nbauthorize-2-stage-decisions

What problem does it solve?

It prevents unsafe or non-compliant extraction by enforcing NBAccess authorization both before sending sensitive content to an LLM and before persisting extracted claims, while minimizing extra authorization cost.

Core Features & Use Cases

• Two-phase authorization for extraction: Performs a send-stage decision and a persist-stage decision using SourceVaultExtract so that content is authorized for LLM transmission and for claim storage.
• Extended decision handling: Supports four decision outcomes—Permit, Screen, RequireApproval, and Deny—with fail-safe behavior that treats unknown decisions as denied.
• Fail-safe response shaping: Returns Status values like DeniedByNBAccess and RequiresApproval, and includes AccessDecisions as <|"Send" -> _, "Persist" -> _|> (or an empty association when explicitly opted out).
• Correct claim spec construction from source metadata: Builds NBClaimSpec via iSpecFromClaim, deriving AccessLabel from snapshot/source meta so NBAccess can apply consistent labeling rules.

Quick Start

Request the system to run SourceVaultExtract with the default authorization enabled for sensitive sources so it returns extracted claims only when both send and persist NBAccess checks succeed, otherwise returning DeniedByNBAccess or RequiresApproval with AccessDecisions details.