Enterprise Security Architecture¶

from src.security import DataClassifier, SensitivityLevel

classifier = DataClassifier()
result = classifier.classify_file("/path/to/file.py")

if result.sensitivity == SensitivityLevel.RESTRICTED:
    print("This file will NEVER be sent to AI")
elif result.pii_detected:
    print("PII detected - special handling required")

from src.security import CodeSanitizer

sanitizer = CodeSanitizer()
result = sanitizer.sanitize_file("/path/to/config.py")

# Original content:
# API_KEY = "sk-ant-1234567890abcdef"
# DATABASE_URL = "postgres://user:password@host/db"

# Sanitized content:
# API_KEY = "[REDACTED]:api_key"
# DATABASE_URL = "[REDACTED]:connection_string"

from src.security import ConsentManager, ConsentScope

consent = ConsentManager(session_id="user-session-123")

# Check if consent exists
if not consent.has_consent(ConsentScope.SEND_TO_ANTHROPIC):
    # Prompt user for consent
    consent.prompt_for_consent([
        ConsentScope.SOURCE_CODE,
        ConsentScope.SEND_TO_ANTHROPIC,
    ])

# Now safe to proceed
consent.require_consent(ConsentScope.SEND_TO_ANTHROPIC)

from src.security import get_audit_logger, AuditEventType

audit = get_audit_logger()

# Log AI request
audit.log_ai_request(
    user_id="user-123",
    model="claude-sonnet-4-5",
    action="analyze_code",
    prompt_hash="abc123...",  # Never log actual prompts
    input_tokens=1500,
)

# Log file access
audit.log_file_read(
    user_id="user-123",
    file_path="/app/src/main.py",
    classification="internal",
    was_sanitized=True,
    secrets_redacted=3,
)

# Generate compliance report
report = audit.generate_compliance_report(
    start_date=datetime(2024, 1, 1),
    end_date=datetime(2024, 1, 31),
)

from src.security import create_secure_reader

# Create reader with security features
reader = create_secure_reader(
    user_id="user-123",
    auto_consent_mode="standard",  # Or prompt interactively
)

# Read codebase - automatically:
# 1. Checks consent
# 2. Classifies files
# 3. Skips restricted files
# 4. Sanitizes secrets
# 5. Logs all access
results = reader.read_codebase("/path/to/app")

# Get safe content for AI
context = reader.get_context_for_ai(results)
# This content is SAFE to send to Claude

from src.security import CodeSanitizer, SecretType

sanitizer = CodeSanitizer(
    additional_patterns={
        SecretType.API_KEY: [
            r"MYORG_API_KEY_[a-zA-Z0-9]{32}",
        ],
    },
    additional_forbidden_files={
        "internal-secrets.yaml",
        "*.myorg-key",
    },
)

sanitizer = CodeSanitizer(
    additional_forbidden_dirs={
        "internal-tools",
        "legacy-secrets",
    },
)

from datetime import datetime, timedelta
from src.security import get_audit_logger

audit = get_audit_logger()

# Last 30 days
report = audit.generate_compliance_report(
    start_date=datetime.now() - timedelta(days=30),
    end_date=datetime.now(),
)

print(f"Total AI requests: {report['summary']['ai_requests']}")
print(f"Files accessed: {report['summary']['files_accessed']}")
print(f"Secrets detected: {report['summary']['secrets_detected']}")
print(f"Total cost: ${report['summary']['total_cost_usd']:.2f}")

# WRONG - direct file read
content = Path("config.py").read_text()
send_to_ai(content)  # May contain secrets!

# CORRECT - use secure reader
reader = create_secure_reader(user_id="me")
result = reader.read_file("config.py")
send_to_ai(result.content)  # Safe, sanitized

# WRONG - assume consent
send_data_to_anthropic(data)

# CORRECT - verify consent
consent = get_consent_manager()
consent.require_consent(ConsentScope.SEND_TO_ANTHROPIC)
send_data_to_anthropic(data)

# WRONG - silent operation
response = call_ai_api(prompt)

# CORRECT - audit trail
audit.log_ai_request(...)
response = call_ai_api(prompt)
audit.log_ai_response(...)

# WRONG - log actual content
audit.log(content=sensitive_data)

# CORRECT - log hash only
from src.security import hash_content
audit.log(content_hash=hash_content(sensitive_data))

consent = ConsentManager(auto_grant_mode="standard")

classifier = DataClassifier()
result = classifier.classify_file("path/to/file")
print(f"Sensitivity: {result.sensitivity}")
print(f"Reasons: {result.reasons}")

sanitizer = CodeSanitizer(
    additional_patterns={
        SecretType.API_KEY: [r"MY_CUSTOM_PATTERN"],
    }
)