feat(F): F-PERM permissions, F-APPR approval, F-AIUSE metadata, F-TRANS transparency, F-DATA-POL data policy, F-OVERSIGHT decision record, F-DRY dry-run, F-AUDIT audit log

- F-PERM: app/ai/agent_permissions.py (230 lines) — AgentPermissionContext, resolve_agent_permissions(), filter_visible_agents(), check_agent_execute_permission(), optimistic locking - F-APPR: app/core/approval.py (160 lines) + app/routes/approvals.py (305 lines) + migration 0123 — ApprovalRequest model, CRUD API, approve/reject/expire - F-AIUSE: app/ai/ai_use_case.py (156 lines) — AIUseCaseMetadata Pydantic model, validate_ai_use_case() - F-TRANS: app/ai/transparency.py (60 lines) — mark_as_ai_generated(), is_ai_participant() - F-DATA-POL: app/ai/data_policy.py (210 lines) — enforce_data_policy() with SENSITIVE_FIELDS + provider compliance - F-OVERSIGHT: app/ai/oversight.py (108 lines) — DecisionRecord, create_decision_record() - F-DRY: agent_loop.py updated with dry_run parameter - F-AUDIT: agent_loop.py updated with audit log for tool calls - agent_routes.py: AI use case metadata endpoints added - main.py: approval routes registered - All Python compile checks pass
2026-08-17 16:57:50 +02:00
parent dbeadd8ab1
commit 638e3f3e1e
11 changed files with 1455 additions and 1 deletions
@@ -0,0 +1,81 @@
+"""Create approval_requests and ai_decision_records tables.
+
+Adds the central approval-request table for agent action approval (F-APPR)
+and the AI decision-record table for the human-oversight audit trail
+(F-OVERSIGHT).
+
+Revision ID: 0123
+Revises: 0122
+"""
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import JSONB, UUID as PGUUID
+
+revision = "0123"
+down_revision = "0122"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "approval_requests",
+        sa.Column("id", PGUUID(as_uuid=True), primary_key=True),
+        sa.Column("tenant_id", PGUUID(as_uuid=True), nullable=False),
+        sa.Column("entity_type", sa.String(80), nullable=False),
+        sa.Column("entity_id", PGUUID(as_uuid=True), nullable=False),
+        sa.Column("action", sa.String(120), nullable=False),
+        sa.Column("requested_by", PGUUID(as_uuid=True), nullable=False),
+        sa.Column("requested_by_type", sa.String(20), nullable=False, server_default="agent"),
+        sa.Column("approver_id", PGUUID(as_uuid=True), nullable=True),
+        sa.Column("approver_group", sa.String(120), nullable=True),
+        sa.Column("status", sa.String(20), nullable=False, server_default="pending"),
+        sa.Column("comment", sa.Text(), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column("resolved_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("metadata", JSONB, nullable=False, server_default=sa.text("'{}'::jsonb")),
+    )
+    op.create_index(
+        "ix_approval_requests_tenant_status", "approval_requests", ["tenant_id", "status"]
+    )
+    op.create_index(
+        "ix_approval_requests_tenant_entity",
+        "approval_requests",
+        ["tenant_id", "entity_type", "entity_id"],
+    )
+    op.create_index(
+        "ix_approval_requests_tenant_approver",
+        "approval_requests",
+        ["tenant_id", "approver_id"],
+    )
+
+    op.create_table(
+        "ai_decision_records",
+        sa.Column("id", PGUUID(as_uuid=True), primary_key=True),
+        sa.Column("tenant_id", PGUUID(as_uuid=True), nullable=False),
+        sa.Column("agent_run_id", PGUUID(as_uuid=True), nullable=False),
+        sa.Column("recommendation", sa.Text(), nullable=False),
+        sa.Column("evidence", JSONB, nullable=False, server_default=sa.text("'{}'::jsonb")),
+        sa.Column("reviewer_id", PGUUID(as_uuid=True), nullable=True),
+        sa.Column("decision", sa.String(20), nullable=True),
+        sa.Column("decision_timestamp", sa.String(40), nullable=True),
+        sa.Column("deviation_note", sa.Text(), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("owner_id", PGUUID(as_uuid=True), nullable=True),
+    )
+    op.create_index(
+        "ix_ai_decision_records_tenant_run", "ai_decision_records", ["tenant_id", "agent_run_id"]
+    )
+
+
+def downgrade() -> None:
+    op.drop_index("ix_ai_decision_records_tenant_run", table_name="ai_decision_records")
+    op.drop_table("ai_decision_records")
+    op.drop_index("ix_approval_requests_tenant_approver", table_name="approval_requests")
+    op.drop_index("ix_approval_requests_tenant_entity", table_name="approval_requests")
+    op.drop_index("ix_approval_requests_tenant_status", table_name="approval_requests")
+    op.drop_table("approval_requests")