An agent cognitive flowchart-based data security dynamic decision method and computer program

Abstract

The application discloses a kind of data security dynamic adjudication method and computer program based on agent cognitive flow chart, it is related to AI agent data security technical field.The application generates standardized structured behavior unit by four types of sensor non-invasive analysis of the task planning, reasoning link, memory access and tool call conversation interaction information of agent, and constructs cognitive flow chart containing time sequence and semantic dependence relationship relying on session ID.When agent initiates data access request, the method calls industry knowledge base and session memory context to perfect cognitive flow chart, extracts multi-dimensional security features and quantifies as feature vector, determines risk level and adjudication conclusion by pre-training security adjudication model.At the same time, generate the minimum field white list and desensitization noise parameter, issue the data access right token with signature, cooperate with step-level progressive minimum authority authorization mechanism.The application can dynamically control agent data access behavior, effectively prevent combination risks such as step-by-step splicing, reasoning disclosure, data transmission, without modifying the internal code of agent, strong compatibility, realize the two-way guarantee of agent business usability and data security compliance.

Description

Technical Field

[0001] This invention relates to the field of AI agent data security technology, specifically to a dynamic data security adjudication method and computer program based on agent cognitive flow graphs. Background Technology

[0002] The AI ​​Agent uses a Large Language Model (LLM) as its cognitive core and integrates four major capability modules: task planning, memory storage, logical reasoning, and tool invocation. It is an autonomous AI system that can receive complex natural language goals from users, autonomously break down multi-step tasks, read historical memories, generate thought reasoning chains, invoke external tools such as databases / APIs / emails, and continuously iterate until the task is completed.

[0003] The operation of an intelligent agent includes the following steps: Planning: Decompose complex goals and generate hierarchical execution steps (corresponding to task step decomposition perceptrons).

[0004] Memory: Stores session history, knowledge base, and vector retrieval information to support subsequent reasoning (corresponding to the memory context perceptron).

[0005] Reasoning: Based on memory and data, a CoT thinking chain is formed to deduce conclusions and identify sensitive entities (corresponding to the reasoning chain extractor perceptron).

[0006] Execution: Call various tools and external interfaces to complete operations such as data query, file export, and email sending (corresponding tools call the intent perceiver).

[0007] Currently, intelligent agents can conceal and splice multiple steps of data to form implicit business intentions during operation. This means they can hide target information within multiple steps, thereby accomplishing covert functions such as information theft. Traditional security gateways only intercept single tool requests and cannot perceive the agent's global cognitive intent, making it difficult to prevent multi-step, spliced ​​data leakage.

[0008] Therefore, a security strategy for intelligent agents is urgently needed to solve at least one of the above problems. Summary of the Invention

[0009] To alleviate or resolve at least one aspect or point of the above-mentioned problems, this invention is proposed. A data security dynamic adjudication method based on an agent's cognitive flow graph according to this invention includes the following steps: S1: Cognitive Flow Parsing: Intercepts the conversational interaction information between the agent and the external environment, and performs structured parsing of the above interaction information through a task decomposition perceptron, an inference chain extraction perceptron, a memory context perceptron, and a tool intent perceptron to generate structured behavioral units. S2: Cognitive Flow Graph Construction: Using the session ID as the unique identifier, structured behavioral units as nodes, and business temporal relationships and semantic dependencies as edges connecting the nodes, construct a cognitive flow graph; S3: Dynamic Decision-Making Step: When an agent initiates a data access request, the request is paused, and dynamic decision-making is performed. This dynamic decision-making includes: S31: Obtain the cognitive flow graph corresponding to the current session; S32: Retrieve industry knowledge base and / or conversational memory context to supplement knowledge and improve attributes of relevant nodes in cognitive flow graph; S33: Based on the improved cognitive flow graph, extract multi-dimensional safety features of task intent, tool intent, and reasoning depth, quantify and assign values ​​to each feature, and form a standardized feature vector; S34: Input the feature vector into the pre-trained security adjudication model and output the risk level and adjudication conclusion corresponding to the current data access request; S35: Execute the corresponding data security control actions based on the aforementioned ruling.

[0010] Preferably, step S35 further includes: combining the current task step of the agent to generate a minimal entity field whitelist and corresponding noise desensitization parameters; Issue digitally signed data access warrants for subsequent data access permission verification and compliance enforcement.

[0011] Preferably, step S35 further includes: adopting a gradual data release strategy: for multi-step combined tasks, not granting full data permissions at once, but only matching the minimum necessary entity field permissions for the currently executed step; adopting step-by-step authorization and hierarchical control to prevent the combined data leakage risks of step-by-step splicing, reasoning leakage, and data transmission.

[0012] Preferably, the task decomposition perceptron adopts a two-layer architecture of rule-based pre-processing and lightweight model fine-tuning, and is configured with a streaming incremental parsing mechanism.

[0013] Preferably, the rule pre-diversion layer has a built-in high-frequency task rule library, which stores intent types, trigger keyword sets, and step templates in JSON structure. It directly generates structured steps through keyword matching and sentence template matching, covering standardized and simple task scenarios. For complex, multi-step tasks where the rule layer fails to hit, the lightweight model fine-tuning layer calls a 4-bit quantized lightweight open-source large model that has been finely tuned by instructions. Through a dedicated prompt word and constraint decoding mechanism, it forces the model to output structured content that conforms to the preset JSON Schema. The streaming incremental parsing mechanism uses complete semantic sentences as the segmentation unit and periods, question marks, exclamation marks, and preset conjunctions as semantic segmentation anchors. It outputs parsing results in segments in real time, with end-to-end parsing latency controlled within 100ms.

