Large model controlled calling and auditing method, system, electronic device and storage medium

Abstract

The application discloses a kind of big model controlled call and auditing method, system, electronic equipment and storage medium, it is related to artificial intelligence and industrial data governance technical field.The method includes: receiving request end processing request and carrying out task disintegration;According to tool hierarchical registration mechanism, obtain tool definition, and the system can be divided into only read data tool, analysis generation tool and controlled strategy request tool;Before tool call, multi-dimensional permission check and parameter specification check are executed in turn;After check, call via tool execution gateway proxy, and generate evidence chain data containing object reference, time range and data source;Finally, constrain big language model and force reference the evidence chain to generate response, and limit controlled strategy request tool can only create strategy draft and cannot directly call industrial equipment.The application isolates big model and underlying control interface, so that AI output has traceable evidence chain, and reduces data overreach and illusion creation risk.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence and industrial data governance technology, and more specifically, to a method, system, electronic device, and storage medium for controlled access and auditing of large models. Background Technology

[0002] With the evolution of deep learning and neural network technologies, large language models have demonstrated capabilities in natural language understanding, complex task decomposition, and comprehensive logical reasoning. However, in scenarios such as industrial energy and carbon management, where security and determinism are extremely critical, directly introducing large language models into production networks carries significant technical risks.

[0003] Existing enterprise-level large-scale model systems typically focus on optimizing the interactive experience or question-and-answer retrieval based on static knowledge bases, lacking tool tiering, secure invocation, and evidence chain management mechanisms for industrial energy and carbon businesses. In real-world industrial environments, when requesting clients input requests such as "Why did energy consumption increase last night?", "Are energy storage revenues abnormal?", or "Can an air compressor scheduling strategy be issued?", computer systems usually need to call multiple underlying tools and interfaces across network domains, including real-time databases, historical time-series databases, asset ledgers, alarm centers, carbon factor libraries, expert models, and strategy centers.

[0004] If computer systems allow large models to directly access the aforementioned databases, execute scripts, or generate and issue device control commands, it will introduce a series of underlying computer and network security risks, including unauthorized data access, incorrect parameter passing, probability-based illusion fabrication, control overreach, and missing audit logs. Specifically, if the results of tool calls cannot be audited at the system level, or if the model-generated response information is not bound to the data's time range, object identifier, tool call records, and model execution records at the data structure level, the system will be unable to determine the sufficiency of the model's output in subsequent processing. This technical deficiency prevents machine logic from verifying AI conclusions in policy execution, compliance auditing, carbon report generation, or incident tracing, significantly limiting the usability and security of large models in industrial control systems. Summary of the Invention

[0005] The purpose of this invention is to provide a controlled calling and auditing method and system for large models, aiming to solve the problems of data overreach, control overreach, and output illusion caused by large language models directly calling industrial underlying data and control interfaces in the prior art.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: A controlled invocation and auditing method for large models includes: Receive the natural language processing request sent by the requesting end, generate a unique tracking identifier associated with the processing request, and obtain the corresponding context data; The intelligent agent orchestration module decomposes the processing request into tasks to determine the target tool to be invoked and its invocation parameters, wherein the invocation parameters include at least the target object and the time range. Based on the tool name of the target tool, the tool definition information of the target tool is obtained from a preset tool registry. The callable tools in the tool registry are pre-classified into read-only data tools, analysis and generation tools, and controlled policy request tools. Based on the context data and the tool definition information, the processing request is sequentially subjected to permission control verification and parameter specification verification. When both the permission control verification and the parameter specification verification pass, the tool executes a gateway proxy call to the backend service node corresponding to the target tool, obtains the original execution result, and converts it into standard tool output data. The evidence chain generation module generates evidence chain data containing the unique tracking identifier for the standard tool output data. The target response information is generated based on the large language model, the standard tool output data, and the evidence chain data. The target response information is then verified through a preset response constraint mechanism to block response outputs that contain direct control instructions for the underlying physical devices.

[0007] Preferably, the step of performing permission control verification and parameter specification verification on the processing request sequentially based on the context data and the tool definition information includes: Verify the identity, role permissions, site scope, data scope, and tool-level permissions corresponding to the requesting client; Verify the input fields, data types, time ranges, object identifiers, and parameter boundaries of the called parameters; When a large-scale data query request without a time range, an unregistered parameter, or an out-of-bounds parameter is detected, the call parameters are intercepted, and a structured exception identifier indicating a failure to perform specification verification is returned to the requesting end.

[0008] Preferably, the step of executing a gateway proxy call through a tool to the backend service node corresponding to the target tool includes: Based on the tool, the gateway performs unified proxy data query, model analysis, and controlled policy requests, blocking the direct communication connection between the large language model and the underlying database or physical device control interface.

[0009] Preferably, when the type of the target tool is the controlled policy request tool, the method further includes: The execution permissions of the controlled policy request tool are limited to creating policy request drafts or revoking policy requests; Output draft data containing policy identifier, status, required confirmation level and blocking reason to the associated policy center node, and prohibit the direct issuance of device control commands through the edge controller interface.

