Security & privacy

LSAS is built for teams that already operate in regulated environments. The implementation in this framework follows the open LSAS specification and focuses on keeping sensitive data inside your boundary while surfacing rich telemetry for audits and investigations.

Deployment options include managed sandbox evaluation, private single-tenant deployment, customer-hosted cloud/VPC deployment, and true self-hosted/on-prem rollout.

The formal spec, schemas, and technical whitepaper are published at reactlabs-dev/lsas-spec. This runtime is designed to be a reference implementation of that work.

Data handling

  • Derived-only telemetry: no raw prompts or completions by default.
  • Explicit tenant/app IDs and environments for all events.
  • Postgres as the system of record, under your control and network boundary.
  • Optional redaction of PHI/PII before storage, driven by policy packs and validators.
PHI-focused governance visualization

Controls & observability

  • Configurable policy packs per app/tenant, mapped to LSAS risk domains.
  • Deterministic validators for PHI/PII, PCI, security, and accessibility (including a HIPAA_PHI domain).
  • Decision logging with risk scores, rule hits, and remediation actions.
  • Structured decision and incident telemetry that you can pipe into incident creation, case management, and downstream SIEM tooling.

Current hardening highlights

  • Strict ingest validation and request-size boundaries for Discovery Scan payloads.
  • Run lifecycle guardrails and retry-safe ingest semantics for resilient operations.
  • Tenant-level provider and resilience policy controls for upstream model calls.
  • Connector-boundary governance controls for healthcare FHIR/OAuth ingress and governed egress release.
  • Gateway metrics endpoint with request and upstream resilience counters.
  • Role-based authorization for high-risk tenant mutations (members, policies, onboarding, keys, and workflow operations).
  • API key lifecycle hardening with one-time reveal, explicit revoke, audit trails, and conflict-safe version checks.
  • Session lifecycle hardening with centralized issuance, concurrent-session limits, and password-reset invalidation.

Regulated workloads

  • HIPAA/PHI: PHI/PII validators plus a HIPAA PHI baseline policy pack to support minimum-necessary access, derived-only telemetry, and clear tenant IDs.
  • Healthcare interoperability boundaries: governed ingress/egress around system-of-record APIs with runtime evidence.
  • Clinical decision support: separating model output from the final clinical decision.
  • PCI and financial data: pattern-based detection for card data and sensitive numbers.
  • Internal-only vs outward-facing flows: different policy packs per surface.

Further reading

LSAS is not a substitute for legal or compliance advice, but it is designed to make it easier to implement the controls your programs require.

  • HIPAA guidance on uses and disclosures of PHI (U.S. HHS).
  • FDA discussion papers on AI/ML-based software as a medical device (SaMD).
  • Your organization's internal security, privacy, and governance standards.