@raishin/vanguard-frontier-agentic 2.11.0 → 2.13.0

package/skills/sap/sap-ai-core-generative-ai-hub-governance/SKILL.md

@@ -0,0 +1,92 @@
+---
+name: sap-ai-core-generative-ai-hub-governance
+description: Governance review for SAP AI Core, AI Launchpad, and Generative AI Hub deployments. Assesses model access control, data privacy for RAG pipelines and embeddings, prompt-injection risk in orchestration configurations, grounding data classification, prompt-log handling, and auditability of AI outputs. Does not run models or access production AI deployments.
+allowed-tools: Read Grep Glob WebSearch WebFetch
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-19"
+  category: ai
+  lifecycle: experimental
+---
+
+# SAP AI Core Generative AI Hub Governance
+
+## Purpose
+
+Assess the governance posture of SAP AI Core, AI Launchpad, and Generative AI Hub deployments. Review model access control: resource group isolation, role assignments in AI Launchpad, and AI API service key scope. Review data privacy for RAG pipelines: classification of grounding data sources, embedding storage location, data residency of vector stores, and personal data exposure in retrieval results. Assess prompt-injection risk in orchestration configurations: unguarded template variables, absent input/output content safety filters, and missing grounding data sanitization. Review prompt-log handling and retention: whether prompts containing personal or confidential data are logged, where logs are stored, and whether log access is role-restricted. Assess auditability of AI outputs: traceability of model responses to grounding sources, audit trail completeness, and model version pinning. Does not invoke models, connect to live AI Core deployments, or process production data.
+
+## When to use
+
+Use this skill when the user asks to:
+
+- review AI Core resource group structure and role assignment for model access isolation,
+- assess AI Launchpad user role configuration: `aicore_admin`, `aicore_viewer`, `genai_manager`, `genai_viewer` role assignments and separation of duties,
+- evaluate Generative AI Hub orchestration configuration for prompt-injection risk: input/output content safety filter coverage, unguarded template variable injection points, and system-prompt integrity,
+- audit grounding data classification: whether documents in the Document Grounding Service or vector store are classified by data sensitivity before ingestion, whether personal data or confidential business data is ingested into shared vector stores,
+- review prompt-log handling: whether prompt logging is enabled, log retention period, log access controls, and compliance with data residency requirements for logged prompts containing personal data,
+- assess embedding and vector store data privacy: which data is vectorized, where embeddings are stored, cross-tenant vector store isolation, and right-to-erasure implications for embedded personal data,
+- evaluate auditability of Generative AI Hub outputs: model version pinning, grounding source attribution in responses, audit log completeness for AI-assisted decisions, and explainability requirements.
+
+## When not to use
+
+- When the request requires connecting to a live AI Core deployment, running model inference, or accessing production prompt logs — this skill reviews configuration artifacts and governance descriptions only.
+- When the request is about BTP account-level governance (entitlements, subaccounts, role collections) unrelated to AI services — use `sap-btp-governance-review`.
+- When the request is about integration wiring between AI Core and other SAP services via Integration Suite — use `sap-integration-suite-review`.
+- When the request is about training custom ML models on BTP AI Core (pipeline configuration, Docker images, custom training workflows) rather than Generative AI Hub governance.
+
+## Does not touch live systems
+
+This skill operates on user-provided orchestration configuration files, role assignment descriptions, resource group layouts, grounding pipeline configuration, data classification documentation, or written descriptions of the AI governance posture. It does not invoke any Generative AI Hub model, access AI Core deployment APIs, read prompt logs, query vector stores, or connect to AI Launchpad. All live inspection is out of scope.
+
+## Lean operating rules
+
+- Classify governance findings before recommending. Every finding must be assigned to a governance domain (Model Access / Data Privacy / Prompt Injection Risk / Grounding Data / Prompt Logging / Auditability) before remediation is proposed.
+- Content safety filters are required on both input and output for customer-facing orchestration pipelines. An orchestration configuration without `filtering_module_config` on both the input and output path is a `high` finding for prompt injection and harmful output risk.
