@vorionsys/security 1.0.0

package/dist/intent/classifier/patterns.js

@@ -0,0 +1,471 @@
+/**
+ * Intent Classification Patterns
+ *
+ * Contains known action patterns, resource sensitivity mappings, and pattern matching utilities
+ * for rule-based intent classification in the Vorion AI Governance Platform.
+ */
+/**
+ * Known action patterns with their default risk levels.
+ *
+ * Risk Score Guidelines:
+ * - 0-25: Low risk, routine operations
+ * - 26-50: Medium risk, requires monitoring
+ * - 51-75: High risk, requires review
+ * - 76-100: Critical risk, requires explicit approval
+ */
+export const ACTION_PATTERNS = [
+    // Data Access Patterns
+    {
+        name: 'data:read',
+        pattern: /^data:read$/i,
+        category: 'data-access',
+        defaultRiskScore: 15,
+        defaultRiskTier: 'low',
+        description: 'Read data from a resource',
+    },
+    {
+        name: 'data:write',
+        pattern: /^data:write$/i,
+        category: 'data-access',
+        defaultRiskScore: 35,
+        defaultRiskTier: 'medium',
+        description: 'Write data to a resource',
+    },
+    {
+        name: 'data:delete',
+        pattern: /^data:delete$/i,
+        category: 'data-access',
+        defaultRiskScore: 60,
+        defaultRiskTier: 'high',
+        description: 'Delete data from a resource',
+    },
+    {
+        name: 'data:export',
+        pattern: /^data:export$/i,
+        category: 'data-access',
+        defaultRiskScore: 55,
+        defaultRiskTier: 'high',
+        description: 'Export data from the system',
+    },
+    {
+        name: 'data:import',
+        pattern: /^data:import$/i,
+        category: 'data-access',
+        defaultRiskScore: 40,
+        defaultRiskTier: 'medium',
+        description: 'Import data into the system',
+    },
+    {
+        name: 'data:query',
+        pattern: /^data:query$/i,
+        category: 'data-access',
+        defaultRiskScore: 20,
+        defaultRiskTier: 'low',
+        description: 'Query data from a resource',
+    },
+    // Model Operation Patterns
+    {
+        name: 'model:train',
+        pattern: /^model:train$/i,
+        category: 'model-operation',
+        defaultRiskScore: 45,
+        defaultRiskTier: 'medium',
+        description: 'Train a machine learning model',
+    },
+    {
+        name: 'model:inference',
+        pattern: /^model:inference$/i,
+        category: 'model-operation',
+        defaultRiskScore: 25,
+        defaultRiskTier: 'low',
+        description: 'Run inference on a model',
+    },
+    {
+        name: 'model:deploy',
+        pattern: /^model:deploy$/i,
+        category: 'model-operation',
+        defaultRiskScore: 70,
+        defaultRiskTier: 'high',
+        description: 'Deploy a model to production',
+    },
+    {
+        name: 'model:evaluate',
+        pattern: /^model:evaluate$/i,
+        category: 'model-operation',
+        defaultRiskScore: 20,
+        defaultRiskTier: 'low',
+        description: 'Evaluate model performance',
+    },
+    {
+        name: 'model:finetune',
+        pattern: /^model:finetune$/i,
+        category: 'model-operation',
+        defaultRiskScore: 50,
+        defaultRiskTier: 'medium',
+        description: 'Fine-tune an existing model',
+    },
+    // External Integration Patterns
+    {
+        name: 'external:api',
+        pattern: /^external:api$/i,
+        category: 'external-integration',
+        defaultRiskScore: 40,
+        defaultRiskTier: 'medium',
+        description: 'Call an external API',
+    },
+    {
+        name: 'external:webhook',
+        pattern: /^external:webhook$/i,
+        category: 'external-integration',