[0014] Preferably, the task decomposition perceptron also calculates the vector cosine similarity of the target description of each step through the Sentence-BERT semantic embedding model, automatically establishes dependencies for steps with similarity higher than the 0.7 threshold, completes the implicit execution logic of the task, and finally outputs a structured list of step nodes.

[0015] Preferably, in step S1, the reasoning chain extraction perceptron takes the CoT thought chain text output by the large model and the reasoning field inside the agent as input, and uses pattern matching combined with semantic classification to parse the reasoning chain.

[0016] Preferably, the system first identifies preset inference connectors through regular expressions and dependency parsing, and then segments the inference text fragments; unmatched texts are fed into a lightweight Transformer classifier, which classifies the sentence types into three categories: premise, inference, and conclusion. Simultaneously, named entity recognition is performed on the inference node text, corresponding task step entities are associated, and a structured inference link containing trace_id, node type, text content, and sensitive entities is constructed to restore the complete logical progression relationship.

[0017] Preferably, in step S1, the memory context perceptron adopts a four-layer architecture of proxy interception + semantic compression + role labeling + relevance calculation. The proxy interception layer injects into the intelligent agent memory module client through aspect-oriented programming Hook, non-intrusively intercepting all read, write and retrieval requests of the vector database, session memory and knowledge base, and capturing query vectors, Top-K retrieval results, set names and partition key metadata; The semantic compression layer uses the BART-small lightweight summarization model with 60M parameters to generate a single-sentence core summary of the memorized content. Only the summary data is persisted, reducing storage overhead and avoiding the risk of secondary leakage. The role labeling layer uses a fine-tuned TinyBERT / DistilBERT four-class classifier to divide the memory content into four semantic roles: factual statements, historical decisions, user preferences, and policy regulations, and matches them with differentiated adjudication weights. The relevance calculation layer determines the legality of access by the cosine similarity between the query vector and the returned result vector. If the similarity is lower than the threshold of 0.5, it is determined to be an abnormal memory access, triggering a risk warning.

[0018] Preferably, in step S1, the tool invocation intent perceiver employs a three-level recognition mechanism of metadata enhancement, parameter semantic parsing, and contextual intent completion.

[0019] Preferably, the metadata enhancement layer requires tools accessing the gateway to pre-register JSON format metadata, which includes tool name, function description, business category, basic sensitivity level, risk label, and sensitive parameters. Unregistered tools will be marked as high-risk and an alarm will be triggered by default. The parameter semantic parsing layer structured parsing tool extracts various input parameters, such as receiving address, data range and query conditions, and identifies high-risk parameters such as external domain names and third-party interfaces and automatically increases the sensitivity level. The context intent completion layer semantically associates tool invocation behavior with top-level task objectives and task steps, refines the real business intent, and outputs standardized risk labels with confidence levels. The standardized risk labels include external transmission, batch export, sensitive query, data modification, and unauthorized execution.

[0020] In addition, the present invention provides a computer program for executing the adjudication method described in any of the preceding claims.

[0021] This invention utilizes four types of dedicated sensors, corresponding to the four core cognitive stages of intelligent agents: planning, memory, reasoning, and execution. It non-intrusively analyzes the complete conversational interaction flow, accurately identifying hidden risks that traditional gateways cannot detect, including: multi-step data splicing leakage, leakage of reasoned sensitive information, memory poisoning attacks, and unauthorized tool calls—a combination of security threats. This invention overcomes the cognitive blind spot of traditional solutions that only intercept single tool requests and cannot identify global business intent, blocking new data security risks such as step-by-step theft and covert transmission from the source of cognitive decision-making.

[0022] This invention employs a two-layer parsing architecture of rule-based pre-processing and lightweight model-based fine-tuning, covering over 80% of standardized simple task scenarios. Simultaneously, it leverages a finely tuned lightweight large model to address the parsing challenges of complex, multi-step tasks. Combined with a streaming incremental parsing mechanism, end-to-end parsing latency is controlled within 100ms, enabling intent prediction before the agent's task execution, achieving proactive protection rather than reactive post-event handling. Furthermore, semantic similarity algorithms automatically complete implicit task dependencies, accurately reconstructing the agent's complete execution logic.

[0023] This invention constructs a structured cognitive flow graph based on both temporal and semantic dimensions, refines node features by combining industry knowledge bases and conversational memory context, and achieves intelligent risk classification and judgment through multi-dimensional quantified feature vectors and adjudication models. It adopts a step-by-step least privilege progressive release strategy, dynamically generating differentiated desensitization and control parameters such as field whitelists, aggregation precision, differential privacy noise, and query row count. Only data permissions necessary for the current task step are granted, preventing sensitive data leakage while maximizing the normal business execution capabilities of the intelligent agent.

[0024] The overall architecture of this invention is based on gateway proxy interception, requiring no modification to the internal code of the intelligent agent. It is compatible with mainstream intelligent agent frameworks such as LangChain and AutoGPT, as well as various vector databases and tool interfaces. Furthermore, through semantic summarization compression technology, it reduces memory storage overhead by more than 90%, avoiding the risk of secondary leakage caused by storing the entire original memory. This results in significant advantages such as low deployment cost and wide applicability.