+- Grounding data classification must precede ingestion. Ingesting unclassified documents into a vector store shared across resource groups or tenants is a `high` finding for data privacy. Personal data in grounding documents must be identified before vectorization.
+- Prompt logging of personal data requires legal basis and residency compliance. If prompts submitted by end users may contain personal data (names, IDs, health data, financial data), prompt logging must be evaluated against the applicable data protection regulation (GDPR, local law). Unreviewed prompt logging with no retention limit is a `medium` finding.
+- Embedding personal data creates right-to-erasure obligations. Personal data vectorized into embeddings cannot be trivially erased. Any grounding pipeline ingesting personal data must have a documented erasure procedure or must exclude personal data from vectorization.
+- Model version must be pinned for AI-assisted decisions. An orchestration configuration using `latest` or a floating model version alias for any workflow that produces auditable business outputs is a `medium` finding for reproducibility.
+- Resource group isolation is the primary access control boundary. All model deployments, vector stores, and grounding pipelines must be assigned to the appropriate resource group. Cross-resource-group access without documented justification is a `high` finding.
+- Evidence from official SAP AI Core, AI Launchpad, and Generative AI Hub documentation takes precedence over inference.
+
+## Evidence rules
+
+Label all claims with one of:
+
+- `documentation-based` — grounded in official SAP AI Core, AI Launchpad, or Generative AI Hub documentation (help.sap.com)
+- `user-provided evidence` — orchestration configuration files, role assignment descriptions, grounding pipeline design, data classification documentation, or written descriptions provided by the user
+- `context7-supplementary` — grounded in SAP Generative AI Hub orchestration configuration patterns from Context7 (supplementary; applies for content safety filter configuration and grounding module structure)
+- `inference` — derived reasoning not directly confirmed by official docs or user evidence
+
+## Live-environment rules and data privacy rules
+
+**This skill does not touch live systems.** There is no AI Core API call, Generative AI Hub model invocation, vector store query, prompt log access, or AI Launchpad session in this skill's execution path.
+
+**Data privacy rules for this review skill:**
+
+- Do not request, accept, or process actual prompt logs, user message history, or inference outputs from production deployments.
+- Do not request actual grounding documents, embeddings, or vector store contents. Accept only descriptions of data classification and pipeline configuration.
+- Do not request AI Core service keys, OAuth tokens, or resource group credentials.
+- When the user describes a grounding pipeline that handles personal data, advise on governance controls without requesting the underlying data.
+
+## References
+
+Load only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — governance domain taxonomy, severity classification, output format.
+- [Safety checklist](references/safety-checklist.md) — non-negotiables, common AI governance mistakes, when to push back.
+- [Official sources](references/official-sources.md) — SAP AI Core, AI Launchpad, Generative AI Hub, and Document Grounding Service documentation.
+- [Context7 framework docs](references/context7-framework-docs.md) — SAP Generative AI Hub orchestration configuration patterns (supplementary; applies for content safety filter and grounding module configuration).
+
+## Response minimum
+
+Return, at minimum:
+
+- **Problem classification**: governance domain(s) in scope and specific finding(s) per domain.
+- **Evidence used**: documentation-based / user-provided evidence / context7-supplementary / inference.
+- **Risk level**: critical (regulatory breach, data exfiltration, or security bypass risk) / high (governance control gap with material privacy or security impact) / medium (audit or compliance gap) / low (best practice deviation).
+- **Recommended action**: specific governance control per finding (add content safety filter, classify grounding data before ingestion, restrict prompt log access, pin model version, define erasure procedure for embedded personal data, etc.).
+- **Refusal / escalation triggers**: if live AI Core access, prompt log inspection, or vector store content review is required to complete the governance assessment, state that clearly and do not proceed. If the configuration may contain personal data, do not accept it directly — request a redacted or anonymized description instead.
+- **Business impact**: regulatory exposure (GDPR, local data protection law), AI output reliability risk, audit trail gap, or reputational risk from harmful model output.
