AI command engine system and execution method
By parsing natural language commands and verifying permissions through an AI command engine system, and combining RBAC and Outbox+CDC mechanisms, the problems of user operation complexity and insufficient auditing in existing technologies are solved, achieving highly secure and auditable automated command execution.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- BEIJING JIEGAO SOFTWARE CO LTD
- Filing Date
- 2026-06-04
- Publication Date
- 2026-07-21
AI Technical Summary
Existing systems rely on manual configuration and complex API calls for automation, making them difficult for ordinary users to operate and lacking system-level access control and auditing mechanisms with natural language interfaces.
It provides an AI command engine system, including a semantic parsing layer, an authorization verification layer, a command generation module, an execution engine, an audit logging layer, and a command and dialogue storage layer. It supports natural language instruction parsing, authorization verification, command execution, audit logging, and playback/rollback functions. It adopts a multi-layer RBAC mechanism and an Outbox+CDC link to ensure data consistency.
It enables traceable execution of natural language commands, supports playback and rollback operations, and features high security, scalability, and auditability. It is suitable for multi-tenant AI automation control platforms and cloud-based intelligent operation and maintenance systems.
Smart Images
Figure CN122431758A_ABST
Abstract
Description
Technical Field
[0001] This application belongs to the technical fields of artificial intelligence, human-computer interaction and enterprise automation management systems, and specifically relates to an AI command engine system and execution method. Background Technology
[0002] Existing system automation typically relies on manual configuration, scripting languages, or complex API calls, making it difficult for ordinary users to operate directly. With the development of Large Language Models (LLMs), natural language interfaces have become possible, but they lack system-level access control, transaction consistency, and auditing mechanisms. Therefore, there is an urgent need for a command engine that can understand natural language instructions and possess enterprise-level security and auditing capabilities. Summary of the Invention
[0003] To address the aforementioned problems, this application provides an AI command engine system, the system comprising: The semantic parsing layer is used to parse the natural language instructions input by the user into structured command objects, which include intent identifiers, execution parameters, and target operation types. The permission verification layer is used to receive structured command objects and verify the user's execution permissions and legitimacy based on RBAC and tenant isolation policies. The command generation module is used to generate dry running command cards based on the validated structured command objects, which are then triggered for execution upon user confirmation. The execution engine is used to route commands based on the command card and call the REST interface to execute commands; The audit logging layer is used to write the execution process and results into the audit link and deliver them to the message bus; The command and dialogue storage layer is used to save command context and execution results, and supports playback and rollback functions through the audit link.
[0004] Optionally, the permission verification layer adopts a multi-layer RBAC mechanism based on tenants and roles, and prioritizes the processing of denial rules.
[0005] Optionally, the dry run command card includes the target operation type, execution parameters, and expected impact on system resources.
[0006] Optionally, the execution engine routes and calls one or more representation state transmission interfaces based on the target operation type according to the dry running command card to execute commands, and collects the response data returned by each interface as the execution result.
[0007] Optionally, the audit log layer includes: The outgoing mail table is used to generate audit events for the execution process and results and write them into the audit chain. Modify the data capture component to capture audit events from the outbox table; A message queue is used to transmit audit events from the change data capture component; An audit database is used to store the audit events.
[0008] Optionally, the command and dialogue storage layer includes: The command logging and playback module provides functions for querying historical commands, comparing differences, playing back, and rolling back. The audit event association module is used to establish a traceable relationship between commands and audit events through audit event identifiers; The permission difference analysis module is used to compare the permissions required by historical commands with the permissions of the current user to determine whether the current user has the execution permission. The replay execution module is used to re-execute commands with the original parameters and update the audit link when the current user has execution permissions. The rollback execution module is used to automatically generate a reverse operation based on the target operation type and execute an undo action when the current user does not have execution permissions.
[0009] Optionally, the command and dialogue storage layer is used to track and identify associated commands, execution results, and audit events.
[0010] Based on the same inventive concept, this application also provides an AI command engine execution method, including: Receive natural language commands input by the user and parse them into structured command objects; The permission verification layer verifies the user's execution permissions and legitimacy based on RBAC and tenant isolation policies; The command generation module generates a dry running command card based on the validated structured command object, which is then executed after user confirmation. The engine executes commands by routing them based on the command cards and calling REST interfaces. The execution process and results of the execution request are written into the audit link through the audit recording layer and delivered to the message bus; The command context and execution results are saved through a command and dialogue storage layer, and playback and rollback functions are supported through an audit link.