+        defaultRiskScore: 35,
+        defaultRiskTier: 'medium',
+        description: 'Send data to a webhook',
+    },
+    {
+        name: 'external:email',
+        pattern: /^external:email$/i,
+        category: 'external-integration',
+        defaultRiskScore: 30,
+        defaultRiskTier: 'medium',
+        description: 'Send an email externally',
+    },
+    {
+        name: 'external:payment',
+        pattern: /^external:payment$/i,
+        category: 'external-integration',
+        defaultRiskScore: 85,
+        defaultRiskTier: 'critical',
+        description: 'Process a payment transaction',
+    },
+    {
+        name: 'external:storage',
+        pattern: /^external:storage$/i,
+        category: 'external-integration',
+        defaultRiskScore: 45,
+        defaultRiskTier: 'medium',
+        description: 'Access external storage service',
+    },
+    // System Configuration Patterns
+    {
+        name: 'system:config:read',
+        pattern: /^system:config:read$/i,
+        category: 'system-config',
+        defaultRiskScore: 25,
+        defaultRiskTier: 'low',
+        description: 'Read system configuration',
+    },
+    {
+        name: 'system:config:write',
+        pattern: /^system:config:write$/i,
+        category: 'system-config',
+        defaultRiskScore: 75,
+        defaultRiskTier: 'high',
+        description: 'Modify system configuration',
+    },
+    {
+        name: 'system:admin',
+        pattern: /^system:admin$/i,
+        category: 'system-config',
+        defaultRiskScore: 90,
+        defaultRiskTier: 'critical',
+        description: 'Administrative system operation',
+    },
+    {
+        name: 'system:security',
+        pattern: /^system:security$/i,
+        category: 'system-config',
+        defaultRiskScore: 95,
+        defaultRiskTier: 'critical',
+        description: 'Security-related system operation',
+    },
+    {
+        name: 'system:audit',
+        pattern: /^system:audit$/i,
+        category: 'system-config',
+        defaultRiskScore: 30,
+        defaultRiskTier: 'medium',
+        description: 'Audit log operation',
+    },
+    // User Action Patterns
+    {
+        name: 'user:create',
+        pattern: /^user:create$/i,
+        category: 'user-action',
+        defaultRiskScore: 40,
+        defaultRiskTier: 'medium',
+        description: 'Create a new user account',
+    },
+    {
+        name: 'user:update',
+        pattern: /^user:update$/i,
+        category: 'user-action',
+        defaultRiskScore: 35,
+        defaultRiskTier: 'medium',
+        description: 'Update user information',
+    },
+    {
+        name: 'user:delete',
+        pattern: /^user:delete$/i,
+        category: 'user-action',
+        defaultRiskScore: 65,
+        defaultRiskTier: 'high',
+        description: 'Delete a user account',
+    },
+    {
+        name: 'user:permissions',
+        pattern: /^user:permissions$/i,
+        category: 'user-action',
+        defaultRiskScore: 70,
+        defaultRiskTier: 'high',
+        description: 'Modify user permissions',
+    },
+    {
+        name: 'user:authenticate',
+        pattern: /^user:authenticate$/i,
+        category: 'user-action',
+        defaultRiskScore: 20,
+        defaultRiskTier: 'low',
+        description: 'User authentication action',
+    },
+];
+/**
+ * Resource sensitivity mappings for risk calculation.
+ *
+ * Resources are matched against patterns and their sensitivity level
+ * is used as a multiplier in risk calculation.
+ *
+ * Note: Patterns use (^|[-_]) and ([-_]|$) for word boundaries that work
+ * with underscore/hyphen delimited resource names (e.g., "customer_data").
