九屏看完私有化 AI 治理与取证平台Nine screens through an on-prem AI governance & forensics platform

态势主页是「一份记录,两个读者」的门面:同一份不出域的取证台账,左供财务读成本与 ROI(永远 LIVE),右供合规读证据与留痕。合规列默认关闭——内容审计与 DLP 受合规双钥保护,启用前只显示全量防篡改链深。底部路线图轨上的能力均诚实标注尚未交付。The front door for "one record, two readers": one in-domain forensic ledger — finance reads cost & ROI on the left (always LIVE), compliance reads evidence & trail on the right. The compliance column is off by default — content audit & DLP sit behind a two-key seal. The roadmap track at the bottom honestly marks what isn't shipped yet.

发现员工在用哪些外部 AI。旁路传感器只观测元数据(host、计数、字节、首末见),物理上不含任何 prompt / 响应明文。风险评分由服务端单一源计算(数据敏感度 + 国别出境 + 用户数 + 流量),前端只展示、不重算。「建议阻断」仅为顾问信号——本面只发现与取证,不执行拦截。See which external AIs staff actually use. The out-of-band sensor reads metadata only (host, counts, bytes, first/last seen) and by construction carries no prompt or response text. Risk is scored server-side (data sensitivity + cross-border + users + volume); the UI displays, never recomputes. "Block recommended" is advisory only.

把已封进防篡改审计链的聚合元数据展开为两个视角:按应用(检测 client:app 与运营声明 agent_label 双列不合并,带调用、用户、护栏命中、跨境与入库美元成本)与按意图(闭集分类分布)。全程只消费聚合计数与闭集标签,绝无内容明文 / PII / key。默认关闭:客户端应用标注与意图标注;意图当前为关键词档,ML 模型在建。Unfolds tamper-evident chain metadata along two axes: by application (detected client:app and operator-declared agent_label kept as two un-merged columns, with calls, users, guardrail hits, cross-border and stored USD cost) and by intent (a closed-set distribution). Off by default: client-app and intent labeling; intent today is keyword-based, with the ML model still in progress.

每一次模型调用都留下不可抵赖的元数据,逐条可查、按部门租户隔离。点开任意一条,即时盖上「窗口化链验真」钢印——密码学证明本条留痕未被篡改。原文默认封存:查看需独立的 content-read 令牌 + 必填用途,且查看动作本身逐行写回审计链;明文只活在抽屉内存,关闭即销毁,绝不出域、绝无复制。内容采集默认关闭(强认证 step-up 在建)。Every model call leaves non-repudiable metadata, queryable record-by-record and tenant-isolated by department. Open any row and a windowed chain-verification seal is stamped on the spot. Plaintext stays sealed by default: viewing needs a separate content-read token + a required purpose, and the act of viewing is itself written back to the chain; cleartext lives only in the drawer's memory and is destroyed on close. Content capture is OFF by default (step-up auth in progress).

这是头号护城河:一键全链重放对整条审计链做哈希验真——自创世条目起逐条比对前向哈希链接与内容哈希。通过则盖下「封」字钢印并出具可打印的《链验真报告》法律证物;任一处被篡改则盖「断」破章并精确定位断点 seq / 类型。结论只含位置与哈希断点,绝不含任何 prompt / 响应明文。WitnessAI 等云端 SaaS 形态结构上做不到这一层。The number-one moat: one click replays the entire chain and hash-verifies it end to end from the genesis record. A pass stamps the "Sealed" chop and issues a printable, court-grade Verification Report; any tamper stamps the "Broken" chop and pinpoints the break by seq/kind. The verdict carries only positions and hash breaks — never any plaintext. Cloud SaaS tools like WitnessAI structurally can't offer this layer.

数据出境的System-of-Record:每一条经受控通道转发到境外 / 境内 provider 的请求,都按部门、员工、Provider 折叠成可查证的聚合,再落到逐请求的取证清单。境内 / 境外判定单一源在服务端,前端只展示、绝不重算;全程只读审计链元数据,不含内容明文。这是个保法 / 数据出境合规的可证据化台账——云端 SaaS 结构上难以提供对应能力。The system-of-record for cross-border egress: every request forwarded through a controlled channel to a domestic or overseas provider is rolled up by department, employee and provider into verifiable aggregates, then grounded in a per-request forensic ledger. The domestic-vs-overseas verdict is server-side; the front end never re-derives it. An evidentiary ledger for PIPL / data-export compliance that cloud SaaS tools structurally struggle to provide.

护栏与输出侧拦截:DLP 与外发内容在出域前按策略集逐条裁决,「首次命中」生效、全不命中落默认动作。出厂默认全部停用(record-not-enforce),启用执行需合规授权;裁决计数在启用前恒为 0,所有动作经防篡改取证留痕。「改道」为保留态、本期不执行(导览不展示提示词重路由)。Guardrails & output-side interception: outbound content is adjudicated rule by rule against a ruleset before leaving the domain — first match wins, default action backstops the rest. Shipped disabled by default (record-not-enforce); verdict counts stay zero until enabled, and every action is written to tamper-evident record. "Reroute" is reserved and not executed this cycle.

把网关唯一持有的计量台账,按部门归因成「谁花了多少」。所有成本都是入库时的字节精确快照——绝不重算价;未命中价目的请求诚实剔除、单列「未计价」。「按人头 license 对比」的席位单价是可配置假设值,明确标注非真实采购报价。全程部门级粒度,不点名到人。云端方案不做计费——这是我们的差异化。The metering ledger only a real gateway holds, attributed by department into who spent what. Every cost is the byte-exact ingest-time snapshot — never re-priced; unpriced calls are honestly excluded and surfaced separately. The per-head license comparison uses a configurable assumed seat price, clearly flagged as not a real quote. Department-level throughout, never named to an individual. Cloud tools don't do billing — this is our differentiation.

全量内容审计默认关闭——由服务端双钥(env 开关 + 法律确认句柄)守护,控制台无权翻动。默认态我们呈现的不是空表,而是「双钥合规启用 · 治理就绪指引」:审批人、法律依据、员工告知、留存期四步封缄核对,合规前置后方可由运维在服务端启用。即便采集关闭,防篡改链仍可重放验真——这是不出域、防篡改的取证职责。Full content audit is off by default, gated by a server-side two-key control (env switch + legal-ack handle) that the console itself cannot flip. The default state shows not an empty log but a two-key enablement readiness checklist: approver, legal basis, employee notice, retention — all sealed before operations turns it on. Even with capture off, the tamper-evident chain stays replayable.