NOJIRA-Insight-tool-expansion-design - #1148
Merged
Merged
Conversation
- bin-ai-manager: document get_related_cases/get_case_notes tool design (5-round reviewed, approved) - bin-ai-manager: document AllowedToolNames single-source-of-whitelist helper for insight "all" support - bin-pipecat-manager: document GetByNames AIType-aware defense-in-depth fix and fail-open-to-fail-closed policy change
Expand Case Insight Assistant's tool whitelist with two new read-only tools and let Insight AIs use the "all" tool shorthand, closing a pre-existing production gap discovered while investigating the latter: tool-list expansion had no AIType awareness and would fail open on AI lookup failure. - bin-ai-manager: add get_related_cases and get_case_notes tools, both scoped to the current case's CustomerID with fail-closed ownership checks and audit logging on cross-customer access attempts - bin-ai-manager: add AllowedToolNames(Type) as the single source of truth for the tool whitelist (deny-by-default for unknown types); refactor ValidateToolNames to use it and accept "all" for type=insight - bin-pipecat-manager: make GetByNames AIType-aware so it re-applies the whitelist at tool-expansion time regardless of what tool_names stores, closing a defense-in-depth gap (Normal AI's "all" was leaking the two Insight-only tools) - bin-pipecat-manager: change the AI-lookup-failure fallback from fail-open (GetAll(), every tool including write-capable ones) to fail-closed (no tools), reversing a prior VOIP-1234 decision now that tool access is enforced per-type; remove GetAll() from the ToolHandler interface entirely so this can't be silently reintroduced - bin-pipecat-manager: update docs/operations.md and metrics to reflect the fail-closed policy
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Expand Case Insight Assistant's tool whitelist with two new read-only
tools and let Insight AIs use the "all" tool shorthand, closing a
pre-existing production gap discovered while investigating the latter:
tool-list expansion had no AIType awareness and would fail open on AI
lookup failure. Design doc: docs/plans/2026-07-30-case-insight-assistant-tool-expansion-design.md
(5 rounds of independent architecture + security review, 2 consecutive
approvals). Frontend counterpart: voipbin/monorepo-javascript#408.
scoped to the current case's CustomerID with fail-closed ownership
checks and audit logging on cross-customer access attempts
truth for the tool whitelist (deny-by-default for unknown types);
refactor ValidateToolNames to use it and accept "all" for type=insight
whitelist at tool-expansion time regardless of what tool_names stores,
closing a defense-in-depth gap (Normal AI's "all" was leaking the two
Insight-only tools)
fail-open (GetAll(), every tool including write-capable ones) to
fail-closed (no tools), reversing a prior VOIP-1234 decision now that
tool access is enforced per-type; remove GetAll() from the
ToolHandler interface entirely so this can't be silently reintroduced
the fail-closed policy