tPj'8dZddlmZddlmZmZGddZy)z Compliance checker for EU AI Act and GDPR regulations. Provides guardrail-agnostic compliance validation based on guardrail modes and execution results rather than specific guardrail names. )Final)ComplianceCheckRequestComplianceCheckResultceZdZdZdefdZdedeefdZ e de dede fdZ d eede fd Zd eede fd Zdefd Zdefd ZdefdZdefdZdefdZdefdZdeefdZdeefdZy)ComplianceCheckera% Validates compliance with EU AI Act and GDPR regulations. Uses guardrail-agnostic checks based on: - Whether any guardrails ran - Guardrail execution mode (pre-call, post-call, etc.) - Whether guardrails intervened/blocked content - Completeness of audit records datac<||_|jxsg|_yN)rguardrail_information guardrails)selfrs d/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/compliance_checks.py__init__zComplianceChecker.__init__s 44:modereturnc|jDcgc]&}|j|jd|s%|(c}Scc}w)z Get all guardrails that ran in a specific mode. If a guardrail doesn't have a mode specified, it's treated as pre-call (the most common case). guardrail_mode)r _mode_matchesget)r rgs r_get_guardrails_by_modez)ComplianceChecker._get_guardrails_by_modes6 ??`ad.@.@GWAXZ^._```s&==g_modec|dk(St|tr|k(St|ttfr!t |xrt fd|DSt|t ry|jd}|y|jd}t|t rt|jng}dtdtffd t fd |g|DSy) a Return True only when a guardrail with logged ``guardrail_mode`` of ``g_mode`` is guaranteed to have run in ``mode`` for the audited request. ``guardrail_mode`` in a spend log can take several shapes because ``LitellmParams.mode`` is typed ``Union[str, List[str], Mode]``, and when the event type cannot be inferred at write time the raw config is logged verbatim. The spend log records the configured mode(s), not the concrete hook that fired for a given request; a match reports a mode satisfied only when every configured branch runs in that mode, so True never claims a hook the guardrail may not have actually executed. Fails safe: if the guarantee cannot be established (missing default, divergent per-tag override, or a list that runs in more than one mode), the guardrail counts for no mode. The precise fix is to log the resolved event mode and match on it; this is the safe interim. pre_callc3(K|] }|k( ywr .0mrs r z2ComplianceChecker._mode_matches..@s'BaT 'BdefaultFtagsbranchrct|tr|k(St|ttfr!t |xrt fd|DSy)Nc3(K|] }|k( ywr rrs rr!zPComplianceChecker._mode_matches.._branch_runs_in_mode..Ls/JaT /Jr"F) isinstancestrlisttupleboolall)r%rs r_branch_runs_in_modez=ComplianceChecker._mode_matches.._branch_runs_in_modeHsBfc*!T>)ftUm4<JC/J6/J,JJrc3.K|] }|ywr r)rr%r.s rr!z2ComplianceChecker._mode_matches..Os[+F3[s) r(r)r*r+r,r-dictrvaluesobject)rrr#r$ tag_branchesr.s ` @rrzComplianceChecker._mode_matches(s& >:% % fc "T> ! ftUm ,<BC'B6'B$B B fd ##ZZ 2G **V,D9CD$9O$t{{}"5UWL V  [7BZ\BZ[[ [rr cB|D]}|jdd}|dvsyy)z;Check if any guardrail intervened (blocked/masked content).guardrail_status)guardrail_intervenedfailedblockedTFr)r r rstatuss r_has_guardrail_interventionz-ComplianceChecker._has_guardrail_interventionRs3 AUU-r2FFF rc,|sytd|DS)z4Check if all guardrails passed (no issues detected).Fc3DK|]}|jddk(yw)r5successNr:)rrs rr!z;ComplianceChecker._all_guardrails_passed..^sNa155+, 9Ns )r-)r r s r_all_guardrails_passedz(ComplianceChecker._all_guardrails_passedZsN:NNNrct|jdkD}tdd||rt|jdSdS)z-Art. 9: Check if any guardrails were applied.rzGuardrails appliedzArt. 9z guardrail(s) appliedzNo guardrails applied check_namearticlepasseddetail)lenr r)r has_guardrailss r_check_art_9_guardrails_appliedz1ComplianceChecker._check_art_9_guardrails_appliedbsS #DOO 4q 8$+!FTs4??+,,AB   [r   rc|jd}t|dkD}tdd||rt|dSdS)zJ EF 1FGF$1"!   rc t|jj}t|jj}t|jj}t |j dkD}|xr |xr|xr|}g}|s|jd|s|jd|s|jd|s|jdtdd||rd Sd d j| S) z+Art. 30: Check if audit record is complete.rrQrRrSrTrUzArt. 30rVrWrXrBrYr\s r_check_art_30_audit_completez.ComplianceChecker._check_art_30_audit_completercrc`|j|j|jgS)a Check EU AI Act compliance. Returns: List of compliance check results for: - Art. 9: Guardrails applied - Art. 5: Content screened before LLM (pre-call screening) - Art. 12: Audit record complete )rIrOrbr s rcheck_eu_ai_actz!ComplianceChecker.check_eu_ai_acts2  0 0 2  . . 0  - - /  rc`|j|j|jgS)a Check GDPR compliance. Returns: List of compliance check results for: - Art. 32: Data protection applied (pre-call screening) - Art. 5(1)(c): Sensitive data protected - Art. 30: Audit record complete )rerjrlrns r check_gdprzComplianceChecker.check_gdprs2  . . 0  9 9 ;  - - /  rN)__name__ __module__ __qualname____doc__rrr)r*r0r staticmethodr2r,rr<r@rrIrOrbrerjrlrorqrrrrrs;3;aCaDJa'f'C'D''Rd4jTOdOO 1F   /D   .C 6  /D   :O * .C 6 &;!<  D!67 rrN)rutypingr(litellm.types.proxy.compliance_endpointsrrrrrrrys  c c r