[0010] Preferably, the step of generating evidence chain data containing the unique tracking identifier for the standard tool output data through the evidence chain generation module includes: A unique tool invocation identifier is assigned to each target tool invocation, and an input digest and an output digest are extracted based on the invocation parameters and the standard tool output data; The unique tracking identifier, the tool call identifier, the object reference information, the time range, the data source information, the data quality status, and the limitation description are concatenated into the structured evidence chain data.

[0011] Preferably, the verification of the target response information through a preset response constraint mechanism includes: Verify whether the target response information references the data time range, object identifier, tool call result, and data source in the evidence chain data; When the original execution result indicates insufficient data, tool failure, or insufficient permissions, the large language model is constrained to output a structured failure description containing the corresponding reason, and the large language model is prohibited from generating fabricated real-time data, device status, or policy benefits in the target response information.

[0012] Preferably, the method further includes auditing and anomaly handling steps: The system records audit logs containing the processing requests, tool call events, model execution records, policy request drafts, structured error information, and target response information, and binds and stores the audit logs with the unique tracking identifier. When a controlled policy request is identified to involve an unauthorized asset, an abnormal status flag indicating control block or unauthorized asset is returned, and the target response information is restricted to generating only a manual confirmation suggestion.

[0013] A second aspect of the present invention also discloses a large-scale model controlled invocation and auditing system, comprising: The Agent orchestration module is used to receive natural language processing requests sent by the requesting end, generate a unique tracking identifier, and decompose the processing request into tasks to determine the target tool to be invoked and its invocation parameters. The tool registry is used to store tool definition information and classify registered callable tools into read-only data tools, analysis and generation tools, and controlled policy request tools. The multi-dimensional security and specification verification module is used to perform permission control verification, including identity and data range, and parameter specification verification, including time range and parameter boundaries, on the processing request based on context data and the tool definition information. The tool execution gateway is used to uniformly proxy the call to the corresponding backend service node after the verification is passed, obtain the original execution result and convert it into standard tool output data, so as to physically isolate the large language model from the database or device interface; The evidence chain generation module is used to generate evidence chain data containing tool call identifier, object reference and data source for the standard tool output data; The AI ​​response constraint module is used to generate target response information based on the large language model, verify the reference relationship between the target response information and the evidence chain data, and block the output of direct control commands to the underlying physical devices.

[0014] A third aspect of the present invention also discloses an electronic device, comprising: At least one processor; And, a memory communicatively connected to the at least one processor; The memory stores computer program instructions that can be executed by the at least one processor, which are executed by the at least one processor to enable the at least one processor to execute the large model controlled invocation and auditing method described above.

[0015] The fourth aspect of the present invention also discloses a computer-readable storage medium storing computer program instructions, which, when executed by a computer, can implement the large model controlled invocation and auditing method described in any of the preceding claims.

[0016] Beneficial effects: This invention enhances the boundary isolation security of industrial control networks by introducing a hierarchical tool registration mechanism and a tool execution gateway at the computer network architecture level. This physically or logically isolates the callable capabilities of the large language model into read-only data tools, analysis and generation tools, and controlled policy request tools. Through this hardware-software decoupling design, the large language model can only issue standardized intent requests through controlled API interfaces, and cannot directly initiate SQL / NoSQL queries to industrial databases or directly execute executable scripts. In particular, strict boundaries are set for the controlled policy request tools; the large model can only create "policy requests" (similar to draft database records) in the policy center database, and cannot directly address or invoke physical devices and edge controllers. This mechanism cuts off illegal command issuance channels at the underlying network topology, reducing data security and control security risks.

[0017] This invention improves the traceability and auditability of the data processing chain by proposing an evidence chain generation mechanism based on unique tracking identifiers and tool call identifiers. During runtime, the computer system structurally binds each natural language request, each cross-service RPC call, object reference, time range, data source, and model runtime identifier, and persistently stores this data in the audit log module. This enables abstract AI responses and reports to possess pointer associations and traceable evidence chains at the data structure level, facilitating automated comparison, customer auditing, problem review, and compliance checks by the computer system.

[0018] This invention reduces probabilistic deviations in system output states by employing a pre-emptive multi-dimensional security check (covering user identity, role, site scope, parameter schema, and time range) and a post-emptive AI response constraint module to construct a closed-loop verification logic. When the underlying system detects tool call failures, insufficient data query scope, or insufficient permissions, the system gateway directly throws a structured error. Upon receiving such error codes, the AI ​​response constraint module forcibly intervenes in the language model's generation probability distribution, requiring the model to output structured failure explanations based on these error codes and prohibiting it from using probabilistic interpolation to fabricate real-time data, device status, or policy benefits. This mechanism, which forcibly constrains upper-layer text generation based on underlying status codes, objectively narrows the model's output boundaries. Attached Figure Description

[0019] Figure 1 A flowchart illustrating a controlled invocation and auditing method for a large model provided in an embodiment of the present invention; Figure 2 A memory mapping diagram of a tool registry center data structure provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the module architecture of a large-model controlled invocation and auditing system provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0021] In the description of this invention, unless otherwise stated, "a plurality of" means two or more; the terms "center," "longitudinal," "lateral," "upper," "lower," "left," "right," "inner," "outer," "front end," "rear end," "head," "tail," "vertical," "horizontal," "top," "bottom," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, and are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, the terms "first," "second," "third," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0022] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art will understand the specific meaning of the above terms in this utility model based on the specific circumstances.