[0025] This invention constructs an incrementally updated cognitive flow graph using a unique session identifier, fully encompassing task, reasoning, memory, and tool behavior nodes, as well as their causal and temporal relationships. Preferably, a globally unique graph fingerprint is generated using SHA-256 hashing. Combined with a tamper-proof JWT data access scepter, it completes full-process permission verification and behavior tracking, enabling the modeling, traceability, and auditability of intelligent agent cognitive behavior, fully meeting enterprise data security compliance management requirements. Attached Figure Description

[0026] Figure 1 This is a schematic diagram of a data security dynamic adjudication method based on an agent cognitive flow graph, which is an exemplary embodiment of the present invention.

[0027] Figure 2 This is a schematic diagram of the cognitive flow control process of an enterprise financial analysis intelligent agent, which is an exemplary embodiment of the present invention. Detailed Implementation

[0028] The following description of embodiments of the present invention with reference to the accompanying drawings is intended to explain the overall inventive concept of the invention and should not be construed as a limitation thereof. In this invention, the same reference numerals denote the same or similar parts.

[0029] The features described herein may be implemented in various forms and should not be construed as limited to the examples described herein. Rather, the examples described herein are provided only to illustrate some of the many feasible ways in which the methods, apparatuses, and / or systems described herein will become clear upon understanding the disclosure of the invention.

[0030] The terminology used herein is for the purpose of describing various examples only and is not intended to limit disclosure. Unless the context clearly indicates otherwise, the singular form is intended to include the plural form as well. The terms “comprising,” “including,” and “having” indicate the presence of the described features, quantities, operations, components, elements, and / or combinations thereof, but do not preclude the presence or addition of one or more other features, quantities, operations, components, elements, and / or combinations thereof.

[0031] To enable those skilled in the art to utilize the content of this invention, the following exemplary embodiments may be provided in conjunction with specific application scenarios, specific systems, device and component parameters, and specific connection methods. However, these embodiments are merely examples for those skilled in the art, and the general principles defined herein can be applied to other embodiments and application scenarios without departing from the spirit and scope of this invention.

[0032] According to an exemplary embodiment of the present invention: Figure 1 As shown, the present invention provides a data security dynamic adjudication method based on an agent's cognitive flow graph, comprising the following steps: S1: Cognitive Flow Parsing Steps: Intercept the conversational interaction information between the agent and the external environment, and perform structured parsing of the above interaction information through the task decomposition perceptron, inference chain extraction perceptron, memory context perceptron and tool intent perceptron to generate structured behavioral units.

[0033] The design goal of this step is to extract task steps, inference chains, memory contexts, and tool call intentions in real time from the interaction flow between the agent and the large language model, tools, and memory modules, without relying on external intent recognition services.

[0034] For example, the four types of sensors together constitute the cognitive flow parsing engine. Based on non-intrusive agent interception, they correspond to the four core cognitive stages of the agent: "planning, memory, reasoning, and execution." They collaboratively output structured behavioral units, providing standardized input for cognitive flow graph construction. All sensors are deployed on the gateway side, requiring no modification to the agent's internal code; parsing is completed simply by intercepting the interaction traffic between the agent and the external environment.

[0035] For example, a task step decomposition perceptron. 1. Core functions: capture the task planning behavior of the intelligent agent, restore the hierarchical execution goals and step dependencies, and build the top-level skeleton of the cognitive flow; solve the shortcomings of traditional gateways that can only recognize single requests and cannot perceive the overall task goals of the intelligent agent, and support subsequent step-by-step authorization and risk assessment based on task goals.

[0036] 2. Input source: Gateway intercepts and obtains three types of input data: (1) Native output of the agent planning stage: intercepts planning nodes of frameworks such as LangChain and AutoGPT, including the Thought / Plan field of ReAct mode and the task decomposition results of Plan-and-Execute mode; (2) User's original query command and session history context; (3) Identified historical task steps and execution status.

[0037] 3. Technical Implementation Details: A two-layer architecture of rule pre-splitting + lightweight model fine analysis + streaming incremental output is adopted to balance inference latency and recognition accuracy. (1) Rule matching splitting layer: Built-in high-frequency task rule library, covering standardized scenarios such as data query, report generation, email sending, and information retrieval; relying on keyword matching and sentence template matching to directly generate structured steps, which can cover more than 80% of simple task scenarios. The rules are stored in JSON structure [intent type, trigger keyword set, step template]; for example, the email sending intent configuration keyword set {"email", "send", "cc"}, and the structured behavior unit is directly output when the match is successful.

[0038] (2) Model Refinement Layer: For complex multi-step tasks where the rule layer fails to reach the target, a lightweight open-source large model with 4-bit quantization fine-tuned by instructions is invoked; optional base models include Mistral-7B and Qwen2.5-7B. The base model is supervised fine-tuned (SFT) on the task decomposition labeled dataset and has stable structured output capability. The proxy layer encapsulates special prompt words, forcing the model to output text that conforms to the preset JSON Schema, and works with constraint decoding to ensure format compliance and eliminate unstructured parsing errors.

[0039] (3) Streaming Incremental Parsing Mechanism: For the streaming planning output of large models, parsing is performed in segments based on complete semantic sentences; periods, question marks, exclamation marks, and conjunctions such as "then" and "next" are selected as semantic segmentation anchors, and the output is performed in real time after the complete steps are identified, without waiting for the full planning to be generated. The end-to-end parsing latency is controlled within 100ms. Parsing can be completed when the agent streams the first step of the planning content. The gateway can obtain the step intent before the agent executes the corresponding step, and realize pre-emptive risk prediction and interception for combined attacks, rather than post-event handling.

