Repoint public POST /tokenize at the orchestrator (tokenize -> agent -> restore)
so a single path returns {final, deidentified_prompt, agent_tokenized,
session_id} — matching what Fusion mirrors from the front-end path, and what
openapi.yaml already documents. The granular detector moves to internal
/tokenize-raw (x-api-key protected; the orchestrator calls it). /demo kept as an
alias so the UI keeps working.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Replace wholesale with strict schemas: required fields, descriptions, examples,
additionalProperties:false so Fusion treats responses as closed structured
objects. /tokenize documents the full round-trip shape (final, deidentified_prompt,
agent_tokenized, session_id); /restore is {session_id,text} -> {final,restored}.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
OpenAPI 3.0 spec for the de-id transforms with concrete request/response
schemas, both /tokenize and /restore, an x-api-key securityScheme for
backend-direct calls, and both servers (backend custom domain + Fusion listener,
which injects the key).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Fusion couldn't resolve the default *.execute-api.amazonaws.com endpoint, so front
the same HTTP API with hncb-deid.apim-apac-demo.com (ACM DNS-validated cert,
apigatewayv2 REGIONAL custom domain, root api mapping, Route53 A ALIAS). Callers
resolve our hostname straight to IPs and never touch an execute-api name; also
survives API-id churn. Point POLICY_SETUP + README demo at the custom URLs.
Verified live: resolves to IPs, 401 unauthenticated, tokenizes with the key.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds an Amazon Bedrock Guardrail (PROMPT_ATTACK, HIGH, input) plus a dedicated
least-privilege IAM user for Fusion's AWS-Guardrail integration, so the gateway
screens inbound prompts for injection/jailbreak before de-id or the agent run.
Outputs the region/id/version/access-key for the Fusion console (secret stays in
gitignored state). Verified live: benign -> NONE, injection -> GUARDRAIL_INTERVENED.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
DynamoDB's `Limit` caps items scanned *before* the FilterExpression runs, so
`scan(FilterExpression=name==X, Limit=1)` returns nothing when the first row
scanned isn't the match. Worked with one seeded customer; adding a second
(cust-0002) made 王小明 fail to resolve to a customer_id, so the RAG tool
returned "token did not resolve" and the agent replied "no customer found".
Remove the Limit; the small table is filtered in full.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Position /tokenize + /restore as the transform backend of an inline request/
response policy on the route to the AgentCore agent, with Fusion as the
non-bypassable enforcement + audit point — rather than a manual HTTP
orchestrator. Adds an honest Fusion-vs-/demo governance note.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Synthetic demo customer cust-0002 with fictional high-risk financials and a
synthetic Taiwan ROC ID. Verified live end-to-end: detected + tokenized on
ingress (name never reaches the cloud), agent produces risk-flavoured talking
points, identity restored on egress.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Mermaid flowchart + sequence diagram and an ASCII fallback for the reversible
de-identification round trip, plus component/auth/network reference tables and
the trust-zone boundaries.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Build the AWS side of the HNCB demo end to end (region ap-southeast-1):
- T1 /tokenize + T2 /restore: Lambdas behind a public API Gateway (shared-secret
auth), Presidio detection, random per-request tokens, DynamoDB vault; overlap
resolution so a ROC ID stays TW_ROC_ID.
- T3: Presidio made private (SG-locked to the tokenize Lambda in-VPC; DynamoDB
gateway endpoint); only /tokenize + /restore are public.
- T4: RAG Lambda registered as an MCP tool on an AgentCore Gateway (AWS_IAM/SigV4);
agentcore_setup.sh + a SigV4 MCP invoke test.
- T5: Strands agent deployed to AgentCore Runtime; SigV4 gateway auth, apac
inference profile, pinned deps.
- T6: advisor UI on S3+CloudFront with a Fusion-less demo orchestrator (/demo)
chaining tokenize -> runtime -> restore.
- T7: README runbook + trace check; teardown deletes gateway/runtime/memory/ECR.
Verified live: the cloud AgentCore/Bedrock trace shows only tokens, never the
real name. Secrets stay in gitignored local.auto.tfvars.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