[0023] To make the objectives, technical solutions, and advantages of the present invention clearer, the technical solutions of the present invention will be described in detail and objectively below in conjunction with the embodiments of the present invention and related data structures and pseudocode.

[0024] 5.1 In-depth analysis of method implementation examples: See Figure 1 This embodiment provides a method for controlled invocation and auditing of large models. The main body of this method is a backend data processing service cluster deployed on a cloud server or local computing node. The method specifically includes the following steps: S101, Request Access and Context Environment Initialization: Receive processing requests sent by requesting clients (such as human-machine collaborative workbench clients, web browsers, and industrial mobile terminals) through network interfaces (such as HTTP / HTTPS, WebSocket protocols). These processing requests typically manifest as data packets carrying natural language text sequences or trigger signals targeting specific industrial objectives. At the network access layer, the API gateway intercepts the request and dynamically allocates and generates a globally unique trace identifier (trace_id) in memory using a globally unique identifier generation algorithm (such as the Snowflake algorithm or UUID v4). Subsequently, the context resolution service parses the requesting client's identity identifier (user_id), site context identifier (site_id), and session context identifier (session_id) from the request message's header or carried token, binds this information to the unique trace identifier in memory, and writes it to a high-speed cache database (such as Redis) for lifecycle management.

[0025] In step S102, based on task decomposition and parameter determination using a directed acyclic graph (DAG), the Agent orchestration module retrieves processing requests and context data from the cache. This module integrates a large language model inference engine and intent recognition algorithm. The Agent orchestration module performs lexical analysis, syntactic analysis, and semantic vector mapping on the input text sequence to understand the user's true question intent. Next, the Agent orchestration module performs task decomposition, transforming complex long-sequence intents into a DAG composed of multiple sub-task nodes and dependency edges. During this process, the system determines the target tool type, tool name, target object (e.g., asset code of a specific device), time range (e.g., start and end interval based on UNIX timestamps), and expected output structure format for each DAG node.

[0026] S103, Tool definition information retrieval and loading: For each tool name planned in the DAG, the system initiates a query request to the tool registry. The tool registry is a configuration library that persistently stores tool metadata. In this invention, in order to establish strict security boundaries, the tool registry divides the callable capabilities of the large model into three predefined enumeration types at the data level: (1) Read-only data tools: used to perform non-destructive data inspection, such as querying real-time measurement point status (query_realtime_points), extracting historical operating curves (query_historical_series), retrieving equipment ledgers (query_asset_registry), obtaining energy consumption statistics, alarm events, or carbon emission results, etc. The security boundary of this type of tool is limited to: only returning data fragments within the authorized range through the gateway, and the response body must carry evidence of data source and data quality status (such as bad point identifiers, interpolation identifiers). (2) Analysis and generation tools: These tools are used to perform high-performance algorithm model calculations, such as running energy consumption baseline analysis algorithms (run_baseline_analysis), performing energy storage charging and discharging optimization strategy calculations (run_storage_optimization), generating air compressor scheduling calculation matrices (run_air_compressor_dispatch), and generating carbon accounting and report drafts. The security boundary of these tools is limited to: only outputting the calculated analysis suggestions, benefit calculation values, and system risk assessment results to the requesting end, and prohibiting the underlying system from directly executing closed-loop control operations on the hardware based on these analysis results. (3) Controlled strategy request tools: These tools are used to bridge the request creation between analysis results and physical control devices, such as initiating control strategy requests (request_control_strategy) or canceling strategy requests (cancel_strategy_request). Such tools suffer the most stringent physical and logical isolation at their security boundaries: they are deprived of any permission to directly establish communication sockets with physical edge controllers, PLCs, or SCADA systems. Their operation instructions are converged at the underlying level into database INSERT / UPDATE transactions, and they can only create or revoke a policy request draft with a status of "pending verification" in the policy center database. Subsequent actual deployment actions are handed over and verified by independent policy center processes and the load asset control matrix system. The tool registry returns structured tool definition information (such as using JSON Schema, OpenAPI specifications, MCP tool descriptions, or other machine-readable data structure specifications) based on the input tool name. This information fully describes the input specifications (input parameter field requirements), output specifications, set risk levels, minimum privilege requirements to trigger the tool, constraints on returned data fields, and corresponding audit rules and policies.

