Security & Compliance - PLai Framework Documentation

Security is built into PLai Framework at every level. This guide covers access control, credential management, safety guardrails, and compliance features.

Role-Based Access Control (RBAC)

RBAC determines who can do what in your organization and projects.

How RBAC Works

Organization level
- OWNER — full access
- ADMIN — full access (except billing)
- VIEWER — read-only
Members join projects
Project level (within each project)
- MEMBER — create and edit resources
- VIEWER — read-only access

Access Matrix

Resource	OWNER	ADMIN	MEMBER	VIEWER
View org/projects	✅	✅	✅ (their project)	✅ (their project)
Create agents	✅	✅	✅ (in project)	❌
Edit agents	✅	✅	✅ (in project)	❌
Delete agents	✅	✅	✅ (in project)	❌
Create workflows	✅	✅	✅ (in project)	❌
Invite members	✅	✅	❌	❌
Manage org settings	✅	✅	❌	❌
View billing	✅	❌	❌	❌

Best Practices for Access Control

Least Privilege

Grant only the minimum access needed. Default to VIEWER, grant MEMBER when necessary.

Regular Audits

Periodically review who has access and remove unnecessary members

Segregate Projects

Use different projects for different teams/use cases for better isolation

Admin Reviews

Have OWNER/ADMIN regularly review who has access to sensitive projects

Credentials: Secure Secret Storage

Credentials are securely stored API keys, tokens, passwords, and other secrets that tools and agents need.

What Can Be Stored as Credentials

API Keys - For external services (SendGrid, Stripe, etc.)
Tokens - OAuth tokens, bearer tokens
Passwords - Database passwords, service accounts
Connection Strings - Database URLs, connection info
Certificates - SSL certificates, authentication certs

Credential Security

PLai Framework keeps credentials safe: ✅ Encryption - All credentials encrypted at rest
✅ Access Control - Only assigned agents can use them
✅ Audit Logging - Every access logged and tracked
✅ Rotation - Easily update without recreating tools
✅ Scope - Credentials scoped to specific projects/agents

Using Credentials

Create Credential

Go to Project Settings → Credentials → Add credential

Enter Secret

Provide the API key, token, or password

Name It

Give it a descriptive name (e.g., “SendGrid API Key”)

Assign to Tools

When creating a tool, select which credential to use

Verify

Test the tool to ensure credential works

Credential Best Practices

Never put credentials directly in agent instructions or datasources. Always use the Credentials system.

✅ Use descriptive names (“SendGrid API”, not “key1”)
✅ Rotate credentials periodically
✅ Use service accounts instead of personal credentials
✅ Limit credential scope to only what’s needed
✅ Audit who accessed credentials

Guardrails: Safety Constraints

Guardrails are safety rules that constrain what agents can do.

Types of Guardrails

Content Filtering

Prevent agents from outputting certain types of content:

No sensitive data (PII, passwords, etc.)
No hate speech or offensive content
No instructions for illegal activities
Custom filters based on keywords

Rate Limiting

Control how much an agent can do:

Max calls per hour/day
Max processing time per request
Throttle requests during high load
Prevent accidental runaway costs

Input Validation

Ensure inputs meet safety requirements:

Max input length
Required fields
Allowed patterns/formats
Block suspicious inputs

Output Validation

Verify outputs before sending:

Check response quality
Validate format
Ensure no sensitive data leaked
Scan for malicious content

Capability Restrictions

Limit which tools agents can use:

Only specific APIs allowed
No code execution
No external datasources
Restricted tool parameters

Answer Filters

Answer Filters are specific guardrails for agent responses.

Agent generates response
Answer filters apply:
- Check length
- Check tone
- Scan for PII
- Validate accuracy
- Check confidence
Response sent or blocked

Configuring Guardrails

Go to Agent Settings

Open your agent configuration

Find Guardrails Section

Look for Safety, Constraints, or Guardrails settings

Define Rules

Set specific constraints:

Max tokens: 2000
Rate limit: 100/hour
Disallowed terms: [list]

Test

Test agent with guardrails enabled

Monitor

Track how often guardrails trigger

Encryption & Data Protection

Data Security at Rest

🔒 All data encrypted in database (AES-256)
🗄️ Backups encrypted
📝 Credentials double-encrypted
🔑 Encryption keys rotated regularly

Data Security in Transit

🔐 All communication via HTTPS/TLS
🤝 Certificate pinning for APIs
📊 Secure WebSocket connections
🛡️ DDoS protection

Data Retention

📅 Configurable retention policies
🗑️ Automatic deletion after X days
📋 Audit logs retained longer
🔄 Backups kept for recovery

Activity Audit Logs

Audit logs track everything that happens in your organization and projects.

