Lewati ke konten
Keamanan Guardrail

Kontrol keamanan

Kontrol runtime pada lingkungan riset — aturan yang ditampilkan di sini adalah aturan yang benar-benar dievaluasi oleh sisi yang mengizinkan permintaan.

Guardrail

kotoba-guardrails-2026-09-v2

Kebijakan konten yang diterapkan pada isi setiap permintaan. Keputusan bersifat deterministik; pemblokiran menolak tugas sebelum kuota apa pun terpakai.

Nama Tindakan Deskripsi Pola Diaktifkan
csam-block Blokir Referensi CSAM ditolak pada setiap permintaan (dilarang keras oleh AUP). 0 Selalu aktif (AUP)
cbrn-block Blokir CBRN/WMD uplift requests are refused on every request (AUP strictly-prohibited). 0 Selalu aktif (AUP)
fraud-block Blokir Permintaan fraud-as-a-service ditolak (dilarang keras oleh AUP). 0 Selalu aktif (AUP)
secret-hygiene Sensor Live credential shapes in the prompt are masked before the model sees them. 3
pii-passkeys Tandai References to passkeys/private keys are flagged for review, never blocked. 2

Firewall

kotoba-firewall-2026-09-v1

Alat tugas yang dapat digunakan agen, beserta tingkat kepercayaan yang diperlukan masing-masing. Pemanggilan di bawah tingkat tersebut akan ditolak (mode observasi hanya mencatatnya).

Alat Tingkat yang diperlukan Tugas terbuka
code-review Identitas terverifikasi code-review
vulnerability-triage Identitas terverifikasi vulnerability-triage
remediation Identitas terverifikasi remediation
payload-crafting Terkontrak — (ditolak secara default)
c2-tooling Terkontrak — (ditolak secara default)

Kepatuhan

kotoba-compliance-2026-09-v1

Automated runtime controls mapped to each framework — a description of controls, not a certification, audit or compliance attestation. No certification is held (see /trust/). PCI DSS scope is delegated to Stripe: card data never reaches Mithril.

Controls mapped to (not a certification) Wilayah Kontrol otomatis Diaktifkan
Automated controls mapped to APPI JP prompt-pii-redaction audit-log-retention screening-evidence-receipts
Automated controls mapped to PCI DSS 4.0
Delegated to Stripe — card data never reaches Mithril		 Global card-data-never-stored secret-hygiene-redaction audit-log-retention
Automated controls mapped to OWASP LLM Top-10 Global guardrails-csam-cbrn firewall-task-deny screen-model-block-receipts
Automated controls mapped to NIST AI RMF US session-projection-uncalibrated assurance-ladder-evidence
Retensi log audit 180 hari
Lokasi penyimpanan data Not pinned — no storage or processing region is selected in code or configuration (Cloudflare's global network and providers whose regions are not specified; see /legal/subprocessors/)

No certification is held. Trust Center

Data retention No inference logs / no training (conversation text kept until account delete)