[0027] S104, Multi-dimensional Security Sandbox and Parameter Specification Verification: Before distributing task nodes to the execution layer, the system must pass through two layers of security interception mechanisms: Layer 1: Tool Access Control Verification. The tool access control module is integrated with the enterprise identity and permission system (such as Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), project role matrix, etc.). This module extracts context data (user_id, site_id) and the permission requirements configured for the target tool from memory, and performs bitwise operations or access control tree traversal to verify whether the requesting end possesses: user identity legitimacy, corresponding role's operation permissions, the visible scope of the target site domain, the data range permission of the underlying data dictionary, and the call permission for the specific tool. If any of the above dimensions is determined to be False, the system immediately interrupts the execution graph stack and throws an interruption exception, returning a status code such as AUTH_FORBIDDEN (authentication prohibited) or DATA_SCOPE_DENIED (data range restricted) to memory. Layer 2: Parameter Specification Verification. After the permission verification passes, the parameter schema verification module performs deep parsing and regular expression matching on the input parameters to be pushed onto the call stack. This step includes: verifying the integrity of input fields, the matching degree of data types, whether enumerated values ​​are within the whitelist, and the legality of parameter boundaries. To address the vulnerabilities of industrial databases, this module has a built-in special disaster prevention rule base. Boundary anomaly blocking: Prohibit the system from receiving large-scale data query parameters with missing time ranges (to prevent slow queries from exhausting the database connection pool).

[0028] Injection attack blocking: Using abstract syntax tree analysis, it prevents any form of custom SQL concatenation and unauthorized execution requests by any local / remote scripts.

[0029] Out-of-bounds variable blocking: Prohibits the transmission of redundant parameters that are not registered in the schema, or out-of-bounds parameter values ​​that exceed the physical device's allowed range limit.

[0030] S105, Tool Execution Gateway Proxies and Data Formatting: After all the aforementioned security and specification checks have passed, the task vector will be allowed to pass through the tool execution gateway. The tool execution gateway acts as a firewall between the large model network domain and the industrial production network domain, responsible for uniformly proxying data queries, model analysis, report generation, and controlled policy request actions. The large language model node is configured to not resolve the connection string of the underlying database or the IP address of the physical device, and it does not expose the database communication port or device register communication interface to the large model. The gateway forwards standardized input parameters to the corresponding data service (such as time series library service), model service, report service, or policy service based on a proxy protocol (such as gRPC or RESTful). After obtaining the raw calculation results or datasets from the underlying layer, it uniformly formats and encapsulates them into standard tool output objects at the gateway layer. The data structure of the standard tool output object is strictly required to include at least the following root field nodes: execution status, business data body, error code, and evidence set. At the same time, the system forces all tool input data to include user_id, site_id, and trace_id to ensure the consistency of the request chain.

[0031] S106, Evidence Chain Block Generation and Solidification: To ensure the non-repudiation and auditability of each call, the evidence chain generation module is triggered to run simultaneously with the gateway receiving the output data. This module uses a hash algorithm to extract digests from the input and output messages of this tool call, generating a unique tool call identifier (tool_call_id) and constructing the evidence chain data block. The evidence set fields must contain high-dimensional tracing information, including at least: time_range: The data query coverage period accurate to the millisecond level; source: Data source identifier (e.g., from a time-series database node with a certain number or an expert model with a certain number); object_refs: A list of references to associated industrial asset objects (such as transformer ledger IDs). tool_call_id: The tool call identifier generated above; data_quality: Returns a quality status assessment value of the data (such as data integrity rate, whether there are null values ​​caused by sensor disconnection). Limitations: Prerequisites or confidence level descriptions for model or algorithm execution. The system can asynchronously write the generated chain of evidence data in an immutable form to persistent storage media, such as security audit tables in relational databases, centralized log systems (e.g., ELK architecture), object storage clusters, knowledge graph node attributes, or package and upload it to blockchain nodes as an immutable block log.

[0032] S107, Target Response Information Constraints and Illusion Prevention Processing: The large language model performs linguistic recombination and summarization on the data from the standard tool's output object. To prevent model divergence and resulting illusions, the system deploys an AI response constraint module and an anomaly handling module at the final output layer. The AI ​​response constraint module can be a rule validator embedded in the system's post-processing flow, a regularization processor, or a standalone multi-model reviewer (using a smaller local review model to perform secondary evaluation of the output text), or a system-level strong prompt word system. This module imposes strict matching constraints on the model's initial generated response: Citation Mandatory: The target response text must contain an explicit citation of the time range of the data, the object ID or name, the numerical value of the tool call result, and the source of the data; Deterministic constraints: For uncertain information that cannot be directly derived from the chain of evidence, the model is required to include an explanation of its uncertainty in the response; Control intent constraint: All output text related to control operations must be marked as "suggestion" or "policy draft" at the system level. It is prohibited to use "executed" or "control completed" status descriptions for policies that have not been executed in the response.

[0033] Anomaly Degradation Handling: When the anomaly handling module detects that a tool call failed, data was insufficient, or insufficient permissions were returned due to authentication issues in the previous process, the AI ​​response constraint module will intercept the free generation process of the large language model, force the return of a predefined structured error report to the requesting end, and clearly explain the reason to the requesting end. The Agent is required not to use interpolation to fabricate results, not to fabricate real-time data or device status, not to fabricate economic benefits after policy execution, not to forge authorization status, and not to directly output write operation control instructions of the underlying device registers to the requesting end in the reply.

[0034] 5.2 In-depth verification examples in industrial application scenarios: To further illustrate the specific execution process of the above abstract method and its objective technical effects, this embodiment lists four typical industrial application scenarios from different dimensions and provides specific data flow logic.