[0011] Optionally, the permission verification layer adopts a multi-layer RBAC mechanism based on tenants and roles, and prioritizes the processing of denial rules.
[0012] Optionally, the dry run command card includes the target operation type, execution parameters, and expected impact on system resources.
[0013] Optionally, the execution engine routes and calls one or more representation state transmission interfaces based on the target operation type according to the dry running command card to execute commands, and collects the response data returned by each interface as the execution result.
[0014] Optionally, the step of writing the execution process and result of the execution request into the audit link through the audit record layer and delivering it to the message bus includes: The execution process and results will be generated into audit events and written into the audit chain. The audit events of the outbox table are captured by the change data capture component, sent to the message queue, and stored in the audit database.
[0015] Optionally, the step of saving the command context and its execution results through the command and dialogue storage layer, and supporting playback and rollback functions through the audit link, includes: Establish a traceable relationship between commands and audit events by identifying audit event identifiers; Compare the permissions required by historical commands with the current user's permissions to determine if the current user has execute permissions; If the current user has execution permission, the command will be re-executed with the original parameters and the audit link will be updated; otherwise, a reverse operation will be automatically generated based on the target operation type and an undo action will be performed.
[0016] Optionally, the command and dialogue storage layer is used to track and identify associated commands, execution results, and audit events.
[0017] Furthermore, this application also provides a computing device, comprising: at least one processor and a memory; The memory is used to store one or more programs; When the one or more programs are executed by the one or more processors, an AI command engine execution method as described above is implemented.
[0018] In another aspect, this application also provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed, it implements an AI command engine execution method as described above.
[0019] Compared with the prior art, this application has the following advantages: This application provides an AI command engine system and execution method, comprising: a semantic parsing layer for parsing user-input natural language commands into structured command objects, wherein the structured command objects include intent identifiers, execution parameters, and target operation types; an authorization verification layer for receiving the structured command objects and verifying the user's execution permissions and legality based on RBAC and tenant isolation policies; a command generation module for generating a command card based on the verified structured command objects, which triggers execution upon user confirmation; an execution engine for routing and calling REST interfaces to execute commands based on the command cards; an audit logging layer for writing the execution process and results into the audit link and delivering them to the message bus; and a command and dialogue storage layer for saving command context and execution results, and supporting playback and rollback functions through the audit link.
[0020] This application implements a traceable natural language command execution mechanism, supports playback and rollback operations, and ensures data consistency through the Outbox and CDC links. The solution features high security, scalability, and auditability, and is suitable for multi-tenant AI automation control platforms and cloud-based intelligent operation and maintenance systems.
[0021] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures pointed out in the description, claims and drawings. Attached Figure Description
[0022] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0023] Figure 1 A schematic diagram of the AI command engine system provided in this application is shown; Figure 2 This application provides a flowchart for command playback and audit traceability. Figure 3 This application provides a schematic diagram of the AI command engine execution method flow. Detailed Implementation To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0024] Example 1 This application provides an AI command engine system, such as Figure 1 ,include: The semantic parsing layer is used to parse the natural language instructions input by the user into structured command objects, which include intent identifiers, execution parameters, and target operation types. The permission verification layer is used to receive structured command objects and verify the user's execution permissions and legitimacy based on RBAC and tenant isolation policies. The command generation module is used to generate dry running command cards based on the validated structured command objects, which are then triggered for execution upon user confirmation. The execution engine is used to route commands based on the command card and call the REST interface to execute commands; The audit logging layer is used to write the execution process and results into the audit link and deliver them to the message bus; The command and dialogue storage layer is used to save command context and execution results, and supports playback and rollback functions.
[0025] REST (Representational State Transfer) is a common API architecture style, which means that the execution engine calls backend services through the REST API.
[0026] API (Application Programming Interface) is the interface through which systems call functions.
[0027] Optionally, the semantic parsing layer uses a large language model (LLM) to support cross-language intent recognition and parameter extraction (NLP).
[0028] NLP (Natural Language Processing) includes language detection, intent recognition, and parameter extraction. Optionally, the permission verification layer adopts a multi-layer RBAC (Role-Based Access Control) mechanism based on tenants and roles, and prioritizes processing denial rules.
