Security controls
Runtime controls for the research environment — the rules wey dey show here na the exact rules wey the admitting side dey check.
Guardrails
kotoba-guardrails-2026-09-v1Content policy wey dem dey apply for the body of every request. The decision dey deterministic; if e block, e go refuse the job before any quota go spend.
| Name | Action | Description | Patterns |
|---|---|---|---|
csam-block
|
Block am | CSAM references are refused on every request (AUP strictly-prohibited). | 3 |
cbrn-block
|
Block am | CBRN/WMD uplift requests are refused on every request (AUP strictly-prohibited). | 5 |
fraud-block
|
Block am | Fraud-as-a-service asks are refused (AUP strictly-prohibited). | 3 |
secret-hygiene
|
Mask am | Live credential shapes wey dey inside the prompt, dem go mask am before the model see am. | 3 |
pii-passkeys
|
Flag am | Any mention of passkeys/private keys, dem go flag am for review, dem no go block am. | 2 |
Firewall
kotoba-firewall-2026-09-v1The task tools wey agent fit use and the trust level wey each one need. If call dey below the level wey e need, dem go refuse am (observe mode go just record am).
| Tool | Level wey dem need | Tasks wey still dey open |
|---|---|---|
code-review
|
Identity don verify | code-review |
vulnerability-triage
|
Identity don verify | vulnerability-triage |
remediation
|
Identity don verify | remediation |
payload-crafting
|
Dem don contract am | — (dem go deny am by default) |
c2-tooling
|
Dem don contract am | — (dem go deny am by default) |
Compliance
kotoba-compliance-2026-09-v1Coverage = automated runtime controls only — no be certification.
| Framework | Region | Automated controls |
|---|---|---|
| APPI | JP | prompt-pii-redaction audit-log-retention screening-evidence-receipts |
| PCI DSS 4.0 | Global | card-data-never-stored secret-hygiene-redaction audit-log-retention |
| OWASP LLM Top-10 | Global | guardrails-csam-cbrn firewall-task-deny deterministic-policy-engine |
| NIST AI RMF | US | session-projection-uncalibrated assurance-ladder-evidence |
How long dem dey keep audit log
180 days
Where data dey stay
No specify
Data No Dey Keep
Dem design am for ZDR (dem go activate am for contract)