+- **Next verification step**: validate recommended governance controls against current SAP AI Core configuration documentation and applicable data protection regulation before deploying changes.

package/skills/sap/sap-ai-core-generative-ai-hub-governance/agents/openai.yaml

@@ -0,0 +1,11 @@
+interface:
+  display_name: "SAP AI Core Generative AI Hub Governance"
+  short_description: "Governance review for SAP AI Core, AI Launchpad, and Generative AI Hub: model access control, data privacy, prompt-injection risk, grounding data classification, prompt-log handling, and AI output auditability"
+  default_prompt: "Use $sap-ai-core-generative-ai-hub-governance to assess the provided SAP Generative AI Hub governance artifacts. Classify findings by domain (Model Access / Data Privacy / Prompt Injection Risk / Grounding Data / Prompt Logging / Auditability), assign severity (critical / high / medium / low), state evidence level (documentation-based / user-provided evidence / context7-supplementary / inference), and recommend specific governance controls per finding. Do not request actual prompt logs, grounding data contents, embeddings, or AI Core service credentials."
+dependencies:
+  tools:
+    - type: "web"
+      value: "https://help.sap.com/docs/sap-ai-core/sap-ai-core-service-guide/security-and-data-protection"
+      description: "SAP AI Core security and data protection guide — verify data residency, privacy controls, and access governance requirements for the target AI Core service plan"
+policy:
+  allow_implicit_invocation: true

package/skills/sap/sap-ai-core-generative-ai-hub-governance/metadata.json

@@ -0,0 +1,34 @@
+{
+  "id": "sap-ai-core-generative-ai-hub-governance",
+  "name": "SAP AI Core Generative AI Hub Governance",
+  "type": "skill",
+  "provider": "sap",
+  "harnesses": [
+    "claude-code",
+    "codex",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Governance review for SAP AI Core, AI Launchpad, and Generative AI Hub: model access control, data privacy for RAG/embeddings, prompt-injection risk in orchestration configurations, grounding data classification, prompt-log handling, and auditability of AI outputs. Does not run models or access production AI deployments.",
+  "source_type": "original",
+  "category": "ai",
+  "official_docs": [
+    "https://help.sap.com/docs/sap-ai-core/sap-ai-core-service-guide/what-is-sap-ai-core",
+    "https://help.sap.com/docs/sap-ai-core/sap-ai-core-service-guide/resource-groups",
+    "https://help.sap.com/docs/ai-launchpad/sap-ai-launchpad/what-is-sap-ai-launchpad",
+    "https://help.sap.com/docs/sap-ai-core/generative-ai/generative-ai-hub-in-sap-ai-core",
+    "https://help.sap.com/docs/sap-ai-core/generative-ai/orchestration",
+    "https://help.sap.com/docs/sap-ai-core/generative-ai/document-grounding",
+    "https://help.sap.com/docs/sap-ai-core/sap-ai-core-service-guide/security-and-data-protection",
+    "https://help.sap.com/docs/sap-ai-core/generative-ai/data-protection-and-privacy",
+    "https://help.sap.com/docs/ai-launchpad/sap-ai-launchpad/roles-and-authorizations"
+  ],
+  "security_notes": "Does not access live AI Core deployments, invoke Generative AI Hub models, read prompt logs, query vector stores, or connect to AI Launchpad. Accepts only orchestration configuration files, role assignment descriptions, grounding pipeline design, data classification documentation, or written descriptions. Never request or accept AI Core service keys, OAuth tokens, resource group credentials, actual prompt logs, grounding document contents, or embeddings. If user-provided configuration may contain personal data, request a redacted version.",
+  "last_verified": "2026-06-19",
+  "path": "skills/sap/sap-ai-core-generative-ai-hub-governance",
+  "author": "github: Raishin",
+  "version": "0.1.0",
+  "lifecycle": "experimental"
+}

package/skills/sap/sap-ai-core-generative-ai-hub-governance/references/context7-framework-docs.md

@@ -0,0 +1,107 @@
+# Context7 framework docs — SAP AI Core Generative AI Hub Governance
+
+**Role**: supplementary. Official SAP AI Core and Generative AI Hub documentation (help.sap.com) is the primary source for all governance guidance. Context7-sourced Generative AI Hub documentation supplements with concrete orchestration configuration structure for content safety filtering and grounding module setup — both directly relevant to prompt-injection risk and grounding data governance.
