Multi-dimensional controlled gateway method and system for ai agents and computer readable storage medium

Abstract

The application discloses a kind of multi-dimensional controlled gateway methods, systems and computer readable storage medium for AI agent.The multi-dimensional controlled gateway method is in the unified gateway checkpoint, deploy six interactive security subplanes, including controlled partition plane, intent filtering plane, illusion fuse plane, capability supply plane, content security plane and compliance audit plane.Six planes share the same AI call context information, link according to preset decision order Determination, avoid the vulnerability and strategy drift caused by the isolation of each security mechanism in traditional system.The multi-dimensional controlled gateway method for AI agent of the application is based on the security architecture of "six-plane linkage", realizes the physical isolation, intent filtering, illusion fuse, capability dynamic supply, content security check and complete compliance audit to the whole process of AI agent call, guarantees AI call security, improves business continuity and compliance management level.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence applications, specifically to a multi-dimensional controlled gateway method, system, and computer-readable storage medium for AI agents, aiming to achieve comprehensive secure control and trusted access to enterprise resources by AI agents. Background Technology

[0002] With the rapid development of artificial intelligence technology, more and more AI agents are being applied to various scenarios such as enterprise business process automation, data analysis, and content generation.

[0003] With the widespread deployment of AI agents driven by large language models in enterprise production environments, AI's access to enterprise capabilities faces unprecedented multi-dimensional risks: architectural layer risks (AI directly accessing underlying databases), intent layer risks (AI attempting to call unauthorized capabilities), behavioral layer risks (AI making biased calls due to hallucinations), content layer risks (Prompt injection and PII leakage), resource layer risks (AI consuming over-budget resources out of control), and compliance layer risks (AI operations cannot be traced afterward). The following sections categorize and describe six mainstream existing technologies and their inherent defects.

[0004] API gateways and traffic control solutions are represented by various API gateway products (such as Kong and APISIX). These gateways focus on HTTP layer traffic distribution, rate limiting, authentication, and monitoring. Their technical limitations include the following: First, API gateways operate at the protocol layer rather than the semantic layer, only identifying "which interface was called," not "what intent the AI ​​is trying to achieve."

[0005] Second, the rate limiting strategy is based on shallow features such as client identifiers and interface paths, and lacks a deep judgment on the "match between the intent of AI output and the enterprise's list of controllable capabilities".

[0006] Third, it has no ability to recognize AI illusions. When AI generates a syntactically correct but semantically incorrect call, the API gateway can only forward the request, causing downstream errors.

[0007] Fourth, it has no ability to block AI from directly accessing the underlying database and other behaviors that "bypass the execution chain".

[0008] Fifth, it lacks support for content security needs unique to the AI ​​era, such as Prompt injection and PII cross-border desensitization.

[0009] Large-scale model function calling tools are represented by implementations such as OpenAI FunctionCalling, Anthropic Tool Use, and various agent frameworks (LangChain, AutoGen). These technologies directly generate tool call requests and pass parameters through the AI ​​model. Their technical limitations include the following: First, the tool description and invocation determination are coupled during the model inference process, making it impossible to perform fine-grained runtime trimming of the "model-visible tool list" on the enterprise side.

[0010] Second, there is a lack of assessment of the "illusion" of the model's output. The model may invoke a tool that exists in the description but is actually offline, or invoke a tool that seems reasonable but whose parameters are completely fabricated.

[0011] Third, there is a lack of coordination with the enterprise state machine. AI may initiate calls to objects that the current state machine does not allow for transitions, leading to downstream errors.

[0012] Fourth, token measurement is scattered across various Agent frameworks, making it impossible to achieve unified quota management across multiple dimensions of tenants / Agents / capabilities.

[0013] Fifth, there is a lack of a unified compliance audit and data collection mechanism. AI call records are scattered across various agent implementations, making it impossible to form a complete chain of evidence.

[0014] Rule-based content security filtering encompasses various content moderation products. This type of technology performs sensitive word filtering, PII recognition, and Prompt injection detection on the text content input and output by AI. Its technical limitations include the following: First, it operates at the content text layer and has no control over "what capabilities AI uses to do what".

[0015] Second, the filtering rules are static rule sets, lacking awareness of the specific business context of the enterprise.

[0016] Third, it is deployed independently of other mechanisms such as intent filtering, capacity supply, quota management, and state machine coordination, lacking a unified checkpoint.

[0017] Fourth, it cannot identify deep-seated errors such as "AI calling a capability in the list but passing in parameters that violate business rules".

[0018] Fifth, there is a lack of a circuit breaker mechanism. Even if content risks are detected, the filter can only block a single call and cannot systematically trigger a circuit breaker for multiple consecutive violations.

[0019] Resource management for model inference services implements functions such as rate limiting, billing, and quota management for various model inference service platforms. Its technical shortcomings include the following: First, resource management is decoupled from business semantics. Quotas are allocated solely based on technical metrics such as the number of tokens and the number of calls, making it impossible to perform fine-grained allocation based on business semantics.

[0020] Second, the quota system is too simplistic. It typically limits traffic based on only the user or API key, lacking fine-grained control over multiple dimensions such as tenant, agent, and capability.

[0021] Third, it fails to recognize "semantic repetition". When the same user asks the same question multiple times, it triggers a complete inference each time, lacking semantic caching capabilities.

[0022] AI agents directly calling enterprise interfaces represent practices such as the simple integration of large language models with enterprise systems. AI agents execute business operations directly through function or tool calls. However, their technical limitations include the following: First, AI agents can invoke any exposed capabilities without the system's awareness, and there is a lack of controlled mapping between "AI invocation and capability exposure".

[0023] Second, AI may bypass the instruction gateway to directly read and write databases or execute code, lacking the constraint of a "physical isolation layer".

[0024] Third, there is no bias assessment between the AI ​​output calls and the enterprise's capability list. Illusory calls generated by AI due to model version changes and context drift are directly passed downstream.

[0025] Fourth, there is no difference in auditing between AI call chains and human user call chains.

[0026] Independent AI security products include various AI security products (such as Prompt injection detection tools, AI firewalls, and model security assessment platforms). Their technical shortcomings include the following: First, it focuses on single-point protection rather than comprehensive, interconnected solutions. Most existing AI security products are independent components (such as those that only perform prompt injection detection), lacking integration with other dimensions such as intent filtering, illusion circuit breaking, capability provisioning, and compliance auditing.

[0027] Second, it is text-level rather than business semantic level. Prompt injection detection is usually based on text pattern matching, which does not understand the semantics of "what operation the AI ​​is trying to perform on which business object", resulting in a high false positive rate and a high false negative rate.

[0028] Third, there is no integration with enterprise state machines / rule engines. Security products only perform "content compliance" but not "business compliance" (such as state machine conflict detection), and cannot achieve "pre-emptive hard enforcement" interception.

[0029] Fourth, there is no unified audit record. Security incidents are scattered across various products and cannot be linked to business calls, making it impossible to support retrospective queries such as "given a business object, view all its historical AI call records and judgment results".