+ */
+export const RESOURCE_SENSITIVITY = [
+    // PII and Personal Data
+    {
+        name: 'pii',
+        pattern: /(^|[-_])(pii|personal|customer|user)([-_]|$)/i,
+        sensitivityLevel: 80,
+        riskTier: 'high',
+        description: 'Personally Identifiable Information',
+    },
+    {
+        name: 'financial',
+        pattern: /(^|[-_])(financial|payment|billing|credit|bank)([-_]|$)/i,
+        sensitivityLevel: 90,
+        riskTier: 'critical',
+        description: 'Financial data including payment information',
+    },
+    {
+        name: 'health',
+        pattern: /(^|[-_])(health|medical|hipaa|patient)([-_]|$)/i,
+        sensitivityLevel: 95,
+        riskTier: 'critical',
+        description: 'Protected Health Information (PHI)',
+    },
+    {
+        name: 'credentials',
+        pattern: /(^|[-_])(credential|password|secret|key|token|api[-_]?key)([-_]|$)/i,
+        sensitivityLevel: 100,
+        riskTier: 'critical',
+        description: 'Authentication credentials and secrets',
+    },
+    // System Resources
+    {
+        name: 'production',
+        pattern: /(^|[-_])(prod|production)([-_]|$)/i,
+        sensitivityLevel: 70,
+        riskTier: 'high',
+        description: 'Production environment resources',
+    },
+    {
+        name: 'staging',
+        pattern: /(^|[-_])(stag|staging|preprod)([-_]|$)/i,
+        sensitivityLevel: 40,
+        riskTier: 'medium',
+        description: 'Staging environment resources',
+    },
+    {
+        name: 'development',
+        pattern: /(^|[-_])(dev|development|test|sandbox)([-_]|$)/i,
+        sensitivityLevel: 15,
+        riskTier: 'low',
+        description: 'Development and test environment resources',
+    },
+    // Data Classifications
+    {
+        name: 'confidential',
+        pattern: /(^|[-_])(confidential|classified|restricted)([-_]|$)/i,
+        sensitivityLevel: 85,
+        riskTier: 'critical',
+        description: 'Confidential or classified data',
+    },
+    {
+        name: 'internal',
+        pattern: /(^|[-_])(internal|private)([-_]|$)/i,
+        sensitivityLevel: 50,
+        riskTier: 'medium',
+        description: 'Internal use only data',
+    },
+    {
+        name: 'public',
+        pattern: /(^|[-_])(public|open)([-_]|$)/i,
+        sensitivityLevel: 10,
+        riskTier: 'low',
+        description: 'Public or openly accessible data',
+    },
+    // Infrastructure
+    {
+        name: 'database',
+        pattern: /(^|[-_])(database|db|sql|mongo|postgres|mysql)([-_]|$)/i,
+        sensitivityLevel: 60,
+        riskTier: 'high',
+        description: 'Database resources',
+    },
+    {
+        name: 'logs',
+        pattern: /(^|[-_])(log|logs|audit[-_]?log|access[-_]?log)([-_]|$)/i,
+        sensitivityLevel: 45,
+        riskTier: 'medium',
+        description: 'Log and audit data',
+    },
+    {
+        name: 'config',
+        pattern: /(^|[-_])(config|configuration|settings)([-_]|$)/i,
+        sensitivityLevel: 55,
+        riskTier: 'medium',
+        description: 'System configuration',
+    },
+];
+/**
+ * Match an action string against known patterns
+ *
+ * @param action - The action string to match (e.g., 'data:read')
+ * @returns Matching action pattern or undefined if no match
+ */
+export function matchActionPattern(action) {
+    if (!action) {
+        return undefined;
+    }
+    return ACTION_PATTERNS.find((p) => p.pattern.test(action));
+}
+/**
+ * Match a resource string against sensitivity patterns
+ *
+ * @param resource - The resource string to match
+ * @returns Array of matching sensitivity patterns, sorted by sensitivity level (descending)
+ */
+export function matchResourceSensitivity(resource) {
+    if (!resource) {
+        return [];
+    }
+    return RESOURCE_SENSITIVITY
+        .filter((s) => s.pattern.test(resource))
+        .sort((a, b) => b.sensitivityLevel - a.sensitivityLevel);
+}
+/**
+ * Get the highest sensitivity level for a resource
+ *
+ * @param resource - The resource string to evaluate
+ * @returns Highest sensitivity level (0-100), defaults to 30 if no match
+ */
+export function getResourceSensitivityLevel(resource) {
+    const matches = matchResourceSensitivity(resource);
+    if (matches.length === 0) {
+        // Default sensitivity for unknown resources
+        return 30;
+    }
+    // Return the highest sensitivity found
+    return matches[0].sensitivityLevel;
+}
+/**
+ * Get the risk tier for a resource based on sensitivity patterns
+ *
+ * @param resource - The resource string to evaluate
+ * @returns Risk tier for the resource
+ */
+export function getResourceRiskTier(resource) {
+    const matches = matchResourceSensitivity(resource);
+    if (matches.length === 0) {
+        return 'low';
+    }
+    return matches[0].riskTier;
+}
+/**
+ * Infer category from action string when no pattern matches
+ *
+ * @param action - The action string to analyze