[0040] (4) Automatic completion of dependencies: If the agent planning does not explicitly declare the step dependencies, the Sentence-BERT (all-MiniLM-L6-v2) semantic embedding model is used to convert the target description of each step into a vector and calculate the cosine similarity; if the similarity is higher than the threshold of 0.7, the DEPENDS_ON dependency edge is automatically established; if it is lower than the threshold, it is determined to be a parallel execution step.

[0041] When intelligent agent frameworks output planning text, they usually only list the steps without explicitly annotating the sequential execution constraints. By inferring implicit causal dependencies through semantic similarity, the task execution logic is completed, enabling the cognitive flow graph to accurately reconstruct the execution trajectory and avoid forming an unordered list of steps.

[0042] Output: A structured list of step nodes [StepNode].

[0043] For example, the reasoning chain extraction perceptron: 1. Core function: Extract structured thinking chains from the reasoning output of the large model of the intelligent agent, restore the logical progression relationship of premise-reasoning-conclusion, identify sensitive entities involved in the reasoning process, provide the adjudication engine with the basis for judging the subjective reasoning intent dimension, and solve the problem that traditional data security solutions are difficult to identify reasoning leakage of "multi-step logical deduction to piece together sensitive data".

[0044] Input: LLM-generated text (containing CoT thought chain content), and the agent's internal reasoning field.

[0045] Implementation scheme: Pattern matching + semantic classification; First, regular expressions and dependency syntax rules are used to identify inference conjunctions (because... therefore... based on... to draw a conclusion); Unmatched text is fed into a lightweight Transformer classifier to classify sentences into premise / inference / conclusion types.

[0046] Key entity linking: Perform named entity recognition on node text, associate it with entities in task steps, and establish traceability clues between reasoning behavior and data access.

[0047] Structured link construction: Inference nodes are organized chronologically, in the format {"trace_id":"","nodes":[{"type":"premise","text":"","entities":[]},{"type":"inference","text":""}]}.

[0048] For example, a memory context perceptor. 1. Core functions: The agent intercepts all memory read and write operations of the intelligent agent, captures memory retrieval content, semantic roles and relevance, restores the information source on which the intelligent agent's thinking is based, provides memory context basis for adjudication, and at the same time prevents risks such as memory poisoning and unauthorized reuse of memories.

[0049] Input sources: (1) Gateway intercepts vector database, session memory, and knowledge base query requests; non-intrusive interception is achieved by injecting intelligent agent memory module clients through aspect-oriented programming (AOP) Hook; (2) Memory retrieval returns text blocks, vector representations, and metadata; (3) The task step ID that triggers memory access.

[0050] Technical implementation details: A four-layer processing architecture of proxy interception + semantic compression + role labeling + relevance calculation is adopted: (1) Proxy interception layer: Dynamic call hooks are injected into vector database clients such as Milvus and Pinecone to proxy all vector retrieval and memory read and write requests; complete capture of metadata such as query vectors, Top-K retrieval results, set names, partition keys, etc., without intruding on the original business logic of the memory module.

[0051] (2) Semantic summarization compression layer: A lightweight summarization model of BART-small (approximately 60M parameters) is adopted; taking the concatenated sequence of retrieved text as input, a single-sentence summary containing core entities and events is generated through domain prompts. The gateway only persists the summary and does not store the original memory text, reducing storage overhead by more than 90% and avoiding the risk of secondary leakage caused by full memory storage.

[0052] (3) Semantic role classification: A four-classifier is built based on TinyBERT / DistilBERT and fine-tuned in the enterprise memory annotation corpus; the memory content is divided into four categories: factual statements, historical decisions, user preferences, and policy regulations; different semantic roles correspond to different adjudication weights. For example, reasoning based on policy regulations can obtain higher access rights, and abnormal and unfounded memory access is marked as risk.

[0053] (4) Relevance verification: Calculate the cosine similarity between the query vector and the returned result vector as the relevance index; if the similarity is less than 0.5, it is judged as abnormal memory access, and warnings are issued for memory poisoning and unauthorized retrieval behavior.

[0054] Output: memory_context: {query: "...", retrieved_summaries: [.], entities: [.], role: "fact"}.

[0055] For example, a tool invocation intent perceiver. 1. Core function: Parsing the agent's tool invocation instructions, It combines task context to reconstruct the true business intent, rather than just identifying function names; it accurately identifies risks such as tool abuse, hidden data leakage, and unauthorized calls, serving as the core perception entry point for cognitive flow execution behavior.

[0056] Input sources: (1) Gateway interception tool call requests, including LangChain Tool calls, OpenAIFunction Calls, and custom API calls; (2) Pre-registered tool metadata and sensitivity level configuration; (3) Current related task steps and overall task objectives.

[0057] Technical implementation details: A three-level recognition mechanism is adopted, consisting of metadata enhancement, parameter semantic parsing, and contextual intent completion. (1) Tool metadata registration mechanism: Tools accessing the gateway register JSON format metadata in advance through the management interface, including tool name, function description, business category, basic sensitivity level (LOW / MID / HIGH), risk label set, and sensitive parameter description; unregistered tools are marked as high risk by default and generate alarm logs.

[0058] (2) Parameter semantic parsing: The structured parsing tool takes input parameters (JSON, query string, gRPC message) and extracts the receiving address, data range, and query conditions; if the parameters contain external email addresses, external domain names, or third-party interface addresses, the tool's sensitivity level is automatically increased.