[0030] Traditional security control systems struggle to meet the complex and dynamic invocation needs of AI agents, primarily due to the following issues: 1) AI agents directly accessing the underlying database or executing code poses a high security risk; various security mechanisms are deployed independently, lacking unified scheduling and collaborative control, which can easily lead to policy conflicts or omissions in judgment. 2) It is impossible to effectively verify the calling intent of AI agents in advance, and often relies on post-event auditing, resulting in lagging security protection; there is a lack of quantitative assessment and automatic circuit breaker mechanism for the "illusion" situation of AI output; 3) Capability exposure and access permissions are difficult to adjust dynamically, posing a risk of over-authorization; resource consumption lacks multi-dimensional quota restrictions and refined budget management, etc.

[0031] Therefore, existing technologies cannot meet the secure, efficient, and compliant access control requirements of enterprise-level AI agents. Summary of the Invention

[0032] The purpose of this invention is to provide a multi-dimensional controlled gateway method for AI intelligent agents. Based on a "six-plane linkage" security architecture, it achieves physical isolation, intent filtering, illusion circuit breaking, dynamic capability provisioning, content security checks, and complete compliance auditing throughout the entire process of AI intelligent agent invocation, thereby ensuring the security of AI invocation and improving business continuity and compliance management.

[0033] Another objective of this invention is to provide a system and computer-readable storage medium for the aforementioned multi-dimensional controlled gateway for AI agents, aiming to achieve comprehensive secure control and trusted access to enterprise resources by AI agents.

[0034] To achieve the above objectives, this invention proposes a multi-dimensional controlled gateway method for AI intelligent agents, comprising the following steps: S1, Controlled Isolation: Receives the original request from the AI ​​agent, performs a mandatory check of the AI ​​constraint rules, which include at least prohibiting direct access to the database, prohibiting the execution of unregistered code, and prohibiting bypassing gateway instructions; if the check passes, the original request is transformed into a structured call contract containing intent, parameters, executor, and metadata, and requests that do not conform to the AI ​​constraint rules are blocked. S2, Intent Filtering and State Machine Collaboration: Receive the structured invocation contract, extract the AI ​​invocation intent, match the AI ​​invocation intent with a predefined list of controlled capabilities, and check the authorization of the AI ​​agent; the core determination step is: query the current state machine state of the target business object and its allowed transition set; if the transition operation indicated by the AI ​​invocation intent is not within the allowed transition set, it is determined to be a state machine conflict and the invocation is immediately blocked; if all determinations are passed, the subsequent steps continue. S3, Illusion Circuit Breaker: For AI call requests that pass the intent filtering, the illusion degree is evaluated in parallel from three dimensions: capability existence, parameter rationality, and semantic deviation, and a comprehensive illusion score is calculated; based on the comprehensive illusion score and a preset threshold, the transition of the circuit breaker state machine between the closed, open, and half-open states is controlled to circuit breaker calls with high illusion risk. S4, Capability Supply and Content Security: For requests that pass through the illusion circuit breaker, dynamically trim the list of capabilities that can be invoked based on the AI ​​agent's identity, tenant, and business context, and perform injection attack detection and sensitive information desensitization processing on the invocation requests; S5, Compliance Audit: Records and archives all successful or blocked call events across the entire process, forming an unalterable audit record.

[0035] Furthermore, in step S1, the AI ​​constraint rules also include prohibiting direct writing to the database and requiring the use of structured contracts; the mandatory detection is performed by a direct access detector, which includes at least one or more of SQL pattern detection, DB endpoint detection, code block detection, Shell execution detection, and eval pattern detection.

[0036] Furthermore, in step S2, before the state machine conflict determination, there are also sequentially executed capability list matching, Agent authorization check and compliance policy check; the state machine conflict determination is the core determination node. Once a conflict is determined, the subsequent determination process is immediately terminated and the process enters the degradation processing module. The degradation processing module provides three-level paths: cache rollback, human intervention and rejection response.

[0037] Furthermore, in step S3, the capability existence assessment is to compare the invoked capability identifier with the currently visible subset of capabilities; the parameter rationality assessment is to compare the type, value range, and dependency relationship of the parameters with the capability schema; the semantic deviation assessment is to calculate the cosine distance between the original prompt embedding vector and the capability description embedding vector; and the calculation weight of the comprehensive illusion score is a dynamic weight, which is adjusted according to the historical performance of the AI ​​agent, business context, or capability type.

[0038] Furthermore, in step S3, the transition rules of the circuit breaker state machine are as follows: when the comprehensive illusion score exceeds the first threshold, it transitions from the closed state to the open state; after a preset cooling period in the open state, it transitions to the half-open state; in the half-open state, if the illusion score of the trial call request is lower than the second threshold, it transitions back to the closed state; otherwise, it transitions back to the open state.

[0039] In addition, this invention also discloses a multi-dimensional controlled gateway system for AI intelligent agents, comprising: Controlled partition plane module: Used to receive the original requests from the AI ​​agent, perform mandatory checks on the AI ​​constraint law, convert the approved requests into a structured call contract, and block illegal requests; Intent Filtering Plane Module: Connected to the Controlled Isolation Plane Module, it is used to receive structured call contracts, extract AI intents and match them with the controlled capability list, and check authorization. Its core includes a state machine engine, which is used to query the state of the target business object and detect whether the AI ​​intent conflicts with the set of allowed transitions of the state machine. If there is a conflict, the call is blocked. Illusion Circuit Breaker Module: Connected to the Intent Filtering Module, it is used to evaluate the illusion of AI call requests from three sub-dimensions: capability existence, parameter rationality, and semantic deviation. Based on the comprehensive score, it drives a circuit breaker state machine to control request release in three states: closed, open, and half-open. Capability Supply Plane Module: Connected to the Illusion Fuse Plane Module, used to dynamically trim and output a list of capabilities visible to the AI ​​agent; Content security plane module: connected to the capability supply plane module, used for injection attack detection and data desensitization of call requests; Compliance audit plane module: Connects to all the aforementioned plane modules, and is used to record all call events throughout the entire process and store them in an immutable storage medium; Support Module Layer: The core plane, including the Controlled Isolation Plane Module, Intent Filtering Plane Module, Illusion Circuit Breaker Plane Module, Capability Supply Plane Module, Content Security Plane Module, and Compliance Audit Plane Module, provides multi-dimensional token quota management, semantic caching, and degradation processing services.

[0040] Furthermore, the controlled partition plane module further includes a direct access detector and a contract converter; the direct access detector is used to detect whether the original request contains direct database operations, code execution, or system command execution modes; the contract converter is used to convert the compliant original request into a structured call contract containing execution instructions, parameters, executor information, and metadata, and to verify the integrity of the contract.

[0041] Furthermore, the intent filtering plane module includes an intent extractor, a capability list matcher, an agent authorization checker, a state machine conflict detector, and a compliance policy checker connected in sequence. The state machine conflict detector is linked with an external baseline state machine component. By querying the current state of the target business object and the allowed transition set, when the transition operation indicated by the AI ​​agent's intent is not within the allowed transition set, it generates a state machine conflict determination result and triggers a blocking action.