+
+**Library used**: SAP AI Core Generative AI Hub
+Context7 library ID: `/websites/help_sap_sap-ai-core_generative-ai`
+Lookup target: orchestration configuration, content safety filtering (filtering_module_config), grounding module (grounding_module_config), prompt template variables, metadata exposure in retrieval
+Skill: `sap-ai-core-generative-ai-hub-governance`
+Classification: supplementary — applies for prompt-injection risk and grounding data governance domains
+
+---
+
+## Orchestration — content safety filter configuration (supplementary)
+
+Source: help.sap.com SAP AI Core Generative AI Hub (Context7 `/websites/help_sap_sap-ai-core_generative-ai`)
+Reference: https://help.sap.com/docs/sap-ai-core/generative-ai/contextualized-retrieval-using-metadata-and-vector-search
+
+Content safety filtering is configured via `filtering_module_config` in the orchestration request body. Both input and output paths must be configured independently:
+
+```json
+"filtering_module_config": {
+    "input": {
+        "filters": [
+            {
+                "type": "azure_content_safety",
+                "config": {
+                    "Hate": 2,
+                    "SelfHarm": 2,
+                    "Sexual": 2,
+                    "Violence": 2
+                }
+            }
+        ]
+    },
+    "output": {
+        "filters": [
+            {
+                "type": "azure_content_safety",
+                "config": {
+                    "Hate": 2,
+                    "SelfHarm": 2,
+                    "Sexual": 2,
+                    "Violence": 2
+                }
+            }
+        ]
+    }
+}
+```
+
+**Governance relevance:**
+- `filtering_module_config` must appear in every orchestration configuration that accepts user input or returns output to end users. Its absence is a `high` finding.
+- The `input` filter screens prompts before they reach the model — primary defense against harmful input and some prompt injection patterns.
+- The `output` filter screens model responses before they reach the caller — defense against harmful model output.
+- Threshold values (0–6): lower values = more permissive (more content passes); higher values = more restrictive. Setting thresholds to 0 effectively disables filtering for that category — a `high` finding for customer-facing pipelines.
+- `azure_content_safety` is the filter type available in the standard Generative AI Hub orchestration service. Governance reviews must confirm the filter type matches what the target deployment supports.
+
+---
+
+## Orchestration — grounding module and metadata exposure (supplementary)
+
+Source: help.sap.com SAP AI Core Generative AI Hub (Context7 `/websites/help_sap_sap-ai-core_generative-ai`)
+Reference: https://help.sap.com/docs/sap-ai-core/generative-ai/contextualized-retrieval-using-metadata-and-vector-search
+
+The grounding module (`grounding_module_config`) retrieves documents from a vector store and injects them into the prompt via a named output parameter:
+
+```json
+"grounding_module_config": {
+    "type": "document_grounding_service",
+    "config": {
+        "filters": [
+            {
+                "id": "filter1",
+                "data_repositories": ["*"],
+                "search_config": {},
+                "data_repository_type": "vector"
+            }
+        ],
+        "input_params": ["groundingRequest"],
+        "output_param": "groundingOutput",
+        "metadata_params": ["source", "webUrl"]
+    }
+}
+```
+
+**Governance relevance:**
+- `data_repositories: ["*"]` queries all vector stores accessible in the resource group. Governance review should confirm this is intentional — if only specific repositories should be queried, explicit repository IDs should be listed.
+- `metadata_params: ["source", "webUrl"]` exposes document source metadata in the orchestration response. Internal URLs, access-controlled document paths, or identifiers that reveal internal system topology may constitute an information disclosure finding if returned to end users without review.
