内部应用程序接口安全指南

版本管理
  - 通过 URL 路径进行版本管理：/api/v1/resources
  - 旧版本至少 6 个月的支持期
  - 通过 Deprecation 标头通知版本更新

速率限制（默认值）
  - 一般 API：100 个请求/15 分钟
  - 认证 API：5 个请求/15 分钟
  - 公共 API：30 个请求/分钟
  - 始终返回 RateLimit-* 标头

响应
  - 内容类型：application/json（固定格式）
  - 错误响应采用 RFC 7807（问题详情）格式
  - 在生产中从不返回堆栈跟踪
  - 分页：默认 20 项，最多 100 项

必填日志字段
  - 时间戳（ISO 8601，UTC）
  - 请求 ID（UUID，用于追踪）
  - 用户 ID / API 客户端 ID
  - HTTP 方法 + 端点
  - 状态代码
  - 源 IP
  - 响应时间

禁止日志字段（敏感数据）
  - 密码/令牌/API 密钥
  - 信用卡号
  - 完整显示 PII（需要屏蔽）

监控警报
  - 认证失败：每分钟 5 次以上时发出警报
  - 403 错误：每分钟 10 次以上时发出警报
  - 500 错误：发生 1 次立即发出警报
  - 超过速率限制：模式分析

■ Training Data Requirements
  - All training data must have documented provenance and licensing
  - PII must be removed or anonymized before use in training/fine-tuning
  - Data poisoning checks: validate data integrity with hash verification
  - Retain training data snapshots for reproducibility and audit

■ RAG (Retrieval-Augmented Generation) Data
  - Document ingestion pipeline must sanitize content (strip scripts, injections)
  - Access control on vector store must mirror source document permissions
  - Embedding models must be versioned and pinned

■ Model Output Data
  - LLM outputs must not be trusted as authoritative — always verify facts
  - Generated code must pass the same security review as human-written code
  - Outputs containing PII must be flagged and redacted before storage

■ Severity Levels for AI-Specific Incidents
  - P1 (Critical): Prompt injection leading to data exfiltration or unauthorized actions
  - P1 (Critical): Model serving compromised or returning manipulated outputs
  - P2 (High): Training data poisoning detected, jailbreak bypass discovered
  - P2 (High): Agent performing unintended actions outside approved scope
  - P3 (Medium): Model drift causing degraded accuracy below threshold
  - P4 (Low): Cost overrun due to excessive token usage

■ Response Procedures
  - P1: Immediately disable affected model endpoint, notify security team
  - P2: Quarantine affected model version, roll back to last known good
  - P3: Trigger retraining pipeline, increase monitoring frequency
  - P4: Adjust rate limits and budget caps, review usage patterns

■ Post-Incident Requirements
  - Root cause analysis within 48 hours for P1/P2
  - Update prompt injection test suite with new attack vectors
  - Review and update guardrails configuration