[0042] Furthermore, the illusion circuit breaker module includes a three-dimensional evaluator and a comprehensive scorer; the three-dimensional evaluator includes a capability existence evaluator, a parameter rationality evaluator, and a semantic deviation evaluator, which are used to calculate the illusion score of the corresponding sub-dimension; the comprehensive scorer is used to calculate the comprehensive illusion score based on dynamic weights; the circuit breaker state machine transitions between closed, open, and half-open states based on the comprehensive illusion score, and accordingly allows or rejects subsequent requests.

[0043] Furthermore, the present invention also discloses a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method of a multidimensional controlled gateway for AI agents as described above.

[0044] By employing the above technical solution, the present invention has the following significant technical effects: 1) This invention overcomes the shortcomings of traditional independent deployment mechanisms through a six-plane linkage and collaborative architecture, realizing unified gate management for AI access control; physical isolation + structured contracts greatly improve access security; 2) Pre-emptive hard enforcement avoids the risk of overstepping authority; quantification of illusions enables automatic control of credibility; dynamic tailoring of capacity supply minimizes exposure. 3) Unified content security de-identification strategy ensures privacy compliance; multi-dimensional quotas refine resource management; semantic caching reduces costs; end-to-end tamper-proof auditing ensures compliance traceability; multi-level degradation ensures system stability and business continuity; 4) Improve the overall efficiency and security of enterprise AI resource scheduling to meet the increasingly complex compliance requirements of AI applications. Attached Figure Description

[0045] Figure 1 The diagram shown is a schematic of the overall architecture of the AI ​​gateway six-plane linkage system; Figure 2 shows a schematic diagram of the controlled partition planar workflow; Figure 3 shows a schematic diagram of the pre-execution of the filter plane and the state machine in coordination; Figure 4 shows a schematic diagram of the three-dimensional evaluation of the illusion fracturing plane; Figure 5 shows a schematic diagram of the dynamic cutting process of capacity supply plane; Figure 6 shows a schematic diagram of a multi-dimensional content security plane inspection. Detailed Implementation

[0046] To better illustrate the present invention, the following detailed description is provided in conjunction with specific embodiments. However, these specific embodiments are merely for illustrative purposes and are not intended to limit the scope of the invention.

[0047] This invention proposes a six-plane collaborative architecture, deploying six interconnected security subplanes on a unified gateway: a controlled isolation plane, an intent filtering plane, an illusion circuit breaker plane, a capability provisioning plane, a content security plane, and a compliance audit plane. These six planes share the same AI call context information and make decisions in a pre-defined order, avoiding vulnerabilities and policy drift caused by the isolation of security mechanisms in traditional systems.

[0048] Controlled Isolation Plane (AI Constraint Ironclad Rules): Enforces hard security constraints, preventing AI agents from directly accessing the underlying database, prohibiting bypassing the gateway to directly execute code or make calls, and requiring all AI actions to be converted into structured call contracts before entering the execution chain. The call contract includes a semantic description of the call intent, target capability identifier, parameter set, caller identifier, timestamp, and prompt hash, ensuring the legality and compliance of the call.

[0049] The intent filtering plane collaborates with the state machine: Intent is extracted from AI call requests, and the extracted results are mapped to the state machine model of the target business object to verify whether the call intent conflicts with the business state. If a conflict is detected, the gateway immediately intercepts the request, ensuring that the AI ​​call operation does not exceed its authority, preventing erroneous or malicious operations, and achieving pre-emptive hard execution.

[0050] The Illusion Circuit Breaker Plane employs a three-dimensional assessment: It evaluates the illusion degree of AI-output call requests, encompassing three sub-dimensions: capability existence verification, parameter rationality verification, and semantic deviation scoring. When the overall illusion degree exceeds a set threshold, a circuit breaker mechanism is activated to prevent business risks caused by errors or false information. Circuit breaker status is managed using a sliding window at the tenant and agent levels to ensure flexibility and accuracy.

[0051] Capability supply plane dynamic trimming: The capability list serves as a declarative, trimmable, and hot-update meta-model, dynamically generating a minimum subset of capabilities based on tenant, AIAgent, and business context. This ensures that AI agents can only access capabilities relevant to their current task, achieving a least privilege model.

[0052] Content security is assessed across multiple dimensions: A unified multi-dimensional security check is performed on AI inputs and outputs, including Prompt injection detection and interception, personal identity information (PII) anonymization, and sensitive business data boundary control. When data flows across borders, sensitive fields are automatically identified and anonymized to ensure data security and privacy compliance.

[0053] Multi-dimensional Token Quota Management: Token quotas are set and combined from three dimensions: tenant level, agent level, and capability level. Exceeding the quota in any dimension will intercept calls and simultaneously report the excess event to the governance layer, facilitating refined resource management and monitoring.

[0054] Semantic caching and timeliness balance: A semantic-level caching mechanism is introduced, which uses three levels of semantic matching (intent hash, parameter hash, and context hash) to determine cache hits for AI call requests, and sets cache TTL and expiration conditions to effectively reduce the token consumption and response latency of repeated calls.

[0055] The compliance audit platform is tamper-proof and has a complete audit record for each AI call, including the original prompt, response result, call time, associated business object identifier, intent determination result, illusion score, capability supply determination, content security check, token consumption and cache hit status, and supports reverse tracing query based on business objects.

[0056] Multi-level degradation path after circuit breaker: When the circuit breaker is triggered, the first level of cache rollback, the second level of human intervention, and the third level of rejection response are executed in sequence according to the preset strategy to ensure that the system can gracefully degrade, ensure business continuity, and avoid system unavailability.

[0057] Figure 1 This paper demonstrates the overall architecture of the AI ​​gateway six-plane linkage system provided by an embodiment of the present invention. The architecture consists of three layers: 1) The top of the AI ​​Agent Layer diagram shows three typical AI agent instances: AI Agent A (Contract Review): Responsible for contract risk identification and compliance review; AI Agent B (Risk Monitoring): Responsible for real-time monitoring and early warning of business risks; AI Agent C (Customer Service Assistant): Responsible for customer service and interaction processing. All AI agents' calls to enterprise capabilities must go through the gateway; bypass channels are prohibited.

[0058] 2) Gateway Core Layer: The area within the central frame in the diagram represents the gateway core, comprising six interconnected sub-planes: ① Controlled Isolation Plane: Located at the forefront, responsible for transforming raw AI requests into structured call contracts and enforcing AI constraint rules; ② Intent Filtering Plane: Located in the second position, responsible for intent extraction and state machine collaborative determination; ③ Illusion Circuit Breaker Plane: Located in the third position, responsible for three-dimensional illusion assessment and circuit breaker management; ④ Capability Supply Plane: Located in the fourth position, responsible for dynamically tailoring the visible capability list according to multiple dimensions; ⑤ Content Security Plane: Located in the fifth position, responsible for Prompt injection detection and PII desensitization; ⑥ Compliance Audit Plane: Located at the very end, responsible for end-to-end record accumulation.

[0059] The six planes are connected by thick solid arrows, indicating the sequential transmission of judgment results. After each plane passes the judgment, a structured judgment result object is generated and passed to the next plane; if any plane determines that the judgment is blocked, the process immediately jumps to the degradation processing module.