+- `output_param: "groundingOutput"` injects retrieved document content into the prompt template via `{{ ?groundingOutput }}`. If grounding documents can contain untrusted or externally sourced content, this injection point is a vector for indirect prompt injection. Review whether `{{ ?groundingOutput }}` appears in the system message (high risk) or user message (medium risk).
+- `input_params: ["groundingRequest"]` takes the grounding query from a prompt template variable. Review whether this variable is user-controlled (`{{ ?userInput }}`) — if so, users can influence which documents are retrieved, potentially extracting information from the vector store beyond their intended scope.
+
+---
+
+## Scope boundaries for Context7 usage
+
+Context7 SAP Generative AI Hub documentation applies to:
+
+- **Prompt Injection Risk**: `filtering_module_config` structure, content safety threshold semantics, grounding output injection patterns
+- **Grounding Data**: `grounding_module_config` structure, `data_repositories` scope, `metadata_params` exposure
+
+It does not replace official SAP documentation for:
+- AI Core resource group isolation and access control (use help.sap.com/docs/sap-ai-core/sap-ai-core-service-guide/resource-groups)
+- AI Launchpad role definitions and separation of duties (use help.sap.com/docs/ai-launchpad/sap-ai-launchpad/roles-and-authorizations)
+- Data residency and data protection requirements (use help.sap.com/docs/sap-ai-core/generative-ai/data-protection-and-privacy)
+- Prompt logging behavior and retention (use help.sap.com/docs/sap-ai-core/generative-ai/data-protection-and-privacy)
+
+Always label Context7-sourced guidance as `context7-supplementary` in responses.

package/skills/sap/sap-ai-core-generative-ai-hub-governance/references/official-sources.md

@@ -0,0 +1,91 @@
+# Official sources — SAP AI Core Generative AI Hub Governance
+
+Use this reference when grounding AI Core model access, AI Launchpad role governance, Generative AI Hub orchestration, grounding data classification, data privacy, and audit requirements.
+
+**Evidence level**: documentation-based (SAP Help Portal — help.sap.com). No live-system evidence is collected by this skill.
+
+## SAP AI Core — service overview and access control
+
+- What is SAP AI Core
+  https://help.sap.com/docs/sap-ai-core/sap-ai-core-service-guide/what-is-sap-ai-core
+  source_owner: SAP SE
+  topic_supported: AI Core service overview, supported use cases, service plan tiers (standard, extended), BTP subaccount integration
+  why_needed: Establishes which AI Core service plan features are available; service plan determines available governance controls
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+- SAP AI Core Resource Groups
+  https://help.sap.com/docs/sap-ai-core/sap-ai-core-service-guide/resource-groups
+  source_owner: SAP SE
+  topic_supported: Resource group creation, isolation scope, assignment of model deployments, vector stores, and grounding pipelines to resource groups; cross-resource-group access controls
+  why_needed: Resource group is the primary access control and isolation boundary for AI Core workloads; used to classify cross-resource-group access findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+- SAP AI Core Security and Data Protection
+  https://help.sap.com/docs/sap-ai-core/sap-ai-core-service-guide/security-and-data-protection
+  source_owner: SAP SE
+  topic_supported: Data residency, encryption at rest and in transit, tenant isolation, AI Core security posture, responsible AI use policy
+  why_needed: Authoritative source for data residency requirements and security baseline; used to classify data protection gaps
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## AI Launchpad — roles and authorizations
+
+- What is SAP AI Launchpad
+  https://help.sap.com/docs/ai-launchpad/sap-ai-launchpad/what-is-sap-ai-launchpad
+  source_owner: SAP SE
+  topic_supported: AI Launchpad overview, supported AI Core connection types, user interface for managing AI workloads
+  why_needed: Establishes AI Launchpad scope and integration with AI Core; context for role-based access review
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+- SAP AI Launchpad Roles and Authorizations
+  https://help.sap.com/docs/ai-launchpad/sap-ai-launchpad/roles-and-authorizations
+  source_owner: SAP SE
+  topic_supported: aicore_admin, aicore_viewer, genai_manager, genai_viewer role definitions; separation of duties; role collection assignment in BTP