[0059] (3) Enhanced contextual intent: Semantically associate tool calls with task steps and refine business intent in conjunction with top-level task objectives. For example, the general send_email tool is identified as "sending Q3 financial analysis emails to external partners" in conjunction with the context, rather than simply marked as "calling email tools".

[0060] (4) Risk Label Mapping: Output standardized risk labels with confidence levels, including external_transfer, batch_export, sensitive_query, data_modify, and privilege_escalation, which are directly sent to the dynamic adjudication engine for policy matching. Output: tool_intent: {tool_name: "...", business_intent: “External Transmission Analysis Report”, params_summary: {.}, sensitivity: "high"}.

[0061] S2: Cognitive Flow Graph Construction Steps: Using behavioral units as nodes, construct an attribute graph based on temporal and semantic dependencies, and generate a unique graph fingerprint. Design Goal: To assemble asynchronous perceptual events into a directed acyclic graph (DAG), where nodes represent operations (steps / reasoning / memory / tools), edges represent temporal order and causal dependencies, and a unique fingerprint is calculated for the entire graph.

[0062] Technical Implementation: Graph Model: An attribute graph model is adopted, with node types including TaskStep, ReasoningStep, MemoryAccess, and ToolInvocation. Node attributes contain detailed captured content (vectors, text summaries, entities). Edge types include NEXT (temporal), DEPENDS_ON (task dependency), and INFORMS (inference premise derived from a memory).

[0063] Construction Algorithm: 1. Session Window Maintenance: Maintain an atomic event queue within a sliding window using session_id as the key.

[0064] 2. Establishment of time-series edges: NEXT edges are naturally formed based on the timestamp of the event.

[0065] 3. Dependency Inference: Edges are established using the depends_on field provided by the task decomposition perceptron. If missing, semantic matching is used: the target description of each step is embedded and matched with the output of other steps based on similarity; if the similarity exceeds a threshold, a DEPENDS_ON edge is automatically added.

[0066] 4. Reasoning-Memory Binding: If an entity in a reasoning node has a height overlap with a memory access node, then an INFORMS edge is established.

[0067] 5. Graph fingerprint calculation: SHA-256 hash is performed on the JSON normalized representation of the entire graph (excluding non-deterministic fields such as timestamps) to serve as a unique identifier for the cognitive flow graph, used for auditing and subsequent trial references.

[0068] Update strategy: The graph is built incrementally as the agent acts. Whenever a new event occurs, the graph is updated immediately and the local hash is recalculated, supporting near real-time adjudication.

[0069] For example, the structured behavioral units (nodes) output by the four perceptrons in step S1 are used as data input, and the current session ID is used as the unique graph space identifier to construct a directed attribute graph containing multiple types of nodes and multiple types of directed edges, and the graph topology is hashed and signed.

[0070] The four types of behavioral units output by the perceptron are each treated as a graph node. Each node contains a set of attributes in a fixed format: Task Planning Node: {Type: 'TASK', id, Step Description, Overall Task Goal, Sensitivity Level (LOW / MID / HIGH), Timestamp}. Inference Chain Node: {Type: 'REASON', id, Premise Text, Inference Process, Conclusion Text, Inference Depth (Integer), List of Sensitive Entities}. Memory Access Node: {Type: 'MEMORY', id, Query Vector Summary, Semantic Role (Fact / Decision / Preference / Policy), Relevance Score (0~1)}. Tool Invocation Node: {Type: 'TOOL', id, Tool Name, Parsed Intent Description, Risk Tag Set, Parameter Summary}.

[0071] Based on execution timing and semantic logic, the system establishes four types of directed edges between nodes: temporal successors, strictly constructed according to timing; and perceptron event stream reporting with temporal order. The system records the millisecond-level timestamp of each node, establishing directed temporal edges from the current node to the next node, thus forming the execution trajectory line. Task dependency originates from the output of the task step decomposition perceptron. If step B is marked as "dependent on step A" (i.e., A is a precondition of B), then a directed edge is established from node B to node A, indicating the data supply logic.

[0072] Information is provided, and reasoning / tools originate from memory. This originates from the entity alignment results of the memory context perceptron and the reasoning chain extraction perceptron. If a sensitive entity extracted from a reasoning node or tool call node can find a matching entity source in a previous memory node, then an edge is established between the reasoning / tool ​​node and the memory node.

[0073] The memory serves a specific tool / step. When a memory retrieval occurs before a tool call and the time windows are highly contiguous (e.g., <100ms interval), or the perceptron resolves that the retrieval purpose is strongly bound to the current task ID, an edge is established from the memory node to the tool node.

[0074] S3: Dynamic decision-making step: When an agent initiates a data access request, the request is paused and a dynamic decision-making process is performed, which includes the following steps:

[0075] For example, S31: Obtain the session cognitive flow graph. When the agent initiates a data access request (such as a database query), the adjudication engine uses the current session ID as the retrieval key to load the complete cognitive flow directed attribute graph corresponding to the session from the graph database or in-memory graph storage. This graph already contains the structured behavioral nodes and temporal and semantic edge sets output by the four perceptrons, and is accompanied by a globally unique SHA-256 graph fingerprint for subsequent anti-spoofing verification.

[0076] S32: Obtain industry knowledge base or memory context as knowledge supplement to relevant nodes of the cognitive flow graph.

[0077] Based on the directed attribute graph of the current conversation cognitive flow obtained by loading S31, the industry knowledge base and conversation memory context are retrieved, and the attributes of each node in the cognitive flow graph are expanded.

