# Fusion (shared SaaS) policy setup (steps 2, 3-route, 8)

Fusion is a **shared SaaS instance** — configured in the Amplify AI Gateway
console, not deployed by this repo. Because it's SaaS it **cannot reach private
VPC resources or use local AWS creds**, so it does not call Presidio or DynamoDB
directly. Instead it calls two **public HTTPS endpoints** this repo exposes
(built in `gateway_api/`, tasks T1/T2), which do the detection, minting, vault
writes, and restore on the AWS side. Fusion owns the orchestration and routing.

## Endpoints Fusion calls
- `TOKENIZE_URL` = `https://<...>/tokenize`  (ingress: detect + mint + vault-write + splice)
- `RESTORE_URL`  = `https://<...>/restore`   (egress: vault lookup + re-attach identity)
- `AGENT_RUNTIME_ARN` (or its HTTPS invoke endpoint) = printed by `scripts/agentcore_setup.sh`
- Secure all three with an API key / OAuth from the Fusion outbound config.

## Ingress policy  (advisor request → cloud)
1. **Authenticate** the advisor; apply the RBAC / business-purpose check.
2. **Tokenize**: POST `{ query }` to `TOKENIZE_URL`. Receive
   `{ deidentified_prompt, session_id }`. (The endpoint runs detect → mint →
   vault-write → splice; detection returns typed findings, never a redacted blob.)
3. **Route**: invoke the agent with `{ "prompt": deidentified_prompt }`.
4. **Trace**: log the **tokenized** payload only — never the raw query.

## Egress policy  (cloud response → advisor)
1. Receive the agent's de-identified result.
2. **Restore**: POST `{ session_id, text }` to `RESTORE_URL`; receive `{ final }`.
3. Return `{ "final": ..., "deidentified_prompt": ... }` so the UI shows the split view.

## Vault item shape (DynamoDB, written by /tokenize)
```
{ "token": "CUST_000123", "type": "CUSTOMER", "value": "cust-0001",
  "session_id": "<conv id>", "expires_at": <epoch+ttl> }
```

## Why this split
Keeping detection, minting, and the vault behind `/tokenize` and `/restore` means
the only things exposed to the SaaS gateway are two authenticated HTTPS endpoints —
no AWS creds or private resources leave the account, and Fusion stays a pure
orchestration/routing layer. That is also the cleanest story on camera: the
gateway owns the flow; the cloud only ever sees tokens.