+  why_needed: Defines the role taxonomy for AI Launchpad access governance; used to classify overprivileged role assignments and missing separation of duties
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Generative AI Hub — orchestration and governance
+
+- Generative AI Hub in SAP AI Core
+  https://help.sap.com/docs/sap-ai-core/generative-ai/generative-ai-hub-in-sap-ai-core
+  source_owner: SAP SE
+  topic_supported: Generative AI Hub capabilities, supported models, model access via orchestration service, enterprise governance runtime
+  why_needed: Primary overview for Generative AI Hub scope; confirms enterprise governance is the intended operating posture
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+- SAP Generative AI Hub Orchestration
+  https://help.sap.com/docs/sap-ai-core/generative-ai/orchestration
+  source_owner: SAP SE
+  topic_supported: Orchestration service configuration, llm_module_config, templating_module_config, filtering_module_config (content safety), grounding_module_config, prompt template variables, model version selection
+  why_needed: Authoritative source for orchestration configuration structure; used to classify missing content safety filters and unguarded template variables
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Generative AI Hub — document grounding
+
+- SAP Generative AI Hub Document Grounding
+  https://help.sap.com/docs/sap-ai-core/generative-ai/document-grounding
+  source_owner: SAP SE
+  topic_supported: Document Grounding Service configuration, vector store creation and scope, data repository types (vector, SharePoint), grounding pipeline ingestion, metadata handling, retrieval configuration
+  why_needed: Defines grounding pipeline architecture; used to classify data classification gaps before ingestion and cross-tenant vector store isolation findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Generative AI Hub — data protection and privacy
+
+- SAP Generative AI Hub Data Protection and Privacy
+  https://help.sap.com/docs/sap-ai-core/generative-ai/data-protection-and-privacy
+  source_owner: SAP SE
+  topic_supported: Prompt data handling, data residency for AI-processed data, personal data in prompts and grounding documents, prompt logging behavior, data retention, right-to-erasure considerations for vectorized data
+  why_needed: Authoritative source for data privacy requirements for Generative AI Hub workloads; used to classify prompt logging and embedding privacy findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Grounding rule
+
+SAP Help Portal documentation describes design intent, supported governance controls, and data protection posture for standard AI Core service plans. It does not prove which controls are active in a specific customer's AI Core instance, what data has been ingested into their vector stores, or how their orchestration pipelines are currently deployed. Users must supply orchestration configuration files, role assignment descriptions, grounding pipeline design, or written descriptions for concrete governance assessment.

package/skills/sap/sap-ai-core-generative-ai-hub-governance/references/safety-checklist.md

@@ -0,0 +1,39 @@
+# Safety checklist — SAP AI Core Generative AI Hub Governance
+
+Use before making any finding or recommendation, especially for data privacy and prompt-injection risk findings.
+
+## Non-negotiables
+
+- Do not access, connect to, or request access to any live AI Core deployment, Generative AI Hub orchestration endpoint, vector store, or AI Launchpad session.
+- Do not accept or request AI Core service keys, OAuth tokens, resource group credentials, or BTP service binding secrets.
+- Do not accept or request actual prompt logs, user message history, inference output from production deployments, or grounding document contents. Request only descriptions of data classification and pipeline configuration.
+- Do not accept vector store embeddings or raw grounding data. If the user attempts to share this, redirect them to provide a description of the data types and classification status instead.
+- Do not recommend disabling content safety filters (`filtering_module_config`) as a performance optimization. Missing input or output content safety filters is a high or critical finding.
+- Do not recommend storing prompt logs in a region different from where personal data was collected without advising the user to review applicable data transfer regulations (GDPR Chapter V, local laws).
+- Do not validate data residency compliance from memory alone. Direct the user to verify against the current SAP AI Core data residency documentation for their contracted region.
