You cannot authorize
what you cannot see.
Org-wide AI adoption is outrunning the evidence required to secure it. LowRisk.io sits at your egress boundary, parses every LLM and remote MCP invocation, and generates the defensible artifacts required for Continuous Authorization.
Who carries the risk
A person pastes. A regulator asks. You answer.
A nurse pastes PHI into a chatbot. A developer points an agent at a credentials file. An analyst drops a case file into a summarizer. None of them meant to create a disclosure event — and none of them will be in the room when someone asks for the record.
The people who ask are a family’s lawyer, a CJIS auditor, a FOIA officer, a federal investigator. The person who answers is the CISO, the Authorizing Official, or the agency head who accepted the risk.
LowRisk.io sits on the egress path so that answer is inventory, enforcement decisions, and period evidence — not a reconstruction after the fact.
Pragmatic Boundaries. Zero Overclaiming.
A security control that overpromises is a liability during an assessment.
- [ NO ]CUI / ITAR determination. We detect structural markings and endpoint jurisdictions. The originating agency designates CUI; we enforce your routing rules.
- [ NO ]De-identification. Masking reduces exposure. It does not meet the regulatory threshold for cryptographic de-identification.
- [ NO ]Complete detection. Published PII/PHI detectors land around F1 0.6–0.9; we ship a harness so you measure recall on your corpus.
- [ NO ]Full MCP coverage. Remote HTTP transport only — stdio has no network vantage point.
- [ NO ]Validation authority. We produce continuous monitoring telemetry. The Authorizing Official accepts the risk.
- [ NO ]Export-control determination. ITAR turns on data nature and recipient jurisdiction — not which words appear. Endpoint allowlisting by jurisdiction is what we enforce.
Implementation mechanics
A protocol-aware egress proxy. Not a tap. Not DNS magic.
LowRisk.io is a forward / reverse AI egress proxy that applications point at (OPENAI_BASE_URL or SDK base URL). Default topology is one gateway per authorization boundary. A sidecar is optional when a system needs policy isolation. It is not a network tap, not a transparent MITM of browser SWG traffic, and not a tunnel (CONNECT is refused).
- Intercept Inspects standard REST, LLM completions, and remote HTTP MCP traffic. Stdio MCP is intentionally out of scope — no network vantage point.
- TLS & crypto Terminates client TLS with rustls + aws-lc-rs (FIPS; CMVP #4816 on the certified variant). Re-originates to upstream. Module status stamped on every evidence record.
- Streaming Response inspection uses a sliding window — it does not buffer full completions to decide, so time-to-first-token stays intact.
- Closed path Restrict model egress so traffic must transit the proxy. Without that, “all AI traffic is inspected” is an assumption, not a control.
Full leave-behind: architecture-overview.pdf
Not your existing SWG / DLP
Palo Alto, Zscaler, and Netskope were not built for streaming LLM context.
When a CISO hears “boundary intercept,” the first question is whether the Secure Web Gateway already covers it. Legacy CASB/DLP regex proxies do not maintain streaming LLM context or validate MCP tool parameters, tool-supplied URLs, or token audiences. They also do not produce the authorization package your AO signs.
| Axis | Legacy CASB / SWG DLP | LowRisk.io |
|---|---|---|
| Enforcement point | Browser / agent SWG; often opt-in or category-based | AI egress proxy; direct path verified closed (acceptance test #1) |
| LLM traffic | Generic HTTP inspection; weak streaming context | Protocol adapters for completions + streaming window detection |
| MCP | Not designed for tools/call parameter or URL-egress gates | Remote HTTP MCP: tool allowlists, parameter validation, URL SSRF filters |
| Evidence | Dashboard alerts and vendor logs | Hash-chained records → OSCAL, SCN, CRM, AO one-pager, KSI-aligned bundles |
| Custody | Often vendor-held or SaaS | Self-hosted / air-gapped; evidence stays in your boundary |
Non-goal: we are not a CASB/SSE for consumer browser AI. Platform incumbents own that surface.
Show the artifacts
What Continuous Authorization actually looks like.
Illustrative dossiers from an example system profile — not assessment results, not asserted control passes. Aligned, not certified.
req_id: a7f8b9c2 principal: hrba-app stream: benefits-assistant action: REDACT categories: [employee-pii] dest: api.openai.com prev_hash: 0x9f4…2a1 this_hash: 0xc31…8e0 fips_module: aws-lc-fips-2.0 fips_status: CMVP-4816 ksi_refs: [KSI-IAM, KSI-CNA]
Proof is gated in CI — not asserted in a slide.
RR-1 Detection incomplete (F1 0.6–0.9). Mitigation: customer harness + sampled review.
RR-2 Model enrichment is advisory; cannot block inline.
RR-3 Proxy is a new SPOF on AI egress under fail-closed.
