25 lines
1.1 KiB
Markdown
25 lines
1.1 KiB
Markdown
# Research Program
|
|
|
|
## Research question
|
|
|
|
Can a constrained, local-first security agent normalize AI-related artifacts, apply transparent policies, and produce useful evidence without executing untrusted content or sending it to an external service?
|
|
|
|
## Current method
|
|
|
|
AAISA separates discovery, immutable artifact evidence, deterministic policy evaluation, reporting, and human decision. Research claims are tied to versioned code, fixture digests, explicit limitations, and reproducible commands.
|
|
|
|
## Current workstreams
|
|
|
|
1. Artifact schemas and safe parsers
|
|
2. Rule quality and evaluation science
|
|
3. Prompt and agent-tool security
|
|
4. Model and dataset provenance
|
|
5. Software supply-chain evidence
|
|
6. SARIF and interoperability
|
|
7. Privacy, redaction, and secure report handling
|
|
8. Contributor experience and governance
|
|
|
|
## Research boundaries
|
|
|
|
The default system does not execute artifacts, make network requests, exploit targets, recover credentials, or modify source content. Probabilistic analyzers remain out of scope until isolation, provenance, confidence, and data-governance requirements are approved.
|