[0078] For example, the industry knowledge base retrieval rules are as follows: using the business type, accessed data object, operation instructions, and subject permission tags of the current data access request as retrieval dimensions, the rules match the same source business examples in the industry knowledge base: retrieve historical standardized request examples that are semantically similar to the current data access request, have overlapping access objects, and consistent business scenarios; and extract the standard processing flow and historical adjudication results corresponding to the examples.

[0079] For example, the standard processing flow, legal operation boundaries, compliant operation steps, and standard approval links of data access requests in the same industry, scenario, and type can be retrieved as compliance benchmarks for the current intelligent agent's behavior and attached to the corresponding data access behavior node in the cognitive flow graph.

[0080] Using the current session ID as the associated index, retrieve the full-time memory context of this session, including the agent's historical task steps, complete inference chain data, past tool call records, historical data access behavior, recalled memory fragments, user's original requests, task iteration process, and records of phased goal changes.

[0081] By using temporal and causal relationship analysis, the dependencies between current data access behavior and preceding behavior are completed. Temporal relationship edges, causal inference edges, and task progression edges are added to the cognitive flow graph to identify potential risks such as multiple consecutive data retrievals within a single session, multi-step aggregated access, and implicit profile aggregation, thereby improving the global behavioral logic of the cognitive flow graph.

[0082] S33: Based on the improved cognitive flow graph in S32, extract multi-dimensional safety features related to task intent, tool intent, and reasoning depth, and quantify and assign values ​​to each feature to form a feature vector.

[0083] For example, taking the extraction of multi-dimensional security features about task intent as an example, we focus on the security attributes of the user's top-level task and determine the risk level of the task itself: Task sensitivity level: involving the company's core salary secrets (highly sensitive); Task access scope: salary data of all employees, covering information of all employees with confidential information; Task output destination: external private email (non-compliance channels); Task compliance: violating data outbound control rules (illegal intent).

[0084] Task intent quantification results: Task sensitivity level: High sensitivity → 5 points; Task access scope: All classified data → 5 points; Task output destination: External illegal channels → 5 points; Task compliance: Clear illegal intent → 5 points.

[0085] S34: Input the feature vector into the pre-trained security adjudication model and output the risk level and adjudication conclusion of the current data access request.

[0086] For example, the security adjudication model is built on a vector database. The vector database persistently stores sample feature vectors corresponding to a large number of historical access requests, and each sample feature vector is associated with a risk label and baseline adjudication information. When the security adjudication model performs inference, it uses the feature vector of the current request as the retrieval vector, performs an approximate vector search in the vector database, and matches similar historical access samples. The model combines vector similarity weights and the risk labeling information of the matched samples to calculate the comprehensive risk value of the current access request, divides it into high, medium, and low risk levels according to a preset range, and outputs adjudication conclusions such as blocking access, allowing access, or submitting for manual review based on the risk level. In the pre-training phase, a sample feature vector library is built by labeling historical access data, configuring vector similarity calculation strategies and risk score mapping rules, and completing the preset parameter configuration and model initialization of the security adjudication model.

[0087] S35: Generate a list of specific fields allowed to be queried in the current step as a field whitelist; generate numerical anonymization parameters, including integer aggregation, differential privacy noise intensity, and a limit on the number of rows returned. For example, based on the adjudication conclusion and risk level of the current data access request, generate a list of specific fields allowed to be queried this time as a field whitelist; and generate numerical anonymization parameters, including integer aggregation, differential privacy noise intensity, and a limit on the number of rows returned in the query results; the field whitelist constrains the range of fields that can be accessed in the query, integer aggregation controls the precision of the numerical aggregation results, differential privacy noise intensity is used for numerical anonymization perturbation, and the limit on the number of rows returned constrains the data scale of a single query output. S35: Issue a signed data access scepter. Package all the above adjudication results into a data access scepter, which is encapsulated in the JWT standard format and contains the following core payloads: session identifier, graph fingerprint, adjudication result (allow, deny, or anonymized), anonymization level, whitelist of allowed query fields, noise parameter, validity period, and digital signature to prevent tampering. After the scepter is sent to the data executor, the data executor rewrites the SQL statement according to the anonymization instructions in the scepter and executes the data return; if it is a deny scepter, it directly returns an insufficient permission prompt to the agent, blocking data outflow.

[0088] S36: Progressive release steps: For multi-step tasks, only authorize entities and fields required for the current step, and add differential privacy noise based on the risk level.

[0089] Example: Figure 2 As shown, this illustrates the entire cognitive flow control process of the enterprise financial analysis intelligent agent.

[0090] 1. Scenario Background. A company deploys a financial analysis agent developed based on a multi-agent framework for internal financial personnel to use. It can access three types of external resources: the company's core financial database, a supplier knowledge base vector library, and the company's email system. The device of this invention is deployed as a gateway between the agent and all external resources. All external interactions are intercepted, parsed, and adjudicated by the gateway.

[0091] The trigger command for this scenario is: the finance staff inputs into the AI ​​agent, "Help me analyze the abnormal risks of production costs in Q3 2025, find the causes and compile an analysis report, and send it to the external supplier contact person partner@ext.com to confirm the negotiation plan."

[0092] 2. Cognitive Flow Full-Link Analysis Process 2.1 Task Step Decomposition Perceptron Execution Process The agent enters the ReAct planning phase and generates initial planning text: "I need to first query the Q3 production cost data, then recall relevant historical information from suppliers to analyze the reasons, generate an analysis report, and finally send it to the contact person."