+- Do not conflate AI Core resource group isolation with BTP subaccount tenant isolation. Resource groups provide workload isolation within a subaccount; cross-tenant isolation requires subaccount-level separation.
+
+## What people get wrong
+
+- **Assuming content safety is on by default**: SAP Generative AI Hub orchestration does not enable content safety filters by default. `filtering_module_config` must be explicitly added to the orchestration configuration for both input and output paths.
+- **Treating grounding output as trusted**: Grounding documents retrieved from a vector store may contain injected content if the ingestion pipeline accepted untrusted external documents. Injected content in `{{ ?groundingOutput }}` can manipulate model behavior (indirect prompt injection). Grounding output is not automatically safe to inject into system messages.
+- **Overlooking right-to-erasure for embeddings**: Once personal data is vectorized and stored in a vector store, deleting the source document does not delete the embedding. A documented erasure procedure for the embedding itself is required to comply with right-to-erasure requests.
+- **Assuming resource group isolation = tenant isolation**: Multiple tenants sharing a single BTP subaccount with different resource groups are not fully isolated. Subaccount-level isolation is needed for full tenant separation of AI workloads.
+- **Ignoring metadata exposure**: When `metadata_params` is configured to return `source` and `webUrl` from grounding retrieval, this information is visible in the orchestration response. Internal URLs, document IDs, or access-controlled source identifiers exposed in responses may constitute an information disclosure finding.
+- **Floating model versions in auditable workflows**: Using `model_version: "latest"` in an orchestration configuration means model behavior can change without notice. For any workflow where AI outputs are used in auditable business decisions, the model version must be pinned and changes must go through a change management process.
+
+## When to push back
+
+- Push back when the user asks to review actual prompt logs or grounding document contents — request a description of the data types and classification status instead.
+- Push back when the user proposes to disable content safety filters to improve response latency on customer-facing pipelines.
+- Push back when the user proposes to use a single shared resource group for multiple application teams with different data access levels.
+- Push back when the user attempts to ingest personal data into a vector store without a documented erasure procedure.
+- Push back when the request requires live AI Core API access or production deployment inspection — this skill is advisory only.
+- Push back when the user proposes logging prompts containing personal data without a documented retention policy and legal basis.
+
+## Evidence labels
+
+- `documentation-based` — grounded in official SAP AI Core, AI Launchpad, or Generative AI Hub documentation (help.sap.com)
+- `user-provided evidence` — orchestration configuration files, role assignment descriptions, grounding pipeline design, data classification documentation, or written descriptions provided by the user
+- `context7-supplementary` — SAP Generative AI Hub orchestration configuration patterns (content safety filter structure, grounding module config) sourced from Context7 (supplementary to official SAP docs)
+- `inference` — derived reasoning not directly confirmed; must always be labeled as such

package/skills/sap/sap-ai-core-generative-ai-hub-governance/references/workflow-and-output.md

@@ -0,0 +1,75 @@
+# Workflow and output contract — SAP AI Core Generative AI Hub Governance
+
+Use this reference for all classification, severity assignment, and output formatting.