What Gets Logged

Action	Logged Details
Agent created	Who, when, configuration
Agent modified	What changed, by whom
Tool used	Which agent, which tool, inputs/outputs
Credential accessed	Which credential, when, by which agent
Member added	Who, role, when
Settings changed	What changed, by whom
Export data	What, when, by whom

Accessing Audit Logs

Organization Settings → Audit Logs
or
Project Settings → Activity Log

Filter by:
- Date range
- User
- Action type
- Resource affected

Audit Log Fields

Timestamp: 2024-01-15 14:23:45 UTC
User: alice@company.com
Action: agent.create
Resource: "Support Bot"
Organization: Acme Corp
Project: Customer Support
Details: "Created agent with Claude 3.5 Sonnet model"
IP Address: 203.0.113.45

Compliance Features

Data Governance

✅ Data classification (public, internal, confidential)
✅ Access controls based on classification
✅ Automatic masking of sensitive data
✅ Compliance reporting

Privacy

✅ No data used for model training (data stays yours)
✅ GDPR compliance (right to be forgotten)
✅ Data residency options (EU, US, etc.)
✅ Privacy-preserving analytics

Monitoring & Alerts

🚨 Alerts for unusual activity
📊 Compliance dashboards
🔍 Threat detection
📋 Regular compliance reports

Security Best Practices

For Organizations

Limit OWNER Role

Keep OWNER role to 2-3 trusted people. Most people should be ADMIN or VIEWER.

MFA

Require multi-factor authentication for OWNER/ADMIN accounts

Regular Reviews

Monthly review of member access and audit logs

Incident Plan

Have a plan for security incidents. Know who to contact.

For Agents & Tools

Minimize Permissions

Only give agents the tools and datasources they actually need

Use Service Accounts

Use service account credentials, not personal credentials

Enable Guardrails

Always enable guardrails, especially for production agents

Rate Limit

Set reasonable rate limits to prevent runaway costs or abuse

For Data

Encrypt Credentials

Always use the Credentials system, never hardcode secrets

Mask PII

Use answer filters to prevent PII leakage

Audit Access

Regularly review audit logs for unauthorized access

Clean Logs

Archive old logs and delete sensitive test data

Troubleshooting Security Issues

Agent getting 'access denied' error

Solutions:

Check if agent has permission for the tool
Verify credential is valid and assigned
Check rate limits not exceeded
Ensure guardrails aren’t blocking legitimate requests

Credential not working

Solutions:

Verify credential value is correct
Check credential hasn’t expired
Test credential outside PLai
Recreate credential if needed

Concerned about data safety

Check:

Audit logs show who accessed what
All credentials encrypted
All communication HTTPS
Retention policies set appropriately
Guardrails enabled on production agents

Need to remove someone's access

Steps:

Go to Organization or Project Settings
Find the member
Click “Remove” (OWNER/ADMIN only)
They lose access immediately
Check audit log confirms removal

Compliance & Regulations

PLai Framework supports compliance with:

🇪🇺 GDPR - General Data Protection Regulation (EU)
🇪🇺 EU AI Act - The world’s first comprehensive legal framework regulating artificial intelligence across the European Union (EU)
📋 ISO 27001 - Information security management (certification in prgoress)

For compliance requirements, contact your account manager.

Key Takeaways

✅ RBAC - Control who can access what
✅ Credentials - Safely store and manage secrets
✅ Guardrails - Enforce safety constraints on agents
✅ Encryption - All data protected in transit and at rest
✅ Audit Logs - Track everything for accountability

Next Steps

Organizations & Projects - Learn about roles and invitations
Monitoring - Track security metrics
Contact Security Team - For enterprise compliance requirements

​Role-Based Access Control (RBAC)

​How RBAC Works

​Access Matrix

​Best Practices for Access Control

Least Privilege

Regular Audits

Segregate Projects

Admin Reviews

​Credentials: Secure Secret Storage

​What Can Be Stored as Credentials

​Credential Security

​Using Credentials

​Credential Best Practices

​Guardrails: Safety Constraints

​Types of Guardrails

​Answer Filters

​Configuring Guardrails

​Encryption & Data Protection

​Data Security at Rest

​Data Security in Transit

​Data Retention

​Activity Audit Logs

​What Gets Logged

​Accessing Audit Logs

​Audit Log Fields

​Compliance Features

​Data Governance

​Privacy

​Monitoring & Alerts

​Security Best Practices

​For Organizations

Limit OWNER Role

MFA

Regular Reviews

Incident Plan

​For Agents & Tools

Minimize Permissions

Use Service Accounts

Enable Guardrails

Rate Limit

​For Data

Encrypt Credentials

Mask PII

Audit Access

Clean Logs

​Troubleshooting Security Issues

​Compliance & Regulations

​Key Takeaways

​Next Steps

Role-Based Access Control (RBAC)

How RBAC Works

Access Matrix

Best Practices for Access Control

Credentials: Secure Secret Storage

What Can Be Stored as Credentials

Credential Security

Using Credentials

Credential Best Practices

Guardrails: Safety Constraints

Types of Guardrails

Answer Filters

Configuring Guardrails

Encryption & Data Protection

Data Security at Rest

Data Security in Transit

Data Retention

Activity Audit Logs

What Gets Logged

Accessing Audit Logs

Audit Log Fields

Compliance Features

Data Governance

Privacy

Monitoring & Alerts

Security Best Practices

For Organizations

For Agents & Tools

For Data

Troubleshooting Security Issues

Compliance & Regulations

Key Takeaways

Next Steps