[0060] The boxed area in the Supporting Module Layer diagram shows three supporting modules: Multi-dimensional Token Quota: Responsible for budget management across multiple dimensions of tenants / AI agents / capabilities; Semantic Caching (Three-Layer Matching): Responsible for semantic hash matching of intent / parameters / context; Degradation Processing (Three-Level Path): Responsible for three-level degradation: cache rollback / human intervention / rejection response.

[0061] (4) The bottom box area of ​​the Enterprise Capability Execution Layer diagram shows the Enterprise Capability Execution Layer, which includes: Database: Enterprise underlying data storage; Capability Bus: Enterprise capability unified call channel; External LLM: External large language model inference service.

[0062] (5) The right-hand box area in the governance linkage component diagram shows the linkage relationship with the enterprise governance component: Baseline state machine: the intent filtering plane calls to obtain the current state of the target object; Rule engine: each plane executes policy judgment through the rule engine; Relationship graph: the relationship between the capability supply visibility reference object; Signal pipeline: the channel for the accumulation of full-link audit records; WORM storage: the storage of tamper-proof audit records; The dashed arrows in the diagram indicate the linkage relationship between the gateway and the governance component.

[0063] Corresponding technical solution module: This diagram corresponds to steps S1 and S2 in the technical solution, showing the position of the gateway in the architecture, the deployment order of the six planes, the collaborative decision-making mechanism between the planes, the cooperation relationship of the supporting modules, and the deep linkage with the enterprise governance components.

[0064] Figure 2 This illustrates the controlled partition plane workflow provided by an embodiment of the present invention. The workflow consists of five stages: (1) Input phase The area within the top frame of the diagram represents the "AI Original Request," which is the entry point into the controlled partition plane. Invocation requests initiated by the AI ​​agent first reach this plane.

[0065] (2) Declaration of the Ironclad Laws of AI Constraints The boxed area in the diagram illustrates five ironclad rules for AI constraints: ① Prohibit direct DB reading: AI agents are prohibited from directly reading the underlying database. ② Prohibit direct DB writing: AI agents are prohibited from directly writing to the underlying database. ③ Prohibit execution of unregistered code: AI agents are prohibited from executing code not registered with the gateway. ④ Prohibit bypassing the instruction gateway: AI agents are prohibited from initiating calls by bypassing this gateway. ⑤ Must use structured contracts: All AI operations must be converted into structured call contracts. These five ironclad rules serve as the physical boundary between the AI ​​logic layer and the physical execution layer.

[0066] (3) Direct access to the detector The area framed on the left in the image shows the detection content of the direct access detector: SQL Pattern Detection: Detects whether the request contains a direct SQL pattern; DB Endpoint Detection: Detects whether the request is targeted at a database endpoint; Code Block Detection: Detects whether the request contains an executable code block; Shell Execution Detection: Detects whether the request requires the execution of a shell command; eval Pattern Detection: Detects whether the request contains an eval pattern or a dynamic code loading pattern; A match in any of these checks constitutes a violation of the ironclad rule.

[0067] (4) Contract Converter The area within the right border of the image shows the output structure of the contract converter: ExecutionInstruction: intent: {verb, target, state} params: {...} actor: {id, type, delegation} metadata: {ts, trace_id, prompt_hash, signature} The contract converter refuses to accept unstructured raw HTTP requests, requiring the AI ​​agent's SDK to construct the call contract according to a specified format. The contract converter performs integrity checks on the contract, rejecting it if any required field is missing.

[0068] (5) Output Branch The bottom of the image shows two output paths: Left blocking path ( Blocking): When the direct access detector detects a violation of the ironclad rule, the call is immediately blocked, generating an audit event of type IRON_RULE_VIOLATION, which is then entered into the compliance audit plane.

[0069] The right side via path ( (Pass): After the contract converter successfully outputs a structured contract, it enters the intent filtering plane for further judgment. The dashed arrows in the diagram indicate that both paths will eventually accumulate audit records in the compliance audit plane.

[0070] Corresponding technical solution module: This figure corresponds to step S3 in the technical solution, showing the AI ​​constraint law of the controlled partition plane, the direct access detection mechanism, the output structure of the contract converter, and the decision path for blocking and passing.

[0071] Figure 3 This invention demonstrates a pre-execution mechanism that combines an intent filtering plane with a state machine. This mechanism utilizes five sequencers and a state machine engine to work together to detect conflicts between AI intents and the target business object's state machine.

[0072] (1) Input phase: Structured call contract; The left side of the diagram shows the input node (rounded rectangle): 3-01 Structured Call Contract (from the controlled partition plane): The output from the controlled partition plane contains structured information such as AI invocation intent, target capability identifier, and parameter set, which serves as the starting point for the input of the intent filtering plane.

[0073] (2) Five Sequence Determiners The diagram shows five sequence determiners (rounded rectangles arranged horizontally): ①Intent Extractor Position: First decision unit; Function: Extract the AI's invocation intent from the structured invocation contract; Output: A semantic description of the AI's intent (verb + target + state).

[0074] ② Capability List Matcher Position: Second decision-maker; Function: Maps AI intents to a controlled capability list; Output: A set of matching capability identifiers.

[0075] ③Agent Authorization Check Position: 3rd decision setter; Function: Checks whether the AI ​​Agent is authorized to execute this capability; Output: Authorization granted / denied.

[0076] ④ State Machine Conflict Detection ★Core★ Location: 4th decision maker (marked with a thick red box); Function: Detects whether the AI ​​intent conflicts with the current state machine state of the target business object; Importance: Marked with a thick red border to emphasize core decision nodes; Output: State machine conflict determination result (pass / conflict).

[0077] ⑤ Compliance Strategy Checker Position: 5th decision set; Function: Check whether AI calls violate corporate compliance policies; Output: Compliant / Violated

[0078] (3) Output stage The right side of the diagram shows two output nodes: Left-side blocking path (blocking path): 3-06 Block STATE_MACHINE_CONFLICT → Degrade: Human intervention: When state machine conflict detection fails, the call is immediately blocked, and a fallback path is initiated to notify human participants to intervene.

[0079] The path on the right (via path): 3-07 → Enter the Illusionary Fuse Plane: When all five decision-makers pass, proceed to the next plane (the illusion melting plane) and continue the subsequent decision-making process.

[0080] (4) State Machine Engine (Query) The state machine engine module (thick-bordered rectangle) is shown at the bottom of the image: Module title: "State Machine Engine (Query)"; State Machine Engine components: 3-08 Current Status: UnderReview (Rounded Rectangle): Displays the current state machine state of the target business object; Example status: "UnderReview" (Under Review); 3-09 Allowed transition set: {approve, reject, request_modification} (rounded rectangle): Displays the set of allowed transition operations in the current state; Example sets: approve, reject, request_modification 3-10 AI attempts a leap: trigger_payment Not in the allowed set (rounded rectangle): Shows the transition operation the AI ​​attempted to perform; Example transition: "trigger_payment" (trigger payment); Result: Not in the allowed transition set (state machine conflict) (5) Typical interception scenario examples The bottom left corner of the image shows a typical interception scenario (a rectangle with thick borders): Module Title: "Typical Interception Scenarios"; Interception Scenario Details: AI Agent: payment-processor-v2; Intent: trigger_payment; Target object: invoice: / / INV-2026-089; Current status: UnderReview; Determination: STATE_MACHINE_CONFLICT; action: Immediate blocking → Human intervention.