[0035] Scenario Example 1: In-depth cause-and-effect investigation of device-level power consumption anomalies: Business Scenario: An operator discovers an anomaly on the terminal interface and enters the question text "Why was energy consumption higher than usual last night?". Computer Processing Chain: The Agent orchestration module receives a request text containing the trace_id and identifies three feature entities—"last night," "energy consumption," and "higher than usual"—using a natural language model. The system then performs task decomposition to construct a Directed Acyclic Graph (DAG), which is further decomposed into four ordered subtasks: asset analysis, historical time-series curve query, baseline analysis, and equipment alarm query.

[0036] Based on the DAG sequence, the system gateway first calls the read-only data tool query_asset_registry to map the "area corresponding to yesterday's nighttime energy consumption" to a specific set of industrial asset object IDs.

[0037] Next, call the read-only data tool query_historical_series, passing in the object ID set and the time range (e.g., from 20:00 yesterday to 06:00 today).

[0038] The acquired time-series data array is input into the analysis and generation tool run_baseline_analysis for curve comparison and deviation rate calculation.

[0039] Synchronously call the read-only data tool query_alarm_events to retrieve whether any underlying alarms have been triggered within the object ID set during this period.

[0040] In this series of calls, the evidence chain generation module generates independent and related tool_call_ids for each of the four calls, extracts the hash digests of the inputs and outputs, and writes the object references and time ranges into the database for storage. In the evidence set returned by the time-series query tool, the data_quality field indicates that "data packets were lost between 02:00 and 02:15 at a certain secondary sensor measurement point."

[0041] When generating the final target answer, the large language model is verified by the AI ​​answer constraint module. The final response information is structured and assembled, precisely referencing: the specific time period of the abnormal fluctuation, the calculated deviation from the baseline ratio, the calculated additional power consumption, the converted cost impact, the associated specific device alarm records, and the inferred possible causes. Furthermore, a descriptive text generated based on data_quality is appended at the end: "There were missing data points at a certain measurement point, but based on core sensor data, this does not affect the main conclusion." This process fully verifies the effectiveness of the evidence chain and anti-hallucination mechanism.

[0042] Scenario Example 2: Controlled Deployment Mechanism of Energy Storage Strategies Based on Electricity Price Fluctuations Business Scenario: An automated trading terminal or operator inputs "Optimize energy storage revenue based on peak and off-peak periods tomorrow." Computer Processing Link: The Agent orchestration module extracts intent tags such as "tomorrow", "peak and valley", and "energy storage". It first calls multiple tool nodes to collect preliminary data: it calls query_storage_status to get the current battery health and remaining power; it calls query_tariff_cost to get the peak-valley-flat electricity price time-of-use table for tomorrow; and it calls query_historical_series to get the historical energy consumption trends that are needed for load forecasting.

[0043] Once the dataset is complete, the system invokes the analysis and generation tool `run_storage_optimization`. Based on the underlying linear programming solver or reinforcement learning algorithm, the optimization tool outputs a detailed charge / discharge power time schedule, remaining power safety boundaries, profit calculations based on the current model, and battery life reduction risk warnings.

[0044] The large language model presents the above optimization scheme to the user. If the user's requesting end sends a "confirmation of request execution" signal, according to the controlled boundary design of this invention, the Agent model no longer has the authority to call other devices, but can only call the uniquely authorized controlled strategy request tool request_control_strategy.

[0045] After execution, this tool only performs one INSERT operation in the strategy center's database, creating a single strategy request draft record and returning the strategy_id, draft status, and predefined required confirmation level (e.g., workshop supervisor level review and confirmation). It must not invoke the edge controller. Whether this plan is subsequently converted into a real electrical control signal is determined by the strategy center engine, load asset control matrix system, and the associated industrial edge controllers, all physically isolated from the main model, through a secondary verification based on the control matrix's safety interlocking logic. This scenario confirms the reliability of control boundary isolation.

[0046] Scenario Example 3: Unauthorized Access Prevention and Auditing Mechanism Based on Data Range Business Scenario: A user with a privilege level configured as a regular operator attempts to query: "Retrieve historical operating data of air compressor No. 3 in Plant B." Computer Processing Chain: The system generates a tracking identifier and allocates resources. Before the agent can invoke the tool to query data, the system redirects to the tool's access control module.

[0047] This module reads the user role tree and site data range configuration table from memory. After traversing and comparing, it finds that the data domain associated with this user ID only includes Plant A, and there is no data access range permission for the target site (Plant B).

[0048] The permissions module immediately triggered a blocking exception, throwing the error status code DATA_SCOPE_DENIED, and forcibly terminated the entire task execution chain.

[0049] The AI ​​response constraint module captured the error code, and the response information ultimately generated by the constraint agent clearly stated: "Insufficient permissions, access denied by the system, unable to display data of the target device on this site, and it is recommended to contact the system administrator to enable cross-regional authorization."