+ * @returns Inferred category based on action prefix
+ */
+export function inferCategoryFromAction(action) {
+    if (!action) {
+        return 'user-action';
+    }
+    const lowerAction = action.toLowerCase();
+    if (lowerAction.startsWith('data:')) {
+        return 'data-access';
+    }
+    if (lowerAction.startsWith('model:')) {
+        return 'model-operation';
+    }
+    if (lowerAction.startsWith('external:')) {
+        return 'external-integration';
+    }
+    if (lowerAction.startsWith('system:')) {
+        return 'system-config';
+    }
+    if (lowerAction.startsWith('user:')) {
+        return 'user-action';
+    }
+    // Default to user-action for unknown patterns
+    return 'user-action';
+}
+/**
+ * Convert a risk score to a risk tier
+ *
+ * @param score - Risk score (0-100)
+ * @returns Corresponding risk tier
+ *
+ * Tier Thresholds:
+ * - low: 0-25
+ * - medium: 26-50
+ * - high: 51-75
+ * - critical: 76-100
+ */
+export function scoreToTier(score) {
+    if (score <= 25) {
+        return 'low';
+    }
+    if (score <= 50) {
+        return 'medium';
+    }
+    if (score <= 75) {
+        return 'high';
+    }
+    return 'critical';
+}
+/**
+ * Get the minimum score for a given tier
+ *
+ * @param tier - Risk tier
+ * @returns Minimum score for the tier
+ */
+export function tierToMinScore(tier) {
+    switch (tier) {
+        case 'low':
+            return 0;
+        case 'medium':
+            return 26;
+        case 'high':
+            return 51;
+        case 'critical':
+            return 76;
+    }
+}
+/**
+ * Check if an action pattern requires approval based on default risk tier
+ *
+ * @param pattern - Action pattern to check
+ * @returns True if the pattern typically requires approval
+ */
+export function requiresApproval(pattern) {
+    return pattern.defaultRiskTier === 'high' || pattern.defaultRiskTier === 'critical';
+}
+//# sourceMappingURL=patterns.js.map

package/dist/intent/classifier/patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../../src/intent/classifier/patterns.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAmDH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,uBAAuB;IACvB;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,aAAa;QACvB,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,KAAK;QACtB,WAAW,EAAE,2BAA2B;KACzC;IACD;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,aAAa;QACvB,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,QAAQ;QACzB,WAAW,EAAE,0BAA0B;KACxC;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,gBAAgB;QACzB,QAAQ,EAAE,aAAa;QACvB,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,MAAM;QACvB,WAAW,EAAE,6BAA6B;KAC3C;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,gBAAgB;QACzB,QAAQ,EAAE,aAAa;QACvB,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,MAAM;QACvB,WAAW,EAAE,6BAA6B;KAC3C;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,gBAAgB;QACzB,QAAQ,EAAE,aAAa;QACvB,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,QAAQ;QACzB,WAAW,EAAE,6BAA6B;KAC3C;IACD;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,aAAa;QACvB,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,KAAK;QACtB,WAAW,EAAE,4BAA4B;KAC1C;IAED,2BAA2B;IAC3B;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,gBAAgB;QACzB,QAAQ,EAAE,iBAAiB;QAC3B,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,QAAQ;QACzB,WAAW,EAAE,gCAAgC;KAC9C;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,oBAAoB;QAC7B,QAAQ,EAAE,iBAAiB;QAC3B,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,KAAK;QACtB,WAAW,EAAE,0BAA0B;KACxC;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,iBAAiB;QAC3B,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,MAAM;QACvB,WAAW,EAAE,8BAA8B;KAC5C;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,iBAAiB;QAC3B,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,KAAK;QACtB,WAAW,EAAE,4BAA4B;KAC1C;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,iBAAiB;QAC3B,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,QAAQ;QACzB,WAAW,EAAE,6BAA6B;KAC3C;IAED,gCAAgC;IAChC;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,sBAAsB;QAChC,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,QAAQ;QACzB,WAAW,EAAE,sBAAsB;KACpC;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,qBAAqB;QAC9B,QAAQ,EAAE,sBAAsB;QAChC,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,QAAQ;QACzB,WAAW,EAAE,wBAAwB;KACtC;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,sBAAsB;QAChC,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,QAAQ;QACzB,WAAW,EAAE,0BAA0B;KACxC;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,qBAAqB;QAC9B,QAAQ,EAAE,sBAAsB;QAChC,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,UAAU;QAC3B,WAAW,EAAE,+BAA+B;KAC7C;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,qBAAqB;QAC9B,QAAQ,EAAE,sBAAsB;QAChC,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,QAAQ;QACzB,WAAW,EAAE,iCAAiC;KAC/C;IAED,gCAAgC;IAChC;QACE