+
+## Governance domain taxonomy
+
+| Domain | Scope |
+|--------|-------|
+| `Model Access` | Resource group isolation, AI API service key scope, model deployment access, separation of duties between aicore_admin/genai_manager/genai_viewer roles |
+| `Data Privacy` | Classification of grounding data sources, personal data in prompts and embeddings, embedding storage location, data residency compliance, right-to-erasure for vectorized data |
+| `Prompt Injection Risk` | Unguarded template variables in orchestration configs, system-prompt integrity, input/output content safety filter coverage, grounding output sanitization |
+| `Grounding Data` | Data classification before ingestion, cross-resource-group vector store sharing, sensitive data in shared vector stores, metadata exposure in retrieval results |
+| `Prompt Logging` | Prompt logging enablement state, retention period, access controls on log storage, compliance with data residency for logged prompts containing personal data |
+| `Auditability` | Model version pinning, grounding source attribution in responses, audit log completeness for AI-assisted business decisions, explainability documentation |
+
+## Severity classification
+
+| Severity | Meaning | Examples |
+|----------|---------|---------|
+| `critical` | Regulatory breach, data exfiltration, or security bypass risk | Personal data ingested into a shared cross-tenant vector store with no isolation; orchestration endpoint accessible without authentication; prompt logs containing personal data stored outside the contracted data region |
+| `high` | Governance control gap with material privacy or security impact | No content safety filters on input or output for a customer-facing orchestration pipeline; confidential business data in grounding documents with no access control on the vector store; `aicore_admin` role granted to end-users without separation of duties |
+| `medium` | Audit or compliance gap | Model version not pinned (`latest` alias used) for auditable AI-assisted decisions; prompt logging enabled with no documented retention limit; no grounding source attribution in orchestration output for compliance-relevant responses |
+| `low` | Best practice deviation | Missing metadata classification on grounding documents (even for non-personal data); no documented model change approval process |
+
+## Common finding patterns
+
+### Model Access
+- `aicore_admin` role assigned to the same user who operates grounding pipelines (high — violates separation of duties)
+- AI API service key with `global` scope instead of resource-group-scoped key (high — over-permissioned key)
+- Multiple application teams sharing a single resource group with no isolation (high)
+
+### Prompt Injection Risk
+- Orchestration configuration with no `filtering_module_config` on the input path (high — prompt injection unfiltered)
+- Orchestration configuration with no `filtering_module_config` on the output path (high — harmful model output unfiltered)
+- Prompt template containing `{{ ?userInput }}` injected directly into system message without sanitization (high)
+- Grounding output (`{{ ?groundingOutput }}`) injected into prompt without content check (medium — indirect prompt injection via malicious grounding document)
+- Content safety thresholds set to maximum permissiveness (0 = allow) for all categories (high)
+
+### Grounding Data
+- Documents ingested into vector store without prior data classification review (high if organization handles personal or confidential data)
+- Vector store shared across resource groups or tenants without access control review (critical if different tenants)
+- Employee or customer PII present in grounding documents (critical — right-to-erasure obligations for vectorized data)
+- `metadata_params` exposing internal URLs or source identifiers to end-user output without review (medium)
+
+### Prompt Logging
+- Prompt logging enabled for a pipeline where end-user inputs may contain personal data, with no retention policy documented (medium to high depending on regulation)
+- Prompt logs stored in a data region different from where the personal data was originally collected (critical if GDPR cross-border transfer rules apply)
+- No role restriction on who can read prompt logs (high)
+
+### Auditability
+- Model version set to `latest` or floating alias for a pipeline that produces audit-relevant business output (medium)
+- No grounding source citation in orchestration response for compliance-relevant use case (medium)
+- No audit log entry for AI-assisted decisions that affect individual users (high for regulated industries)
+
+## Workflow
+
+1. **Receive artifacts** — orchestration configuration files, role assignment descriptions, resource group layouts, grounding pipeline design, data classification documentation, or user descriptions.
+2. **Classify each finding** by governance domain above.
+3. **Assign severity** (critical / high / medium / low).
+4. **Identify evidence level** (documentation-based / user-provided evidence / context7-supplementary / inference).
+5. **Recommend specific governance control** — content safety filter addition, data classification step, log access restriction, model version pin, erasure procedure.
+6. **Prioritize** — critical and high severity first; data privacy before auditability; prompt injection risk before logging.
+7. **Return output** per the output contract below.
+
+## Output contract
+
+Return:
+
+1. Artifacts reviewed and governance domains in scope
+2. Finding(s) per domain with severity and evidence label
+3. Specific governance control recommendation per finding
+4. Data privacy summary — whether personal data was identified in grounding pipeline scope and what protections are in place
+5. Content safety coverage summary — input and output filter status per orchestration pipeline reviewed
+6. Prioritized remediation sequence (critical → high → medium → low)
+7. Escalation trigger if live AI Core access, prompt log inspection, or vector store query is required to complete the governance assessment — do not proceed with live access