41 lines
2.2 KiB
Markdown
41 lines
2.2 KiB
Markdown
# Fusion (shared SaaS) policy setup (steps 2, 3-route, 8)
|
|
|
|
Fusion is a **shared SaaS instance** — configured in the Amplify AI Gateway
|
|
console, not deployed by this repo. Because it's SaaS it **cannot reach private
|
|
VPC resources or use local AWS creds**, so it does not call Presidio or DynamoDB
|
|
directly. Instead it calls two **public HTTPS endpoints** this repo exposes
|
|
(built in `gateway_api/`, tasks T1/T2), which do the detection, minting, vault
|
|
writes, and restore on the AWS side. Fusion owns the orchestration and routing.
|
|
|
|
## Endpoints Fusion calls
|
|
- `TOKENIZE_URL` = `https://<...>/tokenize` (ingress: detect + mint + vault-write + splice)
|
|
- `RESTORE_URL` = `https://<...>/restore` (egress: vault lookup + re-attach identity)
|
|
- `AGENT_RUNTIME_ARN` (or its HTTPS invoke endpoint) = printed by `scripts/agentcore_setup.sh`
|
|
- Secure all three with an API key / OAuth from the Fusion outbound config.
|
|
|
|
## Ingress policy (advisor request → cloud)
|
|
1. **Authenticate** the advisor; apply the RBAC / business-purpose check.
|
|
2. **Tokenize**: POST `{ query }` to `TOKENIZE_URL`. Receive
|
|
`{ deidentified_prompt, session_id }`. (The endpoint runs detect → mint →
|
|
vault-write → splice; detection returns typed findings, never a redacted blob.)
|
|
3. **Route**: invoke the agent with `{ "prompt": deidentified_prompt }`.
|
|
4. **Trace**: log the **tokenized** payload only — never the raw query.
|
|
|
|
## Egress policy (cloud response → advisor)
|
|
1. Receive the agent's de-identified result.
|
|
2. **Restore**: POST `{ session_id, text }` to `RESTORE_URL`; receive `{ final }`.
|
|
3. Return `{ "final": ..., "deidentified_prompt": ... }` so the UI shows the split view.
|
|
|
|
## Vault item shape (DynamoDB, written by /tokenize)
|
|
```
|
|
{ "token": "CUST_000123", "type": "CUSTOMER", "value": "cust-0001",
|
|
"session_id": "<conv id>", "expires_at": <epoch+ttl> }
|
|
```
|
|
|
|
## Why this split
|
|
Keeping detection, minting, and the vault behind `/tokenize` and `/restore` means
|
|
the only things exposed to the SaaS gateway are two authenticated HTTPS endpoints —
|
|
no AWS creds or private resources leave the account, and Fusion stays a pure
|
|
orchestration/routing layer. That is also the cleanest story on camera: the
|
|
gateway owns the flow; the cloud only ever sees tokens.
|