,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,uBAAuB;QAChC,QAAQ,EAAE,eAAe;QACzB,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,KAAK;QACtB,WAAW,EAAE,2BAA2B;KACzC;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,wBAAwB;QACjC,QAAQ,EAAE,eAAe;QACzB,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,MAAM;QACvB,WAAW,EAAE,6BAA6B;KAC3C;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,eAAe;QACzB,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,UAAU;QAC3B,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,oBAAoB;QAC7B,QAAQ,EAAE,eAAe;QACzB,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,UAAU;QAC3B,WAAW,EAAE,mCAAmC;KACjD;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,eAAe;QACzB,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,QAAQ;QACzB,WAAW,EAAE,qBAAqB;KACnC;IAED,uBAAuB;IACvB;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,gBAAgB;QACzB,QAAQ,EAAE,aAAa;QACvB,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,QAAQ;QACzB,WAAW,EAAE,2BAA2B;KACzC;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,gBAAgB;QACzB,QAAQ,EAAE,aAAa;QACvB,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,QAAQ;QACzB,WAAW,EAAE,yBAAyB;KACvC;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,gBAAgB;QACzB,QAAQ,EAAE,aAAa;QACvB,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,MAAM;QACvB,WAAW,EAAE,uBAAuB;KACrC;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,qBAAqB;QAC9B,QAAQ,EAAE,aAAa;QACvB,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,MAAM;QACvB,WAAW,EAAE,yBAAyB;KACvC;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,aAAa;QACvB,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,KAAK;QACtB,WAAW,EAAE,4BAA4B;KAC1C;CACF,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA0B;IACzD,wBAAwB;IACxB;QACE,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,+CAA+C;QACxD,gBAAgB,EAAE,EAAE;QACpB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,qCAAqC;KACnD;IACD;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,0DAA0D;QACnE,gBAAgB,EAAE,EAAE;QACpB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,8CAA8C;KAC5D;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,iDAAiD;QAC1D,gBAAgB,EAAE,EAAE;QACpB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,oCAAoC;KAClD;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,qEAAqE;QAC9E,gBAAgB,EAAE,GAAG;QACrB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,wCAAwC;KACtD;IAED,mBAAmB;IACnB;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,oCAAoC;QAC7C,gBAAgB,EAAE,EAAE;QACpB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,kCAAkC;KAChD;IACD;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,yCAAyC;QAClD,gBAAgB,EAAE,EAAE;QACpB,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,+BAA+B;KAC7C;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,iDAAiD;QAC1D,gBAAgB,EAAE,EAAE;QACpB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,4CAA4C;KAC1D;IAED,uBAAuB;IACvB;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,uDAAuD;QAChE,gBAAgB,EAAE,EAAE;QACpB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,qCAAqC;QAC9C,gBAAgB,EAAE,EAAE;QACpB,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,wBAAwB;KACtC;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,gCAAgC;QACzC,gBAAgB,EAAE,EAAE;QACpB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,kCAAkC;KAChD;IAED,iBAAiB;IACjB;QACE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,yDAAyD;QAClE,gBAAgB,EAAE,EAAE;QACpB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,0DAA0D;QACnE,gBAAgB,EAAE,EAAE;QACpB,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,kDAAkD;QAC3D,gBAAgB,EAAE,EAAE;QACpB,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,sBAAsB;KACpC;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,oBAAoB;SACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SACvC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAgB;IAC1D,MAAM,OAAO,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,4CAA4C;QAC5C,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,uCAAuC;IACvC,OAAO,OAAO,CAAC,CAAC,CAAE,CAAC,gBAAgB,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,MAAM,OAAO,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAEzC,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,IAAI,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACxC,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,8CAA8C;IAC9C,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAChB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAc;IAC3C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,KAAK;YACR,OAAO,CAAC,CAAC;QACX,KAAK,QAAQ;YACX,OAAO,EAAE,CAAC;QACZ,KAAK,MAAM;YACT,OAAO,EAAE,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAsB;IACrD,OAAO,OAAO,CAAC,eAAe,KAAK,MAAM,IAAI,OAAO,CAAC,eAAe,KAAK,UAAU,CAAC;AACtF,CAAC"}

package/dist/intent/classifier/risk.d.ts

@@ -0,0 +1,177 @@
+/**
+ * Intent Risk Assessment
+ *
+ * Provides rule-based risk assessment for intents in the Vorion AI Governance Platform.