[0081] Scene description: AI Agent: payment-processor-v2; Intent: trigger_payment (trigger payment); Target object: invoice: / / INV-2026-089 (invoice object); Current status: Under Review; Result: STATE_MACHINE_CONFLICT (State machine conflict); Processing actions: Immediately block and enter the human intervention downgrade path.

[0082] (6) Judgment process arrow The diagram shows various decision-making process arrows: Solid arrow: Normal process path: Structured Invocation Contract → ① Intent Extractor → ② Capability List Matcher → ③ Agent Authorization Check → ④ State Machine Conflict Detection → ⑤ Compliance Policy Checker → Entering the Illusionary Circuit Breaker Plane.

[0083] Thick solid arrow: Core decision path; from ③ Agent authorization check to ④ State machine conflict detection (emphasizing the core node); Blocking thick arrow: Conflict blocking path; directly jumps from ④ State machine conflict detection to the blocking node.

[0084] By arrow: via path; from ⑤ Compliance Strategy Inspector to entering the Illusionary Circuit Breaker plane.

[0085] Dashed arrow: State machine engine query path, querying the state machine engine from ④ State machine conflict detection.

[0086] (7) State machine conflict determination logic The core decision logic for state machine conflict detection: Query the current state of the target object; Query the current state machine state of the target business object from the state machine engine; Example: The current status of the invoice object is "UnderReview".

[0087] Obtain the set of allowed transitions. Based on the current state, obtain the set of allowed transition operations.

[0088] Example: The allowed transitions in the approval state are {approve, reject, request_modification}.

[0089] Compare the AI's attempted transitions by comparing the transition operations that the AI ​​attempts to perform with the set of allowed transitions; Example: AI attempts "trigger_payment", which is not in the allowed set.

[0090] If a conflict is detected and blocked, and the AI ​​attempts to make a transition that is not in the allowed set, it is determined to be a state machine conflict, the call is immediately blocked, and the process enters the degradation path (human intervention).

[0091] (8) Explanation of the pre-implementation hard enforcement mechanism The "pre-emptive hard enforcement" mechanism illustrated in this diagram includes: (1) Pre-emptive interception The judgment should be made before the AI ​​is invoked and executed, rather than after the violation is discovered through auditing. (2) Hard block When state machine conflicts occur, they are directly blocked without relying on business code for self-verification; ensuring the consistency and enforceability of interception; (3) Centralized control at the gateway layer All decisions are made centrally at the gateway layer, reducing the security responsibilities on the business side. (4) Audit traceability All intercepted events are archived to the compliance audit platform; reverse backtracking queries based on business objects are supported. The corresponding technical solution module, this figure corresponds to step S4 in the technical solution, and shows: Intent Extraction: Extracting AI intent from structured invocation contracts; Capability list matching: Mapping intents to a controlled capability list; State machine coordination: Detecting conflicts between AI intent and the target object's state machine; Pre-emptive hard execution: Preventing conflicting operations before execution; Degradation path: A degradation path that involves human intervention during a conflict.

[0092] The "④ State Machine Conflict Detection ★ Core ★" marked by the thick red box in the diagram is a key node for pre-emptive hard execution. By querying the current state of the target object and the set of allowed transitions through the state machine engine, it can intercept AI unauthorized operations in advance, thus shifting the security defense from post-event auditing to pre-event hard execution.

[0093] Figure 3 By demonstrating the collaborative working mechanism of five sequence decision makers and a state machine engine, the document clearly illustrates how the intent filtering plane achieves pre-execution hard execution. Input: A structured calling contract from the controlled partition plane; Decision-making: Five sequential decision-makers work together to make a decision (intent extraction → capability matching → authorization check → state machine conflict → compliance check); Core: State machine conflict detection (a critical node that is hard-executed beforehand); Output: Pass → Enter the illusionary fuse plane; Block → Degrade: Human intervention; This mechanism allows AI to intercept unauthorized operations before they are executed, far exceeding the protection capabilities of existing systems through post-event auditing.

[0094] Example 1 Figure 4 This displays the three-dimensional evaluation mechanism for the illusion-fractured plane. Example: Specific thresholds and window parameters: Single-call hallucination threshold: single_threshold = 0.35 (score range 0~1, exceeding this will trigger circuit breaker).

[0095] Sliding window parameters: window size = 10 (last 10 calls), cumulative threshold = 2.5 (if the sum of cumulative illusions within 10 calls is ≥2.5, then the circuit breaker will be triggered).

[0096] Cooldown period duration: cooldown_period = 30 seconds (starting from when the open state is entered).

[0097] Probe count: half_open_probe_count = 3 (only after 3 consecutive successful probe calls are allowed in the half-open state can the transition to closed be made).

[0098] Dynamic weight adjustment rules: Basic weights: w1=0.4, w2=0.4, w3=0.2.

[0099] Adjustment factor: Historical accuracy factor: If the AI ​​Agent’s accuracy is less than 80% in the last 100 calls, w3 increases by 0.1 (w1 and w2 each decrease by 0.05).

[0100] Business context factor: If the current business scenario is "financial transaction", then w2 increases by 0.1 (w1 decreases by 0.05, w3 decreases by 0.05).

[0101] Capability type factor: If the called capability is "data writing class", then w1 increases by 0.1 (w2 and w3 each decrease by 0.05).

[0102] After the weights are adjusted, they need to be normalized to ensure that the sum of the three weights is 1.

[0103] Complete calculation of the scoring example: Suppose a certain call has the following scores: capability existence score 0.10, parameter reasonableness score 0.20, and semantic deviation score 0.15.

[0104] The dynamic weights are adjusted to w1=0.45, w2=0.35, and w3=0.20.

[0105] hallucination_score = 0.45×0.10 + 0.35×0.20 + 0.20×0.15 = 0.045 +0.07 + 0.03 = 0.145.

[0106] The value is less than 0.35, so the judgment is passed.

[0107] State machine initialization and logging: Initial state: closed.

[0108] Each time a state transition occurs, an audit event record is generated: {agent_id, timestamp, from_state, to_state, trigger_reason, hallucination_score}.

[0109] In circuit breaker mode, all calls directly return the HALLUCINATION_FUSE_BLOCKED error and enter the fallback processing module ("Reject Response" in the three-level path).

[0110] Figure 4 This invention demonstrates a three-dimensional evaluation mechanism for the illusion fracturing plane provided by an embodiment of the present invention. The evaluation is divided into six levels: (1) Input phase: The top frame area in the diagram shows "AI Invocation Request (Passed Intent Filtering)", which is the entry point into the illusion circuit breaker plane. The invocation request has been judged by the preceding plane and has a structured intent.

[0111] (2) Parallel Evaluation of Three Sub-Dimensions: The three boxed areas in the figure show the three sub-dimensional evaluators in parallel: ① Capability Existence (Left Side): Compare the invoked capability identifier with the visible capability subset; detect whether the capability is in the current supply list; detect whether the capability is offline or the version is incompatible; Score Example: 0.10 (Low Illusion).