[0093] • The gateway intercepts the planning output and sends it to the task step decomposition sensor; • The model generates four structured steps, identifying the overall task type as "financial analysis + external transmission," with an overall sensitivity level of high; • Identify step dependencies: Step 2 depends on Step 1, Step 3 depends on Steps 1 and 2, and Step 4 depends on Step 3.

[0094] 2.2 Execution process of the memory context perceptron The agent executes the second step, calling the vector database to retrieve "historical cases of abnormal supplier costs." The gateway intercepts this retrieval request and the returned results. • Capture the query vector and the text of 3 returned historical cases; • Extracting core entities from the compressed summary: Supplier A, raw material price increases, and a negotiation case from Q2 2024; The classifier determined the semantic role of the memory to be "historical decision-making," and the calculated query similarity was 0.87, indicating normal relevance. • Generate memory access nodes and associate them with the corresponding task steps.

[0095] 2.3 Inference Chain Extraction Perceptron Execution Process The agent executes the third step, calling the large model to infer the cause of the anomaly. The gateway receives the LLM output in streaming: "Because the cost of raw materials in Q3 increased by 22% year-on-year, and considering the historical cooperation with supplier A, it is determined that the cost anomaly is caused by the price increase of supplier A. It is recommended to start negotiations to reduce the purchase price."

[0096] • Initially segment the premise, reasoning, and conclusion segments using conjunction rules; • Classifier verification shows accurate segment classification; sensitive entities extracted: 22%, Supplier A, price negotiation; • The statistical reasoning depth is 2 layers, generating a structured reasoning chain that is linked to the corresponding task steps.

[0097] 2.4 Tool Invocation Intent Perceptor Execution Process The agent initiated two tool calls in succession, which the perceptron parsed respectively: 1. Call the query_finance_db tool with parameters {table: production_cost, quarter:2025Q3}: the intent is identified as "query Q3 production cost details", the basic sensitivity level is medium, and the risk labels are data_query and sensitive_finance.

[0098] 2. Call the send_email tool with parameters {to: partner@ext.com, subject: Q3 cost analysis report}: The recipient is detected as an external domain, the sensitivity level is raised to high, the intent is identified as "sending financial analysis reports to external suppliers", and the risk labels external_transfer and data_leakage_risk are marked.

[0099] 3. Cognitive Flow Map Construction The gateway uses the session ID as a unique identifier to assemble the nodes output by all the sensors into a directed attribute graph: • Node set: Task planning node, financial database tool call node, memory access node, reasoning node, email tool call node; • Edge set: Tool call nodes depend on task planning nodes, memory nodes serve tool call nodes, memory nodes provide information for reasoning, and each node forms a NEXT edge in chronological order; • Calculate the SHA-256 hash of the normalized full graph structure to generate a globally unique graph fingerprint for auditing and adjudication tracing.

[0100] 4. Dynamic adjudication and gradual data release process 4.1 Initial Data Access Decision (Summary Data Authorization) The agent initiates its first request to access the financial database; the data executor suspends the request and submits a ruling. • The adjudication engine locates the current context subgraph and extracts features: the task is financial analysis, there is currently no external transmission intent, and the data sensitivity level is high; • Matching strategy library rules: Access is allowed for internal financial analysis scenarios, with a gradual release process; the first step only provides aggregate-level data. • Issue data access warrants: Allow access, anonymize the data to return only the total cost and year-on-year growth rate, mask supplier detail fields, and add 0.3 level differential privacy noise; The data executor rewrites the SQL query statement based on the scepter and returns the noisy summary data to the agent.

[0101] 4.2 Secondary Data Access Decision (Details Request Blocking) After receiving the aggregated data, the agent discovered an abnormal increase in costs and further requested a query for cost details at the supplier level. • The adjudication engine retrieves the current cognitive flow graph again, which now contains subsequent email sending tool intent nodes; • Traversing the subgraph detected a high-risk combination pattern: "External email transmission intent" + "Access to financial detail data" + "Supplier sensitive entity reasoning", which triggered the high-risk blocking strategy; • Ruling: Access to detailed data denied, the reason being "prohibition of access to vendor-sensitive financial details when there is an intent to transfer external data"; • Generate a denial-of-access scepter; the data executor blocks the data request and returns an insufficient permission message to the agent.

[0102] 4.3 Implementation Results In this embodiment, the agent can only obtain summary-level cost data and cannot obtain core sensitive information such as supplier details. It cannot generate external emails containing sensitive information, thus blocking the risk of combined data leakage by "step-by-step data query and splicing before external transmission" at the cognitive flow level. At the same time, it does not affect the agent's ability to complete basic summary-level analysis tasks, achieving a balance between security protection and business availability.

[0103] This invention uses four types of perceptrons to non-intrusively analyze the conversational interaction information of an intelligent agent's task planning, inference chain, memory access, and tool calls, generating standardized structured behavioral units. Based on the session ID, a cognitive flow graph containing temporal and semantic dependencies is constructed. When an intelligent agent initiates a data access request, this method retrieves industry knowledge base and conversational memory context to refine the cognitive flow graph, extracts multi-dimensional security features and quantifies them into feature vectors, and determines the risk level and adjudication conclusion through a pre-trained security adjudication model. Simultaneously, a minimal field whitelist and de-identified noise parameters are generated, and a signed data access scepter is issued, coupled with a step-by-step progressive least privilege authorization mechanism. This invention can dynamically manage intelligent agent data access behavior, effectively preventing combined risks such as step-by-step splicing, inference leakage, and data outreach, without requiring modification of the intelligent agent's internal code, exhibiting strong compatibility, and achieving dual assurance of intelligent agent business usability and data security compliance.