+ * Risk is calculated based on action type, resource sensitivity, and historical patterns.
+ *
+ * Risk Calculation Logic:
+ * =======================
+ *
+ * 1. Base Risk Score (from action pattern):
+ *    - Each action type has a predefined base risk score (0-100)
+ *    - Unknown actions default to medium risk (40)
+ *
+ * 2. Resource Sensitivity Modifier:
+ *    - Resources are matched against sensitivity patterns
+ *    - Highest matching sensitivity level is used
+ *    - Applied as: adjustedScore = baseScore * (1 + (sensitivity - 30) / 100)
+ *    - This can increase or decrease risk based on resource sensitivity
+ *
+ * 3. Historical Pattern Adjustment:
+ *    - High failure rate (+15 points)
+ *    - First-time action/resource combination (+10 points)
+ *    - Frequent successful history (-5 points)
+ *
+ * 4. Parameter-based Adjustments:
+ *    - Bulk operations (+20 points)
+ *    - Cross-tenant operations (+25 points)
+ *    - Elevated privilege requests (+15 points)
+ *
+ * Final Score: Clamped to 0-100 range
+ */
+import { type RiskTier, type IntentCategory } from './patterns.js';
+/**
+ * Input for risk assessment - matches intent submission shape
+ */
+export interface CreateIntent {
+    /** Action to be performed (e.g., 'data:read', 'model:train') */
+    action: string;
+    /** Resource being accessed */
+    resource: string;
+    /** Action-specific parameters */
+    parameters?: Record<string, unknown>;
+    /** Existing risk score if provided externally */
+    riskScore?: number;
+}
+/**
+ * Risk factor that contributed to the assessment
+ */
+export interface RiskFactor {
+    /** Factor identifier */
+    name: string;
+    /** Points added or subtracted */
+    points: number;
+    /** Description of why this factor applies */
+    reason: string;
+}
+/**
+ * Required approvals based on risk assessment
+ */
+export interface RequiredApprovals {
+    /** Whether human review is required */
+    humanReview: boolean;
+    /** Whether manager/supervisor approval is needed */
+    managerApproval: boolean;
+    /** Whether security team review is needed */
+    securityReview: boolean;
+    /** Minimum trust level required to execute */
+    minTrustLevel: number;
+}
+/**
+ * Complete risk assessment result
+ */
+export interface RiskAssessment {
+    /** Final risk score (0-100) */
+    riskScore: number;
+    /** Risk tier classification */
+    riskTier: RiskTier;
+    /** Factors that contributed to the score */
+    factors: RiskFactor[];
+    /** Category of the intent */
+    category: IntentCategory;
+    /** Required approvals based on risk level */
+    requiredApprovals: RequiredApprovals;
+    /** Assessment timestamp */
+    assessedAt: string;
+}
+/**
+ * Historical pattern information for risk adjustment
+ */
+export interface HistoricalPattern {
+    /** Total number of similar intents processed */
+    totalCount: number;
+    /** Number of successful completions */
+    successCount: number;
+    /** Number of failures */
+    failureCount: number;
+    /** Whether this is a first-time action/resource combination */
+    isFirstTime: boolean;
+    /** Average processing time in milliseconds */
+    avgProcessingTimeMs?: number;
+}
+/**
+ * Configuration for risk assessment
+ */
+export interface RiskAssessorConfig {
+    /** Default risk score for unknown actions (default: 40) */
+    defaultRiskScore: number;
+    /** Enable historical pattern analysis (default: true) */
+    useHistoricalPatterns: boolean;
+    /** Provider for historical patterns (optional) */
+    historicalPatternProvider?: (intent: CreateIntent) => Promise<HistoricalPattern | null>;
+}
+/**
+ * RiskAssessor class for evaluating intent risk
+ *
+ * Provides rule-based risk assessment without external ML dependencies.
