Compliance controls
Six architectural controls that ensure every automated action is governed, traced, and reversible.
Compliance Shadow
Every proposed action is audited before execution. GREEN / YELLOW / RED verdicts with zero-override policy. Automatic execution is allowed only on GREEN.
Kill switch
ASOE_KILL_SWITCH=1 halts all automated execution before any node runs. Zero nodes execute. TraceRecord is still emitted for audit. No process restart required.
Explain mode
ASOE_EXPLAIN_MODE=1 runs the full reasoning pipeline (classify → shadow → select recipe) but stops before execution. Returns a dry-run summary for review.
Circuit breaker
Automatic escalation when thresholds are breached: >50 updates per batch or >$10,000 total variance triggers FAIL_TO_HUMAN. Protects against cascading errors.
Constrained generation
All machine-consumed outputs are constrained via Pydantic Literals. Free-form text never enters state transitions. Intent, verdict, recipe name, and resolution action are all typed.
Full audit trail
Every decision is traced: intent classification, shadow verdict, recipe execution, gateway calls. TraceRecords are JSON-serializable and LangFuse-compatible.
10 execution invariants
Guarantees that hold for every graph execution, documented in the Auditor Guide.
- 1Compliance Shadow always runs before execute_recipe
- 2Kill switch fires before any node runs
- 3Intent is constrained to the allowed enum
- 4Shadow verdict is constrained to GREEN / YELLOW / RED
- 5Recipe name is constrained to registered names only
- 6Recipe parameters are Pydantic-validated
- 7Circuit breaker evaluates before shadow audit
- 8Gateway failures produce FAIL_TO_HUMAN, not partial execution
- 9TraceRecord is emitted on every execution (success or failure)
- 10Explain mode never executes a recipe
Security practices
Data encryption
Data encrypted in transit (TLS 1.3) and at rest. No customer data stored in source code or container images.
Secret management
Azure Key Vault CSI for Kubernetes deployments. Secrets synced to pods via SecretProviderClass — never stored in env var defaults.
Non-root containers
All Docker images run as non-root user (asoe, UID 1000). Minimal base images with deterministic dependency resolution via uv.
Access control
Workload Identity for Azure authentication. No long-lived credentials. Role-based authorization for credit hold releases.