[0029] Here, deny means deny permission. Deny priority means that as long as the deny rule is hit, execution is not allowed even if there are other allow rules.
[0030] RBAC, or Role-Based Access Control, determines whether a user has permission to execute a command based on their role. When a user issues an AI command, the system doesn't execute it directly; instead, it first determines whether execution is allowed based on information such as the user's role, tenant, and organization. For example, a command like "assign an administrator role to a member" requires checking whether the current user has the corresponding tenant, organization, and role management permissions.
[0031] Optionally, the Dry Run command card includes the target operation type, execution parameters, and expected impact on system resources.
[0032] Dry Run is a pre-execution / dry run that does not actually modify the data, but only verifies parameters, permissions, and scope of impact, and displays a command card for user confirmation.
[0033] Optionally, the execution engine routes and calls one or more representation state transmission interfaces based on the target operation type according to the dry running command card to execute commands, and collects the response data returned by each interface as the execution result.
[0034] Optionally, the audit log layer includes: The Outbox (Transactional Outbox Pattern) table is used to generate audit events for the execution process and results and write them into the audit chain. The Change Data Capture (CDC) component is used to capture audit events in the Outbox table; A message queue (Kafka, Apache Kafka) is used to deliver audit events from the change data capture component; An audit database is used to store the audit events.
[0035] Optionally, the command and dialogue storage layer, such as Figure 2 ,include: The command logging and playback module provides functions for querying historical commands, comparing differences, replaying, and rolling back. The audit event association module is used to establish a traceable relationship between commands and audit events through audit event identifiers; The permission difference analysis module is used to compare the permissions required by historical commands with the permissions of the current user to determine whether the current user has the execution permission. The replay execution module is used to re-execute commands with the original parameters when the current user has execution permissions, generate new audit records, and update the audit chain. The rollback execution module is used to automatically generate a reverse operation based on the target operation type when the current user does not have execution permissions, execute the undo action, and generate an audit event.
[0036] Among them, replay involves re-executing a certain type of command based on historical command parameters and generating new audit records; Rollback involves generating a reverse operation to undo or compensate for the previous command results.
[0037] Optionally, the command and dialogue storage layer is used to track and identify associated commands, execution results, and audit events.
[0038] The storage of Commands includes: command parameters, result pointer, status, and trace_id; Audit events audit.events(Database): The main collection of events, containing indexes for tenant_id, category, action, and occurred_at. By command_id (command ID) audit_event_id (audit event ID) establishes a traceable link for playback / rollback.
[0039] This application achieves: an automated closed loop of "natural language → structured instructions → auditable traceable execution"; DryRun confirmation and RBAC permission protection mechanism; transaction consistency of Outbox + CDC; and a traceable execution framework of Replay / Rollback.
[0040] Compared with traditional automation solutions, this system has the following advantages: (1) Supports DryRun and human confirmation mechanisms; (2) Integrate RBAC security strategy; (3) Supports audit event CDC (Change Data Capture, used to monitor changes in database tables and synchronize new and modified events) links; (4) Replayable and rollback; (5) Multimodal input (voice / text); (6) Possesses LLM semantic adaptation capabilities.
[0041] Example 2 Based on the same inventive concept, this application also provides an AI command engine execution method, such as... Figure 3 ,include: The system receives natural language instructions input by the user and parses them into a structured command object, which includes an intent identifier, execution parameters, and target operation type. The permission verification layer verifies the user's execution permissions and legitimacy based on RBAC and tenant isolation policies; The command generation module generates a dry running command card based on the validated structured command object, which is then executed after user confirmation. The engine executes commands by routing them based on the command cards and calling REST interfaces. The execution process and results of the execution request are written into the audit link through the audit recording layer and delivered to the message bus; The command context and execution results are saved through a command and dialogue storage layer, and playback and rollback functions are supported through an audit link.
[0042] Optionally, the permission verification layer adopts a multi-layer RBAC mechanism based on tenants and roles, and prioritizes the processing of denial rules.
[0043] Optionally, the dry run command card includes the target operation type, execution parameters, and expected impact on system resources.
[0044] Optionally, the execution engine routes and calls one or more representation state transmission interfaces based on the target operation type according to the dry running command card to execute commands, and collects the response data returned by each interface as the execution result.