+ * Risk scores are calculated based on:
+ * - Action type and its inherent risk
+ * - Resource sensitivity (PII, financial, credentials, etc.)
+ * - Historical patterns (optional)
+ * - Parameter-based modifiers
+ */
+export declare class RiskAssessor {
+    private config;
+    constructor(config?: Partial<RiskAssessorConfig>);
+    /**
+     * Assess the risk of an intent
+     *
+     * @param intent - The intent to assess
+     * @param historicalPattern - Optional historical pattern data
+     * @returns Complete risk assessment
+     */
+    assessRisk(intent: CreateIntent, historicalPattern?: HistoricalPattern | null): Promise<RiskAssessment>;
+    /**
+     * Perform the actual risk assessment
+     */
+    private performAssessment;
+    /**
+     * Calculate risk adjustments based on historical patterns
+     *
+     * Adjustment Rules:
+     * - High failure rate (>30%): +15 points (indicates problematic pattern)
+     * - First-time action: +10 points (unknown behavior)
+     * - Frequent success (>10 with >90% success): -5 points (established safe pattern)
+     */
+    private calculateHistoricalAdjustments;
+    /**
+     * Calculate risk adjustments based on intent parameters
+     *
+     * Parameter Flags:
+     * - bulk: true -> +20 points (bulk operations have wider impact)
+     * - crossTenant: true -> +25 points (cross-tenant requires extra scrutiny)
+     * - elevated: true -> +15 points (elevated privilege request)
+     * - dryRun: true -> -10 points (dry run is safer)
+     */
+    private calculateParameterAdjustments;
+    /**
+     * Calculate required approvals based on risk assessment
+     *
+     * Approval Thresholds:
+     * - low (0-25): No special approvals, minTrustLevel 1
+     * - medium (26-50): Human review recommended, minTrustLevel 2
+     * - high (51-75): Human review + manager approval, minTrustLevel 3
+     * - critical (76-100): Human review + manager + security review, minTrustLevel 4
+     *
+     * Additional rules for specific categories:
+     * - system-config always requires manager approval if score > 40
+     * - external-integration with payments requires security review
+     */
+    private calculateRequiredApprovals;
+}
+/**
+ * Create a new RiskAssessor instance with optional configuration
+ */
+export declare function createRiskAssessor(config?: Partial<RiskAssessorConfig>): RiskAssessor;
+export type { RiskTier, IntentCategory } from './patterns.js';
+//# sourceMappingURL=risk.d.ts.map

package/dist/intent/classifier/risk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk.d.ts","sourceRoot":"","sources":["../../../src/intent/classifier/risk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAQH,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,cAAc,EAKpB,MAAM,eAAe,CAAC;AAavB;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,uCAAuC;IACvC,WAAW,EAAE,OAAO,CAAC;IACrB,oDAAoD;IACpD,eAAe,EAAE,OAAO,CAAC;IACzB,6CAA6C;IAC7C,cAAc,EAAE,OAAO,CAAC;IACxB,8CAA8C;IAC9C,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,+BAA+B;IAC/B,QAAQ,EAAE,QAAQ,CAAC;IACnB,4CAA4C;IAC5C,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,6BAA6B;IAC7B,QAAQ,EAAE,cAAc,CAAC;IACzB,6CAA6C;IAC7C,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,yBAAyB;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,WAAW,EAAE,OAAO,CAAC;IACrB,8CAA8C;IAC9C,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,qBAAqB,EAAE,OAAO,CAAC;IAC/B,kDAAkD;IAClD,yBAAyB,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;CACzF;AAOD;;;;;;;;;GASG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAqB;gBAEvB,MAAM,GAAE,OAAO,CAAC,kBAAkB,CAAM;IAIpD;;;;;;OAMG;IACG,UAAU,CACd,MAAM,EAAE,YAAY,EACpB,iBAAiB,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAC3C,OAAO,CAAC,cAAc,CAAC;IAsC1B;;OAEG;YACW,iBAAiB;IA8F/B;;;;;;;OAOG;IACH,OAAO,CAAC,8BAA8B;IAmCtC;;;;;;;;OAQG;IACH,OAAO,CAAC,6BAA6B;IA0DrC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,0BAA0B;CA6CnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GACnC,YAAY,CAEd;AAGD,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC"}