[0104] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that variations and combinations of elements may be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A dynamic data security adjudication method based on agent cognitive flow graphs, characterized in that: Includes the following steps: S1: Cognitive Flow Parsing: Intercepts the conversational interaction information between the agent and the external environment, and performs structured parsing of the above interaction information through a task decomposition perceptron, an inference chain extraction perceptron, a memory context perceptron, and a tool intent perceptron to generate structured behavioral units. S2: Cognitive Flow Graph Construction: Using the session ID as the unique identifier, structured behavioral units as nodes, and business temporal relationships and semantic dependencies as edges connecting the nodes, construct a cognitive flow graph; S3: Dynamic Decision-Making Step: When an agent initiates a data access request, the request is paused, and dynamic decision-making is performed. This dynamic decision-making includes: S31: Obtain the cognitive flow graph corresponding to the current session; S32: Retrieve industry knowledge base and / or conversational memory context to supplement knowledge and improve attributes of relevant nodes in cognitive flow graph; S33: Based on the improved cognitive flow graph, extract multi-dimensional safety features of task intent, tool intent, and reasoning depth, quantify and assign values ​​to each feature, and form a standardized feature vector; S34: Input the feature vector into the pre-trained security adjudication model and output the risk level and adjudication conclusion corresponding to the current data access request; S35: Execute the corresponding data security control actions based on the aforementioned ruling.

2. The adjudication method according to claim 1, characterized in that: Step S35 also includes: combining the current task steps of the agent to generate a minimal entity field whitelist and corresponding noise desensitization parameters; Issue digitally signed data access warrants for subsequent data access permission verification and compliance enforcement.

3. The adjudication method according to claim 2, characterized in that: Step S35 also includes: adopting a gradual data release strategy: for multi-step combined tasks, full data permissions are not granted at once, but only the minimum necessary entity field permissions are matched for the current execution step; step-by-step authorization and hierarchical control are adopted to prevent the combined data leakage risks of step-by-step splicing, reasoning leakage and data transmission.

4. The adjudication method according to claim 1, characterized in that: The task decomposition perceptron adopts a two-layer architecture of rule-based pre-processing and lightweight model-based fine parsing, and is configured with a streaming incremental parsing mechanism.

5. The adjudication method according to claim 4, characterized in that: The rule-prepared traffic distribution layer has a built-in high-frequency task rule library, which stores intent types, trigger keyword sets, and step templates in JSON structure. It directly generates structured steps through keyword matching and sentence template matching, covering standardized and simple task scenarios. For complex multi-step tasks where the rule layer fails to hit, the lightweight model fine-tuning layer calls a 4-bit quantized lightweight open-source large model that has been finely tuned by instructions. Through a dedicated prompt word and constraint decoding mechanism, it forces the model to output structured content that conforms to the preset JSONSchema. The streaming incremental parsing mechanism uses complete semantic sentences as the segmentation unit and periods, question marks, exclamation marks, and preset conjunctions as semantic segmentation anchors. It outputs parsing results in segments in real time, with end-to-end parsing latency controlled within 100ms.

6. The adjudication method according to claim 5, characterized in that: The task decomposition perceptron also calculates the cosine similarity of the vectors describing the target at each step using the Sentence-BERT semantic embedding model. For steps with a similarity higher than the 0.7 threshold, it automatically establishes dependencies, completes the implicit execution logic of the task, and finally outputs a structured list of step nodes.

7. The adjudication method according to claim 1, characterized in that: In step S1, the reasoning chain extraction perceptron takes the CoT thought chain text output by the large model and the reasoning field inside the agent as input, and uses pattern matching combined with semantic classification to parse the reasoning chain.

8. The adjudication method according to claim 7, characterized in that: First, pre-defined inference connectors are identified through regular expressions and dependency parsing to segment inference text fragments; unmatched text is fed into a lightweight Transformer classifier to classify sentence types into three categories: premise, inference, and conclusion. Simultaneously, named entity recognition is performed on the inference node text, corresponding task step entities are associated, and a structured inference link containing trace_id, node type, text content, and sensitive entities is constructed to restore the complete logical progression relationship.

9. The adjudication method according to claim 1, characterized in that: In step S1, the memory context perceptron adopts a four-layer architecture of proxy interception, semantic compression, role labeling, and relevance calculation. The proxy interception layer injects into the intelligent agent memory module client through aspect-oriented programming Hook, non-intrusively intercepting all read, write and retrieval requests of the vector database, session memory and knowledge base, and capturing query vectors, Top-K retrieval results, set names and partition key metadata; The semantic compression layer uses the BART-small lightweight summarization model with 60M parameters to generate a single-sentence core summary of the memorized content. Only the summary data is persisted, reducing storage overhead and avoiding the risk of secondary leakage. The role labeling layer uses a fine-tuned TinyBERT / DistilBERT four-class classifier to divide the memory content into four semantic roles: factual statements, historical decisions, user preferences, and policy regulations, and matches them with differentiated adjudication weights. The relevance calculation layer determines the legality of access by the cosine similarity between the query vector and the returned result vector. If the similarity is lower than the threshold of 0.5, it is determined to be an abnormal memory access, triggering a risk warning.

10. A computer program, characterized in that: The computer program is used to execute the adjudication method according to any one of claims 1-9.

Images