[0045] Optionally, the step of writing the execution process and result of the execution request into the audit link through the audit record layer and delivering it to the message bus includes: The execution process and results will be generated into audit events and written into the audit chain. The audit events of the outbox table are captured by the change data capture component, sent to the message queue, and stored in the audit database.
[0046] Optionally, the step of saving the command context and its execution results through the command and dialogue storage layer, and supporting playback and rollback functions through the audit link, includes: Establish a traceable relationship between commands and audit events by identifying audit event identifiers; Compare the permissions required by historical commands with the current user's permissions to determine if the current user has execute permissions; If the current user has execution permission, the command will be re-executed with the original parameters and the audit link will be updated; otherwise, a reverse operation will be automatically generated based on the target operation type and an undo action will be performed.
[0047] Optionally, the command and dialogue storage layer is used to track and identify associated commands, execution results, and audit events.
[0048] Example 3 Based on the same inventive concept, this application also provides an electronic device. The electronic device of this application includes at least one processor and at least one storage medium electrically connected to the processor. The storage medium is electrically connected to the processor, wherein the storage medium stores instructions executable by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the method described above.
[0049] Example 4 Based on the same inventive concept, this application also provides a storage medium storing instructions executable by at least one processor, the instructions being executed by at least one processor to enable at least one processor to perform the method described above.
[0050] Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.
Claims
1. An AI command engine system, characterized in that, The system includes: The semantic parsing layer is used to parse the natural language instructions input by the user into structured command objects, which include intent identifiers, execution parameters, and target operation types. The permission verification layer is used to receive structured command objects and verify the user's execution permissions and legitimacy based on RBAC and tenant isolation policies. The command generation module is used to generate dry running command cards based on the validated structured command objects, which are then triggered for execution upon user confirmation. The execution engine is used to route commands based on the command card and call the REST interface to execute commands; The audit logging layer is used to write the execution process and results into the audit link and deliver them to the message bus; The command and dialogue storage layer is used to save command context and execution results, and supports playback and rollback functions through the audit link.
2. The system according to claim 1, characterized in that, The permission verification layer adopts a multi-layer RBAC mechanism based on tenants and roles, and prioritizes processing denial rules.
3. The system according to claim 1, characterized in that, The dry run command card includes the target operation type, execution parameters, and expected impact on system resources.
4. The system according to claim 1, characterized in that, The execution engine routes and calls one or more representation state transmission interfaces based on the target operation type according to the dry running command card, executes commands, and collects the response data returned by each interface as the execution result.
5. The system according to claim 1, characterized in that, The audit log layer includes: The outgoing mail table is used to generate audit events for the execution process and results and write them into the audit chain. Modify the data capture component to capture audit events from the outbox table; A message queue is used to transmit audit events from the change data capture component; An audit database is used to store the audit events.
6. The system according to claim 5, characterized in that, The command and dialogue storage layer includes: The command logging and playback module provides functions for querying historical commands, comparing differences, playing back, and rolling back. The audit event association module is used to establish a traceable relationship between commands and audit events through audit event identifiers; The permission difference analysis module is used to compare the permissions required by historical commands with the permissions of the current user to determine whether the current user has the execution permission. The replay execution module is used to re-execute commands with the original parameters and update the audit link when the current user has execution permissions. The rollback execution module is used to automatically generate a reverse operation based on the target operation type and execute an undo action when the current user does not have execution permissions.
7. The system according to claim 6, characterized in that, The command and dialogue storage layer is used to track and identify associated commands, execution results, and audit events.
8. A method for executing an AI command engine, characterized in that, include: Receive natural language commands input by the user and parse them into structured command objects; The permission verification layer verifies the user's execution permissions and legitimacy based on RBAC and tenant isolation policies; The command generation module generates a dry running command card based on the validated structured command object, which is then executed after user confirmation. The engine executes commands by routing them based on the command cards and calling REST interfaces. The execution process and results of the execution request are written into the audit link through the audit recording layer and delivered to the message bus; The command context and execution results are saved through a command and dialogue storage layer, and playback and rollback functions are supported through an audit link.
9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the AI command engine method of claim 8.
10. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; When a processor executes a program stored in memory, it implements the steps of the AI command engine method of claim 8.