[0050] The audit log module is triggered, recording a high-security audit log entry containing the user ID, the ID of the target site attempted to access, the name of the tool that triggered the unauthorized access, the system's denial reason code, and the session's trace_id. This log entry is used for subsequent compliance investigations and violation tracing verification. This scenario demonstrates the system's technical effectiveness in combating unauthorized access.

[0051] Scenario Example 4: Preventing the Illusion of Control Caused by Model Self-Affirmation Business Scenario: To confirm the previous operation status, the operator asks the system, "Did you just reduce the air compressor pressure?" Computer Processing Link: The agent attempts to obtain the system status. If the system log or policy center database does not retrieve a status record indicating that the relevant policy has been "executed successfully" as reported by the physical execution layer, the agent will proceed.

[0052] Although the large language model itself has the illusion of giving a positive answer based on the coherence of the dialogue, it is subject to the hard rule of "prohibiting the use of unexecuted policies as executed" in the AI ​​answer constraint module, and the positive probability vector generated by the model is intercepted and penalized.

[0053] Ultimately, the Agent can only output a structured response through the preset template constraint logic: "No execution record of this instruction was found in the system." It can also help display the relevant policy draft content currently in the "pending confirmation" queue or provide adjustment suggestions. Furthermore, the use of misleading descriptors such as "executed" or "pressure reduction under control" is strictly prohibited in the entire response text.

[0054] 5.3 System and Device Examples: Based on the same inventive concept, this embodiment provides a large-scale model controlled invocation and auditing system, which is internally composed of distributed software components. See also Figure 3 The system includes: Agent Orchestration Module: As a translation layer between natural language and machine execution logic, it is used to understand the natural language question stream from the user, abstract the question sequence into task decomposition based on a pre-trained model, select matching tool identifiers, organize and schedule the execution of inference logic to generate response answer text.

[0055] Tool Registry Center: The configuration center module is used to structurally and persistently store and register all access tools' name identifiers, tool type category codes, specified input format schemas, standardized output format schemas, quantitative risk level ratings, multi-dimensional permission requirements criteria, and corresponding security audit policy configurations.

[0056] Tool access control module: Authentication gateway service, before any interface call is triggered, first verifies the validity of the user who initiated the request, matches the associated role permission set, verifies the site scope and underlying data mapping scope covered by the request, and the independent operation permission switch of specific tool level.

[0057] Parameter Schema Validation Module: Utilizes memory scanning algorithms and regular expression parsers to rigorously validate the completeness of the expected input fields of the target tool, data type matching, the rationality of the call time range limit window, the legality of the input object ID set, the compliance of the passed enumeration values, and the extreme value boundary safety of various numerical parameters.

[0058] Tool Execution Gateway: RPC / HTTP proxy and network isolation layer, used for unified proxying of time-series data queries, complex model analysis calls, analysis report generation processes, and controlled policy issuance requests. It is strictly forbidden to expose the connection pool information of the underlying core industrial database or the direct control interface of PLC devices to the computing network domain where the AI ​​large model is located.

[0059] Evidence Chain Generation Module: Source Data Assembly Service. It is responsible for generating a unique identifier tool_call_id for each individual tool call instance using a unique sequence number generation algorithm, extracting the input message digest and output message digest of the call, recording the industrial object reference table involved in the process, the time range involved, and the physical storage source node information of the data hit by the query.

[0060] AI Response Constraint Module: Output Verifier Program. Using regular expressions and semantic verification techniques, it mandates that the final response of the language model must carry a reference pointer to the aforementioned evidence set. When a signal of insufficient data is obtained, it forces the output of explanatory text and includes core functional rules: absolutely prohibiting the fabrication of fictitious real-time data sequences, and absolutely prohibiting the output of device control action instruction formats that directly point to the underlying physical registers.

[0061] Controlled Policy Request Module: This module restricts the data flow, allowing system logic to create policy request draft entities for executing control actions only as needed. The system layer does not grant it hardware or software network routing permissions to directly call the network address of the field edge controller or the control bus interface of the field device.

[0062] Audit Log Module: Employs a high-throughput write mechanism (such as Kafka log streams or immutable storage) to fully record the original user problem records from the requesting end, tool call chain logs containing various IDs, model call calculation records, generated association strategy draft ontology records, program error logs, subsequent flow confirmation logs, manual correction feedback logs, and the final response message issued by the system.

[0063] Exception handling module: Bypass interrupt manager. When the system detects insufficient permission matching, insufficient query return data, connection failure of underlying tool call, or encounters status codes such as system trigger control being blocked or prohibited, it immediately collects context information and returns a standard structured error message to the front end.

