AI Guardrails — HFI GRC Work OS

How the AI drafting features are constrained. Written so it can be shown to a security-minded buyer.

The one-liner (for Dave)

It only reasons over the data in the workspace and what the advisor enters — no web browsing, no outside data sources — and a human reviews every draft before it's used. The scoring and mapping underneath are deterministic, not generative.

Where AI is live (across the product, not a demo corner)

Every one of these is grounded in the first-party control library, runs through the same guardrails below, and produces an editable/refinable/exportable draft:

Surface	Generates
Data Inventory	data-handling (privacy) narrative
Procurement → AI Narrative	buyer-facing AI-use narrative
New Project Intake	system overview (SSP starter)
AI Features	plain-language end-user AI notice
Procurement → Buyer Questions	drafted answers to buyer questions
Procurement → Vendor Checklist	vendor due-diligence questions
GovRAMP → Monthly Review	client check-in message
GovRAMP Readiness Workspace	client-ready readiness summary
Findings & Gap Register	leadership executive summary
Ask AI — Copilot (`/eb/ask`)	answers portfolio questions over a deterministic briefing (counts are real queries; the AI never invents numbers)
Ask AI — persona commands (Deliver)	grounded drafts on demand: map control, generate policy, generate workpaper, assess risk — each cites only control IDs from the first-party glossary
Ask AI — Tutor (`/program/ask`)	plain-English control/GRC help for learners — grounded only in the public control library, never client/engagement data

Plus Refine with AI (plain-language revision) on every draft. The Tool-Stack Assessment mapping, gap-assessment scoring, and document generators remain deterministic — AI only drafts prose; it never computes the numbers. The gap-assessment findings the register summarizes are computed by the deterministic crosswalk engine and persisted server-side (tenant-scoped eb_gap_findings), so the executive-summary draft reasons over real, stored results — not figures the model produced.

Models (current): Anthropic Claude Sonnet 4.5 for drafting/Q&A, Claude Haiku 4.5 for lab feedback and Zoom recording enrichment. Server-side only (Supabase edge functions); the browser never holds the API key.

Two-lane AI boundary (for Dave/Noah): the Tutor (Learn lane) is grounded only in the public control library — zero path to client data. The Copilot (Deliver lane) reasons over the advisor's workspace + the active client. Different grounding contexts that never cross — so a learner's AI can never reach an engagement's data; the tenant boundary holds by construction.

What the model can and can't see

Sees: a fixed system instruction + exactly the context the page passes — the privacy narrative gets the data-inventory rows; the procurement narrative gets the form fields + oversight toggles; Refine gets the current draft + the advisor's instruction. Plus the client/product name.
Does not see: the rest of the database, other clients' data, uploaded files, or anything not explicitly passed.
No internet, no browsing, no external RAG. The Anthropic API call has no tools and no web search enabled — it cannot fetch live web data.

Guardrails in place

First-party grounding (now live) — every drafting/Q&A call ships a compact slice of our own vetted reference data (the control glossary + cross-control evidence matrix) into the prompt, and the system instruction says to cite control IDs only from that glossary and never invent IDs, mappings, or evidence. The model grounds in our curated content, not training memory.
Instructional guardrail — use only the provided facts, never invent systems/vendors/controls, flag missing info rather than guess. (This is why the privacy draft surfaced the test row and the data-retention gap instead of glossing over them.)
Scoped input — only the active client's fields; no cross-client bleed. (The Tutor narrows further: public control library only, no client data.)
Human-in-the-loop — nothing is auto-sent; every output is labeled a draft for review, and is editable/refinable before use.
Deterministic core — the Tool-Stack Assessment mapping, bucket scoring, gap-assessment, and readiness numbers are rules-based (no hallucination risk). Only the narrative drafting is generative.

Honest caveats (we don't overclaim)

Instructions reduce hallucination; they don't eliminate it. The model is probabilistic — grounded and reliable here because inputs are small and structured, but human review is mandatory, not optional.
The model uses its training knowledge to write prose around your facts (e.g., what "encryption at rest" means). That's training, not live internet.
Refine can introduce content — but only because the advisor asked for it.
No redaction on what's sent to the API. Fine for GovRAMP / metadata; for CUI, the data-boundary rule applies (see security-posture.md) — sensitive data needs in-boundary model hosting before it's in scope.

Hardening roadmap

✅ First-party grounding — shipped. Drafting/Q&A now ground in the control glossary + cross-control evidence matrix (see guardrail #1). Next: widen the shipped corpus to crosswalks + tool map as more surfaces need them.
Post-generation check that flags any claim not traceable to the input.
Redaction / data-boundary controls + in-boundary hosting for sensitive data (CUI) — e.g. Claude via AWS Bedrock GovCloud.

The reference corpus (controls, crosswalks, evidence guide, tool map) lives in the Work OS, so widening the grounding is a configuration step, not a multi-week ingestion project.