Risk Copilot, explained the Feynman way

guardrail_check() in backend/hybrid_agent.py runs on every input:

• Empty or over 2000 characters (MAX_INPUT_LEN) is rejected.
• A character allow-list regex ^[A-Za-z0-9 .,?!#$@:/()_-]+$ (only these symbols pass). A semicolon fails, so chained SQL cannot even be typed.
• Blocked whole words: DROP, DELETE, TRUNCATE, ALTER, GRANT, INSERT, UPDATE, UNION, INFORMATION_SCHEMA, XP_, EXEC.

Rate limits (streamlit_app.py):

• 10 per minute per browser session, kept in memory.
• 50 per hour per user in the RATE_LIMIT table, using one MERGE (insert-or-add-one in one statement) keyed by user and the hour window.
• An audit guard also counts only APPROVED and APPROVE_DENIED rows. Failed logins are left out, so a stranger cannot lock out a real officer by typing wrong passwords.
• Any error in the check blocks the request (fail closed).

classify_intent() tests three compiled regexes with \b word edges, in this order:

sar_draft      \b(?:sars?|suspicious|report(?:s|ed|ing)?)\b
policy_lookup  \b(?:polic(?:y|ies)|rules?|clauses?|regulations?)\b
tx_review      \b(?:transactions?|payments?|transfer(?:s|red|ring)?|tx)\b
otherwise      general

No AI is used here. It is deterministic (same input, same answer), free, and testable offline. The user's text never becomes SQL. Queries come from fixed templates, and user values are passed as bound parameters (sent separately from the SQL text).

fetch_transactions() builds one fixed query over TRANSACTIONS T:

SELECT T.TX_ID, T.ACCOUNT_ID, T.AMOUNT, T.CURRENCY, T.TX_DATE, T.MERCHANT
FROM TRANSACTIONS T WHERE 1=1
  [AND T.ACCOUNT_ID LIKE %s ESCAPE '\\']          -- filter, bound + LIKE-escaped
  [AND EXISTS (... A.RISK_TIER != 'RESTRICTED')]  -- non-officers only
ORDER BY T.TX_DATE DESC LIMIT 5 OFFSET 0

• LIMIT/OFFSET are Python ints that are clamped (limit 1–20, offset 0–10000), then written in as digits. The docs do not prove that server-side binding of LIMIT works, so they are never bound and never come from user text.
• Two layers of hiding:
  • the app-side filter and mask_rows();
  • Snowflake row access policies (ACCOUNTS_ROLE_FILTER, TRANSACTIONS_ROLE_FILTER) plus the masking policy MASK_CUSTOMER_NAME in sql/01_setup.sql.

vector_search() runs inside Snowflake:

SELECT POLICY_ID, TITLE, CLAUSE_TEXT,
  VECTOR_COSINE_SIMILARITY(CLAUSE_VECTOR,
    AI_EMBED('snowflake-arctic-embed-m-v1.5', %s)) AS SIM
FROM REGULATORY_POLICIES ORDER BY SIM DESC LIMIT 3

• CLAUSE_VECTOR is VECTOR(FLOAT, 768). Cosine similarity = (a·b) / (|a|·|b|), from −1 to 1, and near 1 means close in meaning.
• The model name must be a literal in the SQL, so it is checked against ALLOWED_EMBED_MODELS first (it raises ValueError if not listed).
• Each clause is cut to 400 characters (MAX_CLAUSE_CHARS).
• Optional: Cortex Search (USE_CORTEX_SEARCH=TRUE, sql/04), which adds keyword match and reranking. Any error or zero hits falls back to cosine.
• It runs once per question, and the same list feeds the screen, the prompt and the audit row.

_build_prompt():

• Uses up to 10 evidence lines (≤4000 characters) and up to 3 clauses.
• Cuts the whole prompt to 350 words.

_run_ai_complete() sends:

SELECT AI_COMPLETE(model => %s, prompt => %s,
  model_parameters => {'guardrails': TRUE, 'temperature': 0})

• Primary model: claude-sonnet-5 (GA, which means generally available; needs cross-region inference). Fallback: llama3.1-8b. Both are in an allow-list, and both run with Cortex Guard (Snowflake's harm filter).
• temperature 0 gives the most repeatable wording, which suits an audit trail.
• Fingerprints:
  • prompt_hash = SHA-256(prompt | model | version)
  • result_hash = SHA-256(report)
  Change one character and the hash changes.

approve_and_log() runs these checks in order:

• The draft must have status == "DRAFT", and the approver must be non-empty.
• Inside Snowflake (SiS): it reads the viewer from st.user.user_name at click time. The viewer must equal the approver and be in APP_OFFICERS (looked up with a bound value; a lookup error counts as “no”).
• Local: the Snowflake login must hold COMPLIANCE_OFFICER (checked with IS_ROLE_IN_SESSION). ALLOW_LOCAL_APPROVE is a demo-only switch, default FALSE.
• Pass: it inserts an APPROVED row with a Python uuid4 (no MAX(ID) race between two people saving at once), plus the evidence IDs, policy IDs, model, hashes and timestamp. It then saves the Snowflake QUERY_ID (cursor.sfqid) as extra proof.
• Fail: it writes an APPROVE_DENIED row naming the real viewer, e.g. JSMITH (claimed BOSS), then raises PermissionError.

• clean_markdown() strips every <…> tag before display. The only HTML on the page is static CSS and badge shells, and badge labels pass through the stripper too. This stops XSS (script injection into a web page).
• build_safe_export() writes the findings, evidence IDs, policy IDs and both hashes as Markdown, with no SQL.
• AI and search failures are logged by error type only, because the full error text could echo prompt data.