[0064] To extend the system's adaptability to heterogeneous network environments, the tool registry's data structure can adopt standard JSON Schema syntax, OpenAPI specification document structure, and MCP (Model Context Protocol) machine-readable description protocol, among other common machine-readable schema definition languages. Furthermore, to enhance the credibility of evidence data in compliance audits, the traceability data generated by the evidence chain generation module can be flexibly stored in relational database systems supporting transactional operations, centralized log systems with high query performance, object storage service clusters for massive data, knowledge graph databases for building entity relationship indexes, or in a blockchain-style immutable distributed ledger log system using encrypted consensus algorithms. The specific technical implementation of the AI ​​response constraint module can also be configured in various ways, such as pre-setting strong system-level System Prompt constraint prompts during the LLM prompt engineering phase, using a script engine-based rule expression validator, employing a model post-processing penalizer during the decoding phase, or deploying an independently operating multi-model adversarial review mechanism. Furthermore, the tool's access control module has an open interface that can be configured to achieve data interoperability and access control integration with the target enterprise's existing RBAC (role-based access control model), ABAC (attribute-based access control model), site organizational structure data scope, specific project virtual role orchestration, and existing lower-level machine control and authorization systems.

[0065] Furthermore, although the embodiments of this invention are described from the perspective of industrial energy and carbon management scenarios, based on the multi-dimensional isolation, evidence chain generation, and model anti-illusion technical architecture design ideas disclosed in this invention, the controlled tool invocation and evidence chain auditing method can obviously be extended and transferred to a wider range of vertical industrial application fields by switching the underlying knowledge base and access tool set. These include intelligent water system management, building automation control and operation and maintenance monitoring and analysis systems, decision support for discrete and process manufacturing execution systems (MES), predictive diagnostic operation and maintenance for heavy special equipment, automatic generation systems for enterprise-level ESG (Environmental, Social, and Governance) compliance quantitative indicator reports, and intelligent decision support system platforms that assist virtual power plants in spot trading and load scheduling. This system-level isolation and traceability architecture provides highly secure core underlying support for the introduction of large-scale AI model applications in these industries. This method, through a tool classification mechanism and a controlled strategy request security isolation zone mechanism for the instruction issuance link of the execution agency, clearly and logically separates the AI ​​inference computing capabilities with unpredictable probabilistic attributes from the actual execution boundary of industrial control that requires high determinism and high availability. This forms a core technology and patent moat for building an industrial-grade energy carbon emission automated control operating system (Industrial Energy Carbon OS) based on a secure and controllable application layer of a large language model.

[0066] 5.4 Examples of electronic devices and storage media: Based on the same technical concept, see [link / reference] Figure 4 This invention also provides an electronic device, which can be a rack-mounted server cluster deployed in an enterprise private cloud, an edge computing node gateway device, or a computing resource instance providing public cloud services. At the physical hardware architecture level, this electronic device includes a multi-core central processing unit (CPU) and a physical memory module (such as a combination of DRAM memory and NVMe solid-state drives) that communicates with the CPU via a high-speed system bus. The memory is allocated a certain amount of storage space to store computer program instructions with logical instruction code sequences. When the operating system kernel loads the computer program instructions into the memory space, and the arithmetic logic unit (ALU) of the multi-core CPU fetches and executes them, it can drive the entire computer hardware system to cooperate in completing the aforementioned tasks. Figure 1The controlled invocation and auditing method for the large model described in the corresponding embodiment includes: generating a unique session trace_id tracing identifier; performing forward propagation of the large language model on word embedding vectors in memory based on computing power to decompose the directed graph of task instructions; reading and verifying the authentication parameters of the requesting end and the parameter schema range of the target object from the memory bus; using the network interface controller (NIC) configured on the host motherboard to initiate TCP / IP network data capture requests to other local area network node databases; calculating cryptographic-level input / output digests based on the SHA acceleration instruction set built into the hardware CPU to generate the corresponding tool call evidence chain storage block; and finally intercepting and checking the text character set to be output in the large language model buffer queue to determine whether it is compliant, and blocking the direct issuance of unauthorized serial device control signal instruction sequences to the underlying system bus or connected controller ports in the form of physical isolation.

[0067] Furthermore, embodiments of the present invention also provide a computer-readable storage medium, which can be any form of non-volatile data storage entity, such as a USB flash drive, an optical disc (CD-ROM), a magnetic hard disk drive, or a solid-state drive array built into a server. A set of computer-executable program instruction code is embedded in this computer-readable storage medium. When these binary instructions are recognized, loaded, and executed by the interpreter / compiler of a computer or processor, the object data conversion and control flow process required by the controlled tool invocation and chain of evidence auditing method and system as defined in the claims can be substantially achieved through the read / write changes of the computer memory state and the control of interface transmission and reception.

[0068] It should be understood that the specific embodiments detailed herein are merely for the purpose of more clearly and intuitively explaining and elaborating on the technical concept and working principle of the present invention, and are not intended to mechanically limit the scope of patent protection claimed by the present invention through these specific parameters and network node structure descriptions. For those skilled in the art with certain basic software and hardware development experience, after fully reading the above-mentioned technical principles of the present invention and the control logic links of each module, different degrees of modification and flexible adaptation can be made to the aforementioned embodiments without departing from the spirit of the core security isolation and traceability audit framework of the present invention. For example, different versions of communication protocols can be used (such as changing from HTTP to MQTT protocol), different brands of middleware can be used (such as changing the cache database engine type), or different network proxy forms with different topologies can be selected. All these variations, equivalent substitutions, and structural adjustments derived from the same inventive concept of the present invention that can be implemented without creative effort should be considered to cover and fall within the scope of patent protection claimed in the claims of this application.

