reference and an incitement construction — a phrase that advocates something against people, rather than a hostile word on its own — within a bounded proximity window of adjacent sentences. Requiring the construction is what keeps legitimate work possible: questions and answers about Qanun Jinayat, Mahkamah Syar'iyah jurisdiction, house-of-worship permitting and population statistics by religion all name religious and ethnic groups, and all must be answered. Anti-jailbreak matches disclosure, override, bypass and activation constructions, so an answer that explains what a system prompt is passes.

The guard is measured rather than asserted. make eval-slice SLICE=policy runs the bank's policy slice and reports both a catch rate on inflammatory content and a false-refusal rate on legitimate government content. Coverage is Bahasa Indonesia and English as validated tiers, with best-effort Acehnese that has not been validated by a native speaker. What the guard does not catch — semantic paraphrase, obfuscation, references beyond the adjacent sentence — is listed case by case in ADR-0008.

OCR governance

OCR confidence and model version are recorded so confidence can be interpreted correctly. Low-confidence or non-comparable OCR output routes to review and is excluded from retrieval.

Dependency governance

Every delivered component must use an OSI-approved license. This constraint drives Qwen, PaddleOCR-VL, pgvector, vLLM, Langfuse, Docling Slim, PostgreSQL, Redis, and Kafka choices.