Accepted by: System Owner — signature required — not yet signed
Built for the regimes that ask
Same data plane. Different inheriting frameworks.
Aligned, not certified. Each row is what counsel already knows — plus what LowRisk.io maps from traffic and CI-gated control evidence.
| Sector | Framework | Cited exposure | What LowRisk.io maps to |
|---|---|---|---|
| Healthcare | HIPAA Security Rule | Avg. healthcare breach cost $9.77M (IBM Cost of a Data Breach Report 2024) | PHI-class detection profiles; allow-with-audit / block at egress; period evidence for BA / security risk analysis support |
| Law enforcement | CJIS Security Policy | CJIS audits ask who accessed what, when — AI tools that summarize case files create a new access path with no native audit trail | Stream inventory by principal and destination; hash-chained decision records; exportable incident-window queries |
| Government | FedRAMP CR26 / KSIs · RMF | Mandatory CR26 KSI adoption 1 Jan 2027; narrative SSPs no longer carry the load alone | 23 FedRAMP KSIs mapped in CI; OSCAL component definition; drafted SCN; quarterly evidence bundle |
| Defense / DIB | CMMC · ITAR / EAR | Export-controlled technical data leaving via a SaaS model is a jurisdiction failure, not a prompt typo | Endpoint allowlisting by jurisdiction; CUI marking detection (not designation); self-hosted / air-gapped deploy |
| Financial services | GLBA · SOX | Prompts with account identifiers or control narratives create retention and disclosure obligations the model vendor does not share | Classification + enforcement at egress; customer-held evidence chain; CRM for what stays yours |
| Education | FERPA | Student PII in tutoring / advising bots is an education record once maintained by the institution | Inventory of AI apps touching student data; redaction / block policies; assessor-facing control statements |
Architecture
Enforce the Boundary. Generate the Evidence.
Legacy DLP and CASB solutions fail on streaming LLM context and tool-call parameters. LowRisk.io operates as a protocol-aware inspection layer.
01 // Intercept
Protocol-agnostic inspect of standard REST, LLM completions, and remote HTTP MCP. Stdio MCP intentionally bypassed.
> llm | mcp_http | rest
> inventory from traffic
02 // Enforce
Drop, redact, or flag before external infrastructure. Endpoint allowlists by jurisdiction.
> action: REDACT
> forward re-originated TLS
03 // Telemetry
Map egress events to frameworks. Export machine-readable KSIs for the authorization package.
> oscal + crm delta
> draft SCN / AO one-pager
Try it in two minutes
Observe-only. Inventory from traffic.
Point one application at the proxy. It enforces nothing and inventories everything — including shadow AI your teams didn’t report.
$ make quickstart
$ export OPENAI_BASE_URL=http://localhost:8080/v1
What goes in. What comes out.
The proxy is how the evidence is collected. The evidence is the product.
INPUTS // INGEST & CONFIGURATION
| Traffic | LLM API calls, remote-HTTP MCP, general REST/API egress, plus network flow data to detect boundary bypass. |
|---|---|
| Policy Config | streams.yml: sensitivity levels, detection profiles, action modes (observe/redact/block), jurisdiction allowlists, spend limits. |
| Policy Bundles | Versioned and cryptographically signed. Unsigned or tampered bundles are refused outright. |
| Authorities | Pinned catalogs: SP 800-53 Rev 5.2.0, FedRAMP KSIs, OpenTelemetry GenAI conventions. |
| Identity | API keys, JWT/OAuth, mTLS, OIDC context mapping principal to payload. |
| Legal Process | Legal-hold and subject-rights erasure requests as first-class chained events. |
OUTPUTS // ARTIFACTS BY AUDIENCE
| For Apps & Users | |
|---|---|
| To Apps | Redacted content with deterministic token restoration; structured denial codes with opaque event refs linking to evidence. |
| To Users | Configurable notifications (default: warn). Note: User notification is independent of SIEM alerting. |
| For SOC & Assessors | |
|---|---|
| To SIEM | Tamper-evident export, at-least-once delivery, air-gapped file sinks, OTLP. Shipped with content packs (parsers, dashboards). Repeated-block signals. |
| To ISSO/AO | Hash-chained evidence, drafted SCNs, SIAs, OSCAL definitions reconciled vs actual tests, AO one-pager, block distribution report. |
| For Privacy, Agents & Ops | |
|---|---|
| Privacy / Legal | Privacy-plan evidence, chain-preserving erasure tombstones, legal-hold records. |
| To Agents | MCP server exposing read/preflight tools (e.g. check_policy) to avoid violations before sending content. Signed llms.txt. |
| Operators | Console with policy test bench, stream simulator, dry-run diffs. |
| Every Release | Signed containers, SBOM, provenance, signed conformance report, FIPS-active stamps. |