Institutional AI and research disclosure policy — r34

PF Simulation r34 can persist organization and project policies for external AI. These controls govern both a user's personal BYOK account and an operator's configured provider. They do not alter standalone physics or numerical solvers.

Deployment and migration

Run the explicit SaaS database migration before serving the updated application:

python -m pf_saas init

The migration adds research policy and consent tables alongside the project-access migration. Historical runs and evidence remain unchanged. Back up the database and existing credential encryption keys before upgrading.

The new reference institutional deployment sets:

PF_SAAS_RESEARCH_POLICY_DEFAULT=institutional

This setting denies external AI, provider access and source disclosure until an organization administrator configures an explicit policy. Normal simulation execution, evidence inspection and private layers remain available.

For an existing deployment, the default value is legacy. Without explicit organization/project policies, previously operator-authorized assistant behavior remains available. Set institutional deliberately during a scheduled migration to begin with external disclosure disabled. Every API replica must use the same setting, database, approved endpoint map and credential encryption keys.

An explicit policy is enforced in either mode. Project policy can further restrict an organization policy; it cannot grant an exception to it.

Policy fields

The classification order is public, internal, confidential, restricted. If the effective classification exceeds the ceiling, requests are denied. Classification is an administrator-supplied policy label; PF Simulation does not infer sensitive content or automatically classify individual attachments. Use the project's most sensitive permitted data when assigning its classification.

Named providers must use their canonical service endpoints when an explicit or institutional policy applies. Compatible endpoints must match an operator-approved HTTPS endpoint. BYOK policies use the endpoint ID actually selected by the user; operator configuration supplies a URL and is allowed when an approved alias for that exact URL is in the effective allowlist. Selecting BYOK does not bypass these checks. The operator must assess the chosen service's retention, contractual and residency arrangements; the software does not assert that an allowlisted service meets them.

Administrator API

Authenticated organization members can read an organization policy. Organization administrators and owners can update it:

GET /api/organizations/{org_id}/research-policy
PUT /api/organizations/{org_id}/research-policy
GET /api/projects/{project_id}/research-policy
PUT /api/projects/{project_id}/research-policy

A project policy also requires access to that project, including an explicit project grant when its sharing is restricted. A platform administrator has no implicit project-data bypass. These endpoints use the existing login and CSRF protection. Policy writes and consent grants/revocations create audit events.

GET returns policy, revision and configured; project GET also returns effective_policy. PUT requires all seven policy fields and the revision just read, preventing a stale administration page from overwriting a newer policy:

{
  "expected_revision": "<revision returned by GET>",
  "policy": {
    "external_ai_enabled": true,
    "allowed_providers": ["openai"],
    "allowed_endpoint_ids": [],
    "source_disclosure_allowed": true,
    "require_consent": true,
    "data_classification": "internal",
    "maximum_external_data_classification": "internal"
  }
}

This is an illustrative internal-data policy, not a recommendation to disclose any particular research data. Project defaults inherit the organization limits.

User disclosure consent

The hosted controls display the effective policy and disclosure statement. For the selected project, the consent API is:

GET    /api/assistant/disclosure-consent
POST   /api/assistant/disclosure-consent
DELETE /api/assistant/disclosure-consent
X-PF-Project: <project_id>

GET identifies the provider, model and endpoint and returns the disclosure statement, allowed, reason, consent_required, consent_current, expires_at and a fingerprint. POST requires { "accepted": true, "fingerprint": "..." } using the fingerprint the user reviewed. A viewer cannot grant consent for chat.

Consent covers messages, selected run evidence, attachments and source excerpts from that project. It expires after 24 hours and is bound to the authenticated user, project, current effective policy revision, provider/model/endpoint and personal credential revision. It is not transferable to another user or project. Policy changes or BYOK rotation require a fresh consent when consent is required. DELETE revokes the current user's consent. Credentials never appear in policy or consent responses or audit records.

Enforcement and verification scope

The adapter checks current project access, effective policy and consent before chat admission. The provider transport repeats the check immediately before every outbound HTTP attempt, including tool rounds, provider retries and resumed investigations. A saved provider object or investigation checkpoint cannot retain an earlier permission. Revocation blocks the next request; already transmitted requests cannot be recalled.

The controls apply to the SaaS research-assistant outbound provider path. They do not replace network-level egress controls or govern arbitrary software that an operator runs outside PF Simulation. Scientific jobs and isolated assistant code execution keep their existing execution policies.

Run the authored boundary tests with:

python -m pytest -q tests_saas/test_r34_research_policy.py

These tests cover deny-before-network, operator and personal credential paths, policy intersection, classifications, stale/expired/revoked consent, HTTP retry revocation, an actual paused/resumed investigation, authorization and redaction. Provider replies are test fixtures; no paid AI service or scientific model accuracy is claimed by these security checks.