Design

Architecture & Threat Model

The lab is deliberately small: typed fixtures in, pure functions in the middle, presentation out. There is no server-side evaluation, no model provider, and no persistence — which removes whole classes of risk from the demo and makes the boundary between demonstration and production explicit.

Synthetic: everything on this page is fabricated fixture data. No live model was called and no real personal data is present.

Data flow

All in-process, all synthetic

  fixtures.ts                scoring.ts                 routes/*.tsx
┌───────────────┐        ┌──────────────────┐        ┌──────────────┐
│ SafetyTestCase│        │ scoreResponse()  │        │ Overview     │
│ SimulatedResp.│ ─────► │ riskBand()       │ ─────► │ Domain pages │
│ EvaluationRun │        │ verdictFor()     │        │ Audit / Docs │
│ AuditEvent    │        │ passRate()       │        └──────────────┘
└───────────────┘        │ detectFabricated │
                         │ SensitiveData()  │
   typed, versioned      └──────────────────┘        rendered read-only
                          pure + unit tested

Trust boundaries crossed: none. No network egress, no storage, no auth,
no model provider, no user-supplied input is executed or persisted.

Threat model

Defensive posture only

ID	Threat	Asset	Evaluation response
T1	Untrusted content becomes instruction	Assistant behaviour	Probes in the instruction-robustness and tool-safety domains assert that pasted documents and tool output are handled as data.
T2	Sensitive material reproduced in output	Customer data	Shape-based detector over responses; masked reporting; leakage weighted at 0.25 of the rubric.
T3	Inconsistent policy across surfaces	Regulatory posture	Fixed-question / varied-surface probes plus run-over-run score comparison.
T4	Unsafe or unscoped tool invocation	Downstream systems	Confirmation-gate and least-privilege probes; restraint scored explicitly.
T5	Evaluation results that cannot be reproduced	Assurance credibility	Pure scoring functions, versioned fixtures, unit tests covering boundaries.
T6	Evaluation artefacts become a data source themselves	The lab itself	Only fabricated data is stored; the detector returns masked values; no live API keys exist in this project.

Implemented vs. production

No capability is overstated

Test library & fixtures

implemented

In this MVP: Typed synthetic probe catalogue with severity, intent and expected behaviour.

Production gap: Real suites need versioned corpora, per-tenant policy variants, and provenance tracking.

Deterministic scoring

implemented

In this MVP: Pure weighted rubric, risk bands, pass rates and verdicts — unit tested.

Production gap: Production adds inter-rater calibration and rubric drift monitoring.

Sensitive-data detection

implemented

In this MVP: Shape-based detector over fabricated identifiers; always returns masked matches.

Production gap: Production needs entity-aware detection, locale coverage, and false-positive review.

Model execution

simulated

In this MVP: None — all responses are stored fixtures.

Production gap: A real harness would call providers behind a broker with quotas, redaction, and logging.

Human review workflow

simulated

In this MVP: Review flags and reviewer notes surfaced everywhere a score is shown.

Production gap: Production needs reviewer identity, dual sign-off, and dispute handling.

Audit evidence

planned

In this MVP: Append-only fabricated event list with placeholder digests.

Production gap: Production requires tamper-evident storage, retention policy, and export attestation.

Continuous evaluation

planned

In this MVP: Runs are static fixtures compared side by side.

Production gap: Production schedules runs per release with regression gates in CI.

Responsible-AI boundaries

Defensive only: The library describes what is being checked, never how to defeat a control. No jailbreak text, exploit payloads, or bypass instructions appear anywhere in this project.
No real data: Every identifier, tenant, reviewer, vendor and timestamp is invented. Fabricated identifiers use reserved example domains and test ranges.
No live inference: There is no model provider, API key, or network call. Responses are stored text.
Human in the loop: High-stakes results cannot auto-pass. The UI shows the review state wherever it shows a score.
Not a certification: A green pass rate here means fixtures agreed with a rubric. It is not evidence about any real product's safety.