[0112] ② Parameter rationality (medium): Compare the parameter type with the capability schema; check if the parameter value is within the declared value range; check if the parameter dependency is satisfied; check if the enumeration field value is valid; Score example: 0.20 (medium illusion).

[0113] ③ Semantic Bias (Right Side): NL Embedding vs Capability Description Embedding; Calculate the cosine distance between the original Prompt embedding vector and the capability description embedding vector; Calculate the semantic distance between the parametric embedding and the declared embedding; Score Example: 0.15 (Low Illusion).

[0114] (3) Comprehensive Scorer: The calculation formula for the comprehensive scorer is shown in the central frame area of ​​the diagram: hallucination_score = w1×0.10 + w2×0.20 + w3×0.15= 0.15 (dynamic weights w1=0.4, w2=0.4, w3=0.2).

[0115] Dynamic weights can be dynamically adjusted based on factors such as the AI ​​Agent's historical performance, current business context, and capability type.

[0116] (4) Fuse state machine: The bottom of the diagram shows the three states of the fuse state machine: `closed` (Closed / Normal Release): An ellipse indicates that the AI ​​Agent is in a normal state, and calls are allowed normally. `open` (Open / Full Circuit Breaker): An ellipse indicates that the AI ​​Agent is in a circuit breaker state, and all calls are rejected during the cooldown period. `half_open` (Half-Open / Trial Recovery): An ellipse indicates that the AI ​​Agent is in a trial recovery state after the cooldown period, allowing a small number of trial calls.

[0117] (5) The arrows in the state transition rule diagram show the state transition rules: closed → open (exceeding threshold): When the illusion level exceeds the threshold in a single call or the cumulative high illusion level in multiple calls within the sliding window exceeds the window threshold, the window transitions from the closed state to the open state.

[0118] open → half_open (cooldown period ends): When the fuse cooldown period ends, the fuse transitions from the open state to the half_open state.

[0119] half_open → closed (trial passed): When all illusions of the trial call pass the threshold check, the process transitions from the half_open state to the closed state.

[0120] half_open → open (failed again): When the probing call again finds a high illusion degree, return from the half_open state to the open state.

[0121] Corresponding technical solution module: This diagram corresponds to step S5 in the technical solution, showing the evaluation content of the three sub-dimensions of illusion degree, the weight calculation of the comprehensive scorer, the three states of the circuit breaker state machine, and the state transition rules.

[0122] Example 2 Figure 5 This displays the dynamic trimming process of the capacity supply plane. Example: The specific implementation rules and examples of six-level filtering: Tenant visibility filtering: The `tenants` field in the capability metamodel is a string array, such as `["tenant_A", "tenant_B"]`. Capabilities are retained only if the current tenant ID is contained in this array. Example: The current tenant is `tenant_A`, and 80 out of the initial 200 capabilities contain `tenant_A`, so 80 are retained.

[0123] Role-based visibility filtering: The `ai_agent_roles` field is an array of role names, such as `["contract_reviewer", "risk_monitor"]`. Only AI Agent role names that match are retained. Example: The current Agent role is `contract_reviewer`, and 40 out of 80 match, so 40 are retained.

[0124] Disable role exclusion: The `forbidden_roles` field is a blacklist of roles, such as `["admin"]`. If the Agent role is in the blacklist, this capability will be excluded. Example: If the role is not in the blacklist, exclude 5 out of 40, keeping 35.

[0125] Context-based filtering: `context_conditions` are conditional expressions, such as `object_state_in: ["draft", "pending_review"]`, which requires the current business object state (such as contract state) to belong to this list. Example: The current contract state is "draft," and 20 out of 35 conditions match; keep 20.

[0126] Disable object state exclusion: `forbidden_object_states` is a blacklist of states, such as `["archived"]`. If an object state is on the blacklist, it will be excluded. Example: The current state is not on the blacklist, so 2 out of 20 are excluded, keeping 18.

[0127] Exclusion of prohibited combinations: `forbidden_combination` specifies the combination of capability IDs that are prohibited from being called simultaneously, such as `[["cap_001", "cap_002"], ["cap_003", "cap_004"]]`. If the current Agent has called `cap_001` within the sliding time window (e.g., the last 30 seconds), then `cap_002` is excluded. Example: `cap_001` has been called; out of 18, `cap_002` is excluded (6 of which involve prohibited combinations), leaving 12.

[0128] Hot update mechanism: The capability metamodel supports runtime hot updates, pushing changes in real time through a configuration center (such as etcd / Consul). After the gateway detects a capability metamodel update event, it updates the capability cache in memory without restarting the gateway process. Hot update effective time: <100ms (based on atomic replacement of in-memory hash table).

[0129] Update log: Each hot update generates an audit event {capability_id, old_visibility, new_visibility, timestamp}, which is stored in the compliance audit plane.

[0130] Example of capability meta-model fields: { "capability_id": "cap_contract_analyze", "version": "2.1.0", "description": "Intelligent analysis of contract terms", "param_schema": "{ \"contract_id\": \"string\", \"analysis_type\": \"enum[risk, compliance, summary]\"}", "visibility": { "tenants": ["tenant_A", "tenant_B"], "ai_agent_roles": ["contract_reviewer", "legal_advisor"], "forbidden_roles": ["guest"], "context_conditions": { "object_state_in": ["draft", "pending_review"]}, "forbidden_object_states": ["archived", "deleted"], "forbidden_combination": [["cap_contract_analyze", "cap_contract_write"]]}, "cost_profile": { "tokens_per_call": 500, "max_concurrency": 10}, "hot_reloadable": true} `hot_reloadable=true` indicates that this capability allows hot reloading at runtime; if set to `false`, the gateway needs to be restarted.

[0131] Response of the capability determination branch: If the called capability identifier is not in the final visible subset, return error code CAPABILITY_NOT_IN_VISIBLE_SET (HTTP 403) and attach the current visible capability list for upstream debugging.

[0132] Degradation process: If it is a critical business operation, a "human intervention" degradation path can be triggered, which can be temporarily invoked by the administrator through manual authorization.

[0133] Figure 5 This demonstrates the capability supply planar dynamic clipping process provided by an embodiment of the present invention. The process consists of seven steps: (1) Input phase: The top frame area in the figure shows "All registered capabilities (N=200)", which is the initial input of the capability supply plane. The company has registered a total of 200 capabilities, and all capabilities need to be dynamically pruned by the supply plane.

[0134] (2) Six-level filtering process: The area within the box in the diagram shows the six-level filtering process. Each level of filtering reduces the number of visible capabilities. ① Tenant visibility filtering: matching the tenants field; reduced from 200 capabilities to 80 capabilities; ② Role visibility filtering: ai_agent_roles matching; reduced from 80 abilities to 40 abilities; ③ Disable role exclusion: forbidden_roles excludes roles; reduces the number of abilities from 40 to 35. ④ Contextual condition filtering: object_state_in matching (such as the current business object state); reduced from 35 capabilities to 20 capabilities.

[0135] ⑤ Disable object state exclusion: forbidden_object_states; reduces the number of capabilities from 20 to 18.

[0136] ⑥ Disable combination exclusion: forbidden_combination exclusion (such as when combined with recently invoked capabilities to form a prohibited combination); reduced from 18 capabilities to 12 capabilities.