[0069] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A method for controlled invocation and auditing of large models, characterized in that, include: Receive the natural language processing request sent by the requesting end, generate a unique tracking identifier associated with the processing request, and obtain the corresponding context data; The intelligent agent orchestration module decomposes the processing request into tasks to determine the target tool to be invoked and its invocation parameters, wherein the invocation parameters include at least the target object and the time range. Based on the tool name of the target tool, the tool definition information of the target tool is obtained from a preset tool registry. The callable tools in the tool registry are pre-classified into read-only data tools, analysis and generation tools, and controlled policy request tools. Based on the context data and the tool definition information, the processing request is sequentially subjected to permission control verification and parameter specification verification. When both the permission control verification and the parameter specification verification pass, the tool executes a gateway proxy call to the backend service node corresponding to the target tool, obtains the original execution result, and converts it into standard tool output data. The evidence chain generation module generates evidence chain data containing the unique tracking identifier for the standard tool output data; target response information is generated based on the large language model, the standard tool output data, and the evidence chain data, and the target response information is verified through a preset response constraint mechanism to block response outputs containing instructions that directly control the underlying physical devices.

2. The method according to claim 1, characterized in that, Based on the context data and the tool definition information, the step of sequentially performing permission control verification and parameter specification verification on the processing request includes: Verify the identity, role permissions, site scope, data scope, and tool-level permissions corresponding to the requesting client; The system verifies the input fields, data types, time ranges, object identifiers, and parameter boundaries of the call parameters. When a large-scale data query request without a time range, an unregistered parameter, or an out-of-bounds parameter is detected, the system intercepts the call parameters and returns a structured exception identifier indicating that the standard validation failed to the requesting client.

3. The method according to claim 1, characterized in that, The step of using a tool to execute gateway proxy calls to the backend service node corresponding to the target tool includes: using the tool to execute gateway unified proxy data query, model analysis, and controlled policy requests, thereby blocking the direct communication connection between the large language model and the underlying database or physical device control interface.

4. The method according to claim 1, characterized in that, When the type of the target tool is the controlled policy request tool, the method further includes: The execution permissions of the controlled policy request tool are restricted to creating policy request drafts or withdrawing policy requests; draft data containing policy identifier, status, required confirmation level and blocking reason is output to the associated policy center node, and direct issuance of device control commands through the edge controller interface is prohibited.

5. The method according to claim 1, characterized in that, The step of generating evidence chain data containing the unique tracking identifier for the standard tool output data through the evidence chain generation module includes: Assign a unique tool call identifier to each target tool call, and extract input and output digests based on the call parameters and the standard tool output data; concatenate the unique tracking identifier, the tool call identifier, object reference information, the time range, data source information, data quality status, and limitation descriptions into structured evidence chain data.

6. The method according to claim 1, characterized in that, The verification of the target response information through a preset response constraint mechanism includes: Verify whether the target response information references the data time range, object identifier, tool call result, and data source in the evidence chain data; when the original execution result indicates insufficient data, tool failure, or insufficient permissions, constrain the large language model to output a structured failure description containing the corresponding reason, and prohibit the large language model from generating fabricated real-time data, device status, or strategy benefits in the target response information.

7. The method according to any one of claims 1 to 6, characterized in that, The method also includes auditing and anomaly handling steps: The system records audit logs containing the processing requests, tool call events, model execution records, policy request drafts, structured error information, and target response information, and stores the audit logs in conjunction with the unique tracking identifier. When a controlled policy request is identified to involve an unauthorized asset, an abnormal status identifier indicating control blocking or unauthorized asset is returned, and the target response information is restricted to generating only manual confirmation suggestions.

8. A large-scale model controlled invocation and auditing system, characterized in that, include: The Agent orchestration module is used to receive natural language processing requests sent by the requesting end, generate a unique tracking identifier, and decompose the processing request into tasks to determine the target tool to be invoked and its invocation parameters. The tool registry is used to store tool definition information and classify registered callable tools into read-only data tools, analysis and generation tools, and controlled policy request tools. The multi-dimensional security and specification verification module is used to perform permission control verification, including identity and data range, and parameter specification verification, including time range and parameter boundaries, on the processing request based on context data and the tool definition information. The tool execution gateway is used to uniformly proxy the call to the corresponding backend service node after the verification is passed, obtain the original execution result and convert it into standard tool output data, so as to physically isolate the large language model from the database or device interface; The evidence chain generation module is used to generate evidence chain data containing tool call identifiers, object references, and data sources for the standard tool output data; the AI ​​response constraint module is used to generate target response information based on the large language model, verify the reference relationship between the target response information and the evidence chain data, and block the output of commands that directly control the underlying physical device.

9. An electronic device, characterized in that, include: At least one processor; And, a memory communicatively connected to the at least one processor; wherein, The memory stores computer program instructions that can be executed by the at least one processor to enable the at least one processor to perform the large model controlled invocation and auditing method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing computer program instructions, characterized in that, When the computer program instructions are executed by the computer, they can implement the large model controlled invocation and auditing method as described in any one of claims 1 to 7.

Images