إنتقل إلى المحتوى الرئيسي

⚖️ AI Governance & Ethics

BayanCore enforces structural governance policies to ensure its artificial intelligence operates transparently, safely, and ethically in compliance with the SDAIA AI Ethics Principles.

1. Safety Guardrail Architecture​

The system wraps the LLM in three distinct safety layers:

Input Guardrails (PII & Injection)​

  • Prompt Injection Filters: Incoming user queries are evaluated against heuristic patterns to block prompt injections or attempts to bypass system constraints.
  • PII Redaction: Identifiers (Iqama numbers, bank IBANs, phone numbers) are masked at the gateway before LLM processing, preventing PII leaks to the inference context.

Output Guardrails (Deterministic Checkers)​

  • Hallucination Filters: If the LLM generates an analytical claim containing financial numbers (e.g. "Your outstanding receivables total SAR 24,500"), the system parses the statement and programmatically queries MariaDB. If the actual database value differs, the system overrides the LLM response with the verified value.
  • Confidence Thresholds: Every LLM generation calculates a token confidence score. Responses scoring below a threshold (85%) are flagged with an uncertainty warning, requesting the user verify the cited documents manually.

Execution Guardrails (RBAC Enforcement)​

  • Role Segregation: The agent maps intents to executable tools. If the user's role does not possess permissions to execute the target action manually, the system blocks the execution and logs the attempt.

2. K-Anonymity & Privacy Protection​

When training models or testing retrieval pipelines:

  • Zero Raw Data Training: Customer databases are never used to train global LLM weights.
  • K-Anonymity Standards: Context datasets extracted for training LoRA parameters undergo anonymization. Any personal detail or transaction value is scrubbed and generalized so that an individual record cannot be identified from a group of size $K$ ($K \ge 100$).

3. AI Explainability & Transparency​

To maintain user trust, particularly during financial audits:

  • Source Attribution: The Information Agent is programmatically blocked from outputting claims without providing clickable markdown links to the specific source records (e.g. [Invoice #PINV-041](file:///...)).
  • Arabic Logic Explanations: When the AI drafts or recommends actions (such as matching a bank transaction), it must supply a clear, bilingual description of its reasoning:
    • System Logic: Match confirmed.
    • AI Explanation: "Matched bank row (SAR 1,500, May 15) to Sales Invoice #INV-104 based on exact amount match and a 94% string similarity match on the depositor name."