[0137] (3) Final Visible Capability Subset: The bottom box area in the figure shows "⑦ Final Visible Capability Subset (N=12, Minimum Permission)", which is the final list of visible capabilities generated after six levels of filtering. Each AI Agent can only see the minimum capability subset related to its current task at each invocation time.

[0138] (4) Ability Judgment Branch: The diamond shape in the diagram shows the judgment of "Is the ability identifier in the subset?": Yes (through the path on the left): Allowed to enter the content security plane; No (right-side blocking path): Deny,CAPABILITY_NOT_IN_VISIBLE_SET; (5) Capability Meta-Model Fields: The area within the left border of the diagram shows the field structure of the capability meta-model: capability_id, version, description, param_schema visibility:{tenants, ai_agent_roles, forbidden_roles, context_conditions, forbidden_object_states, forbidden_combination} cost_profile, hot_reloadable=true The capability meta-model declares the visibility scope of each capability, supports runtime hot updates, and does not require restarting the gateway.

[0139] Corresponding technical solution module: This diagram corresponds to step S6 in the technical solution, showing the six-level filtering process of the capability supply plane, the capability reduction amount at each level of filtering, the generation of the final visible capability subset, the field structure of the capability meta-model, and the branch path of capability determination.

[0140] Example 3 Figure 6 This displays the multi-dimensional inspection process for content security. Example: Specific rules and examples for Prompt injection detection: Detection pattern library (regular expression example): Role-based privilege escalation injection: / ignore\s+previous\s+instructions|you\s+are\s+now\s+an?\s+(admin|root|superuser) / i; Constraint bypass injection: / do\s+not\s+follow\s+the\s+rules|ignore\s+the\s+gateway|directly\s+access\s+(db|database) / i Data leak inducement: / output\s+(all|every|full)\s+(customer|user|employee)\s+(data|info|records) / i; Multilingual obfuscation injection: / \\x[0-9a-f]{2}|%[0-9a-f]{2}| <script>|eval\( / i（检测编码或脚本标签）；检测流程：对Prompt文本（包含参数中的字符串字段）依次匹配上述正则，若任一匹配则判定为注入，阻断并标记Agent安全观察（security_watch计数+1）。

[0141] 安全观察阈值：若同一Agent在1小时内被标记>=3次，则自动冻结该Agent调用权限，需管理员手动解冻。

[0142] PII脱敏的具体算法：敏感字段模式库（基于正则+上下文规则）：手机号：1[3-9]\d{9}，脱敏为\1\2（保留前3后4，中间4位掩码）。示例：13812341234 → 1381234。

[0143] 身份证号：\d{18}|\d{17}X，脱敏为\1\2（保留前6后4，中间8位掩码）。示例：110101199001011234 → 1101011234。

[0144] 合同条款：匹配"合同编号”"合同金额”等关键词后的数值，脱敏为[模糊范围]，例如原金额"500000元” → "50万~100万元”。

[0145] 财务数据：匹配"银行账号”"交易金额”等，脱敏规则同手机号（掩码中段）。

[0146] 脱敏触发判定：通过"目的地是否离开企业边界”判定，即检查调用目标域是否在内部域白名单中（如内部API域名列表）。若不在，则判定为跨境调用，触发自动脱敏。

[0147] 脱敏映射记录：生成脱敏映射表，例如{original: "13812341234", masked: "1381234", timestamp: ..., agent_id: ..., trace_id: ...}，使用AES-256加密存储于内部审计数据库，仅授权审计员可反查。

[0148] 敏感数据边界检查策略：数据分类等级：定义三级分类：L1（公开）：可无条件处理。

[0149] L2（内部）：需验证租户隔离。

[0150] L3（机密）：需同时验证租户隔离、时间窗口、跨境策略。

[0151] 租户隔离：检查数据标签（如tenant_id字段）是否与当前Agent所属租户一致，不一致则拒绝。

[0152] 时间窗口：可配置的工作时间区间，例如Mon-Fri 09:00-18:00，若当前时间不在窗口内，则L3数据拒绝处理。

[0153] 跨境策略：若目的地IP属于境外（基于IP地理数据库），则L2及以上数据拒绝；若为L1数据，仅允许脱敏后传输。

[0154] 边界违规返回错误码DATA_BOUNDARY_VIOLATION（HTTP 403），并附带违规详情（如"数据等级L3不允许跨境传输”）。

[0155] 典型跨境脱敏场景的完整数据流原始Prompt："查询客户张三、手机号13812341234、身份证号110101199001011234的最新订单金额”。

[0156] 经Prompt注入检测：通过。

[0157] 目的地判定：外部LLM服务（域名api.openai.com） → 离开企业边界 → 触发PII脱敏。

[0158] 脱敏后Prompt："查询客户[匿名标识]、手机号1381234、身份证号1101011234的最新订单金额[模糊范围]”。

[0159] 脱敏映射加密存储，外部LLM仅接收脱敏版本。

[0160] 敏感数据边界检查：脱敏后的数据已被泛化，视为L1等级，跨境策略允许通过。

[0161] 最终进入配额管理模块，完成调用。

[0162] 另外，图6展示了本发明实施例提供的内容安全平面多维度检查流程。该流程分为三个子模块：(1) 输入阶段图中顶部框线区域展示"AI调用契约+目的地(来自能力供给平面)",这是进入内容安全平面的入口点。调用契约包含结构化的调用信息,目的地标识调用是否离开企业边界。

[0163] (2) Prompt 注入检测器：图中左侧框线区域展示①Prompt 注入检测器：检测四类注入模式：角色越权注入:试图让 AI 扮演更高权限角色；约束绕过注入:试图让 AI 直接执行被禁止的操作；数据泄露诱导:试图让 AI 输出敏感信息；多语言混淆注入：使用编码字符等方式绕过文本检测。输出路径:阻断 + 标记 Agent 安全观察；输出路径:无注入,进入 PII 脱敏器。

[0164] (3) PII 脱敏器：图中中部框线区域展示②PII 脱敏器：脱敏字段类型:手机号:按敏感字段模式库识别；身份证号:按敏感字段模式库识别；合同条款:敏感合同条款识别；财务数据:敏感财务数据识别。

[0165] 脱敏触发判定(菱形)：目的地是否离开企业边界?否(左侧):内部调用,不脱敏；是(右侧):跨境调用,触发自动脱敏；脱敏操作(右侧):跨境调用触发自动脱敏；脱敏记录(右侧):脱敏映射加密记录,内部审计可反查。

[0166] 4)敏感数据边界检查器：图中底部框线区域展示③敏感数据边界检查：检查维度:数据分类:数据敏感等级判定；租户隔离:数据仅允许特定租户访问；时间窗口:某些数据仅允许在工作时间内被 AI 处理；跨境策略:某些高敏数据不允许跨境传输；输出路径:DATA_BOUNDARY_VIOLATION → 拒绝；输出路径:全部通过 → 配额管理模块；(5) 典型脱敏场景：图中展示了典型的跨境调用 PII 自动脱敏场景：原始数据：客户姓名：手机号 13812341234；身份证号 110101199001011234；最近订单金额；脱敏后数据:客户姓名→匿名标识；手机号→1381234(中段掩码)；身份证号→1101234(中段掩码)；合同金额→模糊范围；外部模型仅接收脱敏后版本,脱敏映射关系被加密记录于内部审计存储。

