Security
Yunque Agent implements defense-in-depth security architecture with barriers at every stage from input to output.
Security Flow
Request → [Auth] → [RBAC] → [Input Guardrails] → [Approval] → [Execution] → [Output Guardrails] → [Audit] → ResponseGuardrails
Input Guardrails
| Guardrail | Function |
|---|---|
| PII Redaction | Auto-detect and mask personal information (email, phone, SSN, credit card, etc.) |
| Injection Detection | Detect prompt injection (role override, system prompt leak, jailbreak attempts) |
| Content Moderation | Filter harmful, illegal, or inappropriate content |
Output Guardrails
| Guardrail | Function |
|---|---|
| PII Redaction | Ensure no PII in replies |
| Egress Guard | Sensitive data exfiltration detection |
| Audit Logging | Every reply recorded in Merkle audit chain |
Trust Score
Behavior-based progressive permission model:
| Score Range | Permission Level | Capabilities |
|---|---|---|
| 0 – 29 | ReadOnly | File read, web search |
| 30 – 59 | Write | File creation, editing |
| 60 – 79 | Network | HTTP requests, API calls |
| 80 – 100 | Shell | System command execution |
Audit Trail
Immutable Merkle chain records every Agent action:
- Each entry contains SHA-256 hash of the previous entry
- Date-segmented structured audit files
GET /v1/audit/verify— Verify chain integrityGET /v1/audit/events— Query audit events
RBAC
Fine-grained role-based access control:
- Built-in roles:
owner,admin,user,viewer - Custom roles with specific permission sets
- 4-level inheritance: Global → Tenant → User → Session
Approval System
High-risk operations require explicit approval:
| Feature | Description |
|---|---|
| Risk Classification | 4-tier auto classification: safe / caution / danger / critical |
| Shell Guard | 40+ regex patterns for dangerous shell syntax |
| Tool Guard | Tool call risk assessment |
| Decision Options | allow_once / allow_always / deny_always |
| Persistent Rules | Session/user/global scope, stored in Ledger KV |
| IM Integration | Feishu cards / Telegram buttons for direct approval |
HTTP Security Headers
Auto-applied in production: CSP, HSTS, X-Content-Type-Options, X-Frame-Options.
First-Run Security
On first launch without a password, all API access is blocked (only auth/setup/health allowed) until a password is set via the setup wizard.