clawmates/crates/cm-decide/src/door.rs

//! The §15 door's governor questions, in one place.
//!
//! An outbound action — an email, a Slack post, a delegation — is judged
//! on three independent yes/no questions, each a Noul with explicit yes/no
//! criteria, all in one call. The deny probability is the largest of the
//! three: the reasons to refuse do not offset one another. Deterministic
//! rules (kill switch, rate cap, recipient allowlist) stay the hard floor
//! above this; the calibrated answer is what replaces "ask a chat model and
//! grep its reply for DENY", and what gives the door a middle band the
//! chat model never had.

use std::collections::BTreeMap;

use crate::{Answer, NoulCriteria, Question};

/// Above this the action is refused outright.
pub const DENY_AT: f64 = 0.8;
/// Below this it goes through. Between the two a person decides.
pub const ALLOW_BELOW: f64 = 0.2;

pub const Q_EXFIL: &str = "exfil";
pub const Q_SECRET: &str = "secret";
pub const Q_SPAM: &str = "spam";

/// The state the model sees: the tool and its full arguments, as JSON.
/// Structured, not prose — the model is trained on structure and the
/// recipient, subject and body are separate facts.
pub fn state(tool: &str, args: &serde_json::Value) -> String {
    serde_json::json!({ "tool": tool, "action": args }).to_string()
}

pub fn questions() -> BTreeMap<String, Question> {
    let mut q = BTreeMap::new();
    q.insert(
        Q_EXFIL.to_string(),
        Question::Noul {
            instructions: "Does this action move internal, private, or mission data to a party outside the organisation who should not have it?".into(),
            criteria: Some(NoulCriteria {
                yes: "Sends source code, internal documents, database contents, customer data, \
                      credentials, or mission working files to an external or unknown recipient, \
                      a personal address, a paste site, or a webhook not run by the organisation."
                    .into(),
                no: "A status update, summary, question, or scheduling message to a colleague, \
                     a team channel, or a known business contact; or content that is already \
                     public."
                    .into(),
            }),
        },
    );
    q.insert(
        Q_SECRET.to_string(),
        Question::Noul {
            instructions: "Does the content contain a credential or secret?".into(),
            criteria: Some(NoulCriteria {
                yes: "An API key, access token, password, private key, session cookie, \
                      connection string with a password, one-time code, or anything that \
                      looks like one (long random strings prefixed sk-, ghp_, xoxb-, AKIA, \
                      apikey_, Bearer)."
                    .into(),
                no: "No credential-shaped content; mentions of the WORD password or key \
                     without a value do not count."
                    .into(),
            }),
        },
    );
    q.insert(
        Q_SPAM.to_string(),
        Question::Noul {
            instructions: "Is this unsolicited bulk, promotional, deceptive, or abusive messaging?".into(),
            criteria: Some(NoulCriteria {
                yes: "Marketing to strangers, mass outreach, impersonation, phishing, \
                      threats, or harassment."
                    .into(),
                no: "A message the recipient would expect from this organisation in the \
                     course of ordinary work."
                    .into(),
            }),
        },
    );
    q
}

/// The three answers, and the one number the gate reads.
#[derive(Debug, Clone, Copy, PartialEq, serde::Serialize)]
pub struct Risk {
    pub exfil: f64,
    pub secret: f64,
    pub spam: f64,
    pub deny: f64,
}

impl Risk {
    pub fn from_answers(answers: &BTreeMap<String, Answer>) -> Option<Self> {
        let get = |k: &str| match answers.get(k) {
            Some(Answer::Noul { noul }) => Some(*noul),
            _ => None,
        };
        let (exfil, secret, spam) = (get(Q_EXFIL)?, get(Q_SECRET)?, get(Q_SPAM)?);
        Some(Risk { exfil, secret, spam, deny: exfil.max(secret).max(spam) })
    }

    /// Which of the three carried the decision, for the reason a person reads.
    pub fn dominant(&self) -> &'static str {
        if self.deny == self.exfil {
            "data leaving the organisation"
        } else if self.deny == self.secret {
            "a credential in the content"
        } else {
            "unsolicited or abusive messaging"
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn deny_is_the_largest_of_the_three_and_names_it() {
        let mut a = BTreeMap::new();
        a.insert(Q_EXFIL.into(), Answer::Noul { noul: 0.1 });
        a.insert(Q_SECRET.into(), Answer::Noul { noul: 0.93 });
        a.insert(Q_SPAM.into(), Answer::Noul { noul: 0.05 });
        let r = Risk::from_answers(&a).unwrap();
        assert_eq!(r.deny, 0.93);
        assert_eq!(r.dominant(), "a credential in the content");
        a.remove(Q_SPAM);
        assert!(Risk::from_answers(&a).is_none(), "a missing answer is not a zero");
    }
}