Fusion (shared SaaS) policy setup (steps 2, 3-route, 8)

Fusion is a shared SaaS instance — configured in the Amplify AI Gateway console, not deployed by this repo. Because it's SaaS it cannot reach private VPC resources or use local AWS creds, so it does not call Presidio or DynamoDB directly. Instead it calls two public HTTPS endpoints this repo exposes (built in gateway_api/, tasks T1/T2), which do the detection, minting, vault writes, and restore on the AWS side. Fusion owns the orchestration and routing.

Endpoints Fusion calls

TOKENIZE_URL = https://<...>/tokenize (ingress: detect + mint + vault-write + splice)
RESTORE_URL = https://<...>/restore (egress: vault lookup + re-attach identity)
AGENT_RUNTIME_ARN (or its HTTPS invoke endpoint) = printed by scripts/agentcore_setup.sh
Secure all three with an API key / OAuth from the Fusion outbound config.

Ingress policy (advisor request → cloud)

Authenticate the advisor; apply the RBAC / business-purpose check.
Tokenize: POST { query } to TOKENIZE_URL. Receive { deidentified_prompt, session_id }. (The endpoint runs detect → mint → vault-write → splice; detection returns typed findings, never a redacted blob.)
Route: invoke the agent with { "prompt": deidentified_prompt }.
Trace: log the tokenized payload only — never the raw query.

Egress policy (cloud response → advisor)

Receive the agent's de-identified result.
Restore: POST { session_id, text } to RESTORE_URL; receive { final }.
Return { "final": ..., "deidentified_prompt": ... } so the UI shows the split view.

Vault item shape (DynamoDB, written by /tokenize)

{ "token": "CUST_000123", "type": "CUSTOMER", "value": "cust-0001",
  "session_id": "<conv id>", "expires_at": <epoch+ttl> }

Why this split

Keeping detection, minting, and the vault behind /tokenize and /restore means the only things exposed to the SaaS gateway are two authenticated HTTPS endpoints — no AWS creds or private resources leave the account, and Fusion stays a pure orchestration/routing layer. That is also the cleanest story on camera: the gateway owns the flow; the cloud only ever sees tokens.

2.2 KiB Raw Blame History