[0167] 对应技术方案模块:该图对应技术方案中的步骤 S7,展示了内容安全平面的三个子模块(Prompt 注入检测、PII 脱敏、敏感数据边界检查)、每个子模块的检测内容、以及典型的跨境调用 PII 自动脱敏场景。

[0168] 以上所述，仅是本发明的较佳实施例而已，并非对本发明作任何形式上的限制，故凡是未脱离本发明技术方案内容，依据本发明的技术实质对以上实施例所作的任何简单修改、等同变化与修饰，均仍属于本发明技术方案的范围内。< / script>

Claims

1. A multi-dimensional controlled gateway method for AI intelligent agents, characterized in that, Includes the following steps: S1, Controlled Isolation: Receives the original request from the AI ​​agent, performs a mandatory check of the AI ​​constraint rules, which include at least prohibiting direct access to the database, prohibiting the execution of unregistered code, and prohibiting bypassing gateway instructions; if the check passes, the original request is transformed into a structured call contract containing intent, parameters, executor, and metadata, and requests that do not conform to the AI ​​constraint rules are blocked. S2, Intent Filtering and State Machine Collaboration: Receive the structured invocation contract, extract the AI ​​invocation intent, match the AI ​​invocation intent with a predefined list of controlled capabilities, and check the authorization of the AI ​​agent; the core determination step is: query the current state machine state of the target business object and its allowed transition set; if the transition operation indicated by the AI ​​invocation intent is not within the allowed transition set, it is determined to be a state machine conflict and the invocation is immediately blocked; if all determinations are passed, the subsequent steps continue. S3, Illusion Circuit Breaker: For AI call requests that pass the intent filtering, the illusion degree is evaluated in parallel from three dimensions: capability existence, parameter rationality, and semantic deviation, and a comprehensive illusion score is calculated; based on the comprehensive illusion score and a preset threshold, the transition of the circuit breaker state machine between the closed, open, and half-open states is controlled to circuit breaker calls with high illusion risk. S4, Capability Supply and Content Security: For requests that pass through the illusion circuit breaker, dynamically trim the list of capabilities that can be invoked based on the AI ​​agent's identity, tenant, and business context, and perform injection attack detection and sensitive information desensitization processing on the invocation requests; S5, Compliance Audit: Records and archives all successful or blocked call events across the entire process, forming an unalterable audit record.

2. The method according to claim 1, characterized in that: In step S1, the AI ​​constraint rules also include prohibiting direct writing to the database and requiring the use of structured contracts; the mandatory detection is performed by a direct access detector, which includes at least one or more of the following: SQL pattern detection, DB endpoint detection, code block detection, Shell execution detection, and eval pattern detection.

3. The method according to claim 1, characterized in that: In step S2, before the state machine conflict determination, there are also sequentially executed capability list matching, Agent authorization check and compliance policy check; the state machine conflict determination is the core determination node. Once a conflict is determined, the subsequent determination process is immediately terminated and the process enters the degradation processing module. The degradation processing module provides three-level paths: cache rollback, human intervention and rejection response.

4. The method according to claim 1, characterized in that: In step S3, the capability existence assessment is to compare the invoked capability identifier with the currently visible subset of capabilities; the parameter rationality assessment is to compare the type, value range, and dependency relationship of the parameters with the capability schema; the semantic deviation assessment is to calculate the cosine distance between the original prompt embedding vector and the capability description embedding vector; the calculation weight of the comprehensive illusion score is a dynamic weight, which is adjusted according to the historical performance of the AI ​​agent, business context, or capability type.

5. The method according to claim 4, characterized in that: In step S3, the transition rules of the circuit breaker state machine are as follows: when the comprehensive illusion score exceeds the first threshold, it transitions from the closed state to the open state; after a preset cooling period in the open state, it transitions to the half-open state; in the half-open state, if the illusion score of the trial call request is lower than the second threshold, it transitions back to the closed state; otherwise, it transitions back to the open state.

6. A multi-dimensional controlled gateway system for AI intelligent agents, characterized in that, include: Controlled partition plane module: Used to receive the original requests from the AI ​​agent, perform mandatory checks on the AI ​​constraint law, convert the approved requests into a structured call contract, and block illegal requests; Intent Filtering Plane Module: Connected to the Controlled Isolation Plane Module, it is used to receive structured call contracts, extract AI intents and match them with the controlled capability list, and check authorization. Its core includes a state machine engine, which is used to query the state of the target business object and detect whether the AI ​​intent conflicts with the set of allowed transitions of the state machine. If there is a conflict, the call is blocked. Illusion Circuit Breaker Module: Connected to the Intent Filtering Module, it is used to evaluate the illusion of AI call requests from three sub-dimensions: capability existence, parameter rationality, and semantic deviation. Based on the comprehensive score, it drives a circuit breaker state machine to control request release in three states: closed, open, and half-open. Capability Supply Plane Module: Connected to the Illusion Fuse Plane Module, used to dynamically trim and output a list of capabilities visible to the AI ​​agent; Content security plane module: connected to the capability supply plane module, used for injection attack detection and data desensitization of call requests; Compliance audit plane module: Connects to all the aforementioned plane modules, and is used to record all call events throughout the entire process and store them in an immutable storage medium; Support Module Layer: The core plane, including the Controlled Isolation Plane Module, Intent Filtering Plane Module, Illusion Circuit Breaker Plane Module, Capability Supply Plane Module, Content Security Plane Module, and Compliance Audit Plane Module, provides multi-dimensional token quota management, semantic caching, and degradation processing services.

7. The system according to claim 6, characterized in that: The controlled partition plane module further includes a direct access detector and a contract converter; the direct access detector is used to detect whether the original request contains direct database operations, code execution, or system command execution modes; the contract converter is used to convert the compliant original request into a structured call contract containing execution instructions, parameters, executor information, and metadata, and to verify the integrity of the contract.

8. The system according to claim 6, characterized in that: The intent filtering plane module includes an intent extractor, a capability list matcher, an agent authorization checker, a state machine conflict detector, and a compliance policy checker connected in sequence. The state machine conflict detector is linked with an external baseline state machine component. By querying the current state of the target business object and the allowed transition set, when the transition operation indicated by the AI ​​agent's intent is not within the allowed transition set, it generates a state machine conflict determination result and triggers a blocking action.

9. The system according to claim 6, characterized in that: The illusion circuit breaker module includes a three-dimensional evaluator and a comprehensive scorer. The three-dimensional evaluator includes a capability existence evaluator, a parameter rationality evaluator, and a semantic deviation evaluator, which are used to calculate the illusion score of the corresponding sub-dimension. The comprehensive scorer is used to calculate the comprehensive illusion score based on dynamic weights. The circuit breaker state machine transitions between closed, open, and half-open states based on the comprehensive illusion score, and allows or rejects subsequent requests accordingly.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by the processor, it implements the method as described in any one of claims 1 to 5.

Images