# AEGIS — Asset Inventory

- **Document ID:** ARCH-04
- **Phase:** A — Problem Definition
- **Status:** Draft for review
- **Version:** 0.1
- **Date:** 2026-07-10
- **Owner:** Chief Security Architect
- **Depends on:** ARCH-01, ARCH-02, CLAUDE.md

---

## 1. Purpose

Enumerate every asset AEGIS holds, produces, transmits, or touches; classify each; and record retention, encryption, jurisdiction, and ownership. This inventory is the input to ARCH-03 (Threat Model): you cannot threat-model what you have not first inventoried.

## 2. Classification System

Five levels (from constitution and locked decisions):

| Level | Meaning | Handling summary |
|---|---|---|
| **P — Public** | Non-sensitive by design; can be published. | No confidentiality control; integrity still required. |
| **I — Internal** | Non-public but low-harm on disclosure. | Access-controlled; audit optional. |
| **C — Confidential** | Disclosure harms tenants or AEGIS. | Encrypted at rest + in transit; access-controlled; audited. |
| **R — Restricted** | Disclosure causes serious operational or regulatory harm. | As Confidential + tenant-key-scoped encryption + break-glass required for cross-tenant access. |
| **HR — Highly Restricted** | Disclosure is catastrophic (secrets, master keys, live PII of many subjects). | As Restricted + HSM/KMS-backed key hierarchy + no L3 hosted AI access + strict least-privilege + mandatory 4-eyes for any operational access. |

**Rule:** If unclear, classify **one level higher**, not one lower. Downgrading requires documented rationale and Owner approval.

## 3. Asset Categories

Organized by lifecycle stage: **ingested** → **derived** → **operational** → **model** → **identity** → **cryptographic** → **audit** → **backup** → **support** → **AEGIS-self**.

### 3.1 Ingested Assets — from customer environment into AEGIS

| ID | Asset | Class | Owner | Retention (default) | Encryption | Notes |
|---|---|---|---|---|---|---|
| AS-I-01 | Raw event payload (as received) | C-R (may contain PII, secrets) | Tenant | 90d hot / 1y warm | AES-256-GCM at rest, TLS 1.3 in transit | Preserved verbatim per F-2.2. Redaction happens in the *normalized* copy, not this one. |
| AS-I-02 | Normalized event | C | Tenant | 90d hot / 1y warm | Same as AS-I-01 | Additive; carries redaction manifest. |
| AS-I-03 | Ingest source metadata (source IP, TLS cert, forwarder version) | I-C | Tenant | With event | Same as AS-I-01 | Useful for source-integrity checks. |
| AS-I-04 | Ingest bus records (Kafka topics) | C-R | Tenant | 7d hot; then to event plane | Kafka topic-level encryption | Bus is a transient store, not a system of record. |
| AS-I-05 | Cloud audit log pulled by connector | C-R | Tenant | Same as AS-I-01 | Same as AS-I-01 | May contain principal identifiers, IPs, resource IDs. |

### 3.2 Derived Assets — produced by AEGIS from ingested data

| ID | Asset | Class | Owner | Retention | Encryption | Notes |
|---|---|---|---|---|---|---|
| AS-D-01 | Sigma rule inventory (tenant-authored) | C | Tenant | Indefinite until deleted; versioned | AES-256-GCM at rest | Detection logic is sensitive; leak enables adversary evasion. |
| AS-D-02 | Findings (rule matches) | C-R | Tenant | 7 years default (audit-linked) | AES-256-GCM at rest | Links to evidence; may reveal targets. |
| AS-D-03 | Cases | C-R | Tenant | 7 years default | Same | Analyst work; may contain PII of subjects. |
| AS-D-04 | Incident timelines | C-R | Tenant | With case | Same | Same. |
| AS-D-05 | AI recommendations (text + rationale + citations) | C-R | Tenant | With case | Same | May quote sensitive events. |
| AS-D-06 | Statistical baselines / anomaly models (tenant-specific) | C | Tenant | Rolling window; retrainable | Same | Reveals normalcy shape → useful to adversary. |
| AS-D-07 | Case exports (signed evidence bundles) | R (contains all evidence) | Tenant + Recipient | Per export policy | Bundle signed + encrypted with recipient key | Chain-of-custody artifact. |

### 3.3 Operational Assets — configuration and runtime state

| ID | Asset | Class | Owner | Retention | Encryption | Notes |
|---|---|---|---|---|---|---|
| AS-O-01 | Tenant configuration (retention, redaction, integrations) | C | Tenant | Indefinite until deleted; versioned | AES-256-GCM at rest | Config changes are audited (F-X.8). |
| AS-O-02 | Integration connection settings (endpoints, cert refs) | R | Tenant | Indefinite | HR key store for secret parts | Split: non-secret settings vs. secret references. |
| AS-O-03 | Policy definitions (routing, classification rules, AI-tier gates) | C-R | Tenant + Platform | Indefinite; versioned | AES-256-GCM at rest | Central to enforcement. |
| AS-O-04 | Runtime feature flags | I | Platform | Indefinite | At rest | Non-tenant, non-secret. |
| AS-O-05 | Correlation engine transient state (windowing, in-flight matches) | C | Tenant | Bounded window (minutes–hours) | In-memory; disk spill encrypted | Ephemeral; contains partial event data. |
| AS-O-06 | Redis cache entries | C | Tenant | Short TTL | AES-256-GCM at rest (Redis TLS + disk encryption); no plaintext secrets ever | Cache is not a system of record. |

### 3.4 AI Model Assets

| ID | Asset | Class | Owner | Retention | Encryption | Notes |
|---|---|---|---|---|---|---|
| AS-M-01 | Local model weights (L2 open-weights) | I-C | Platform | Indefinite; versioned | At rest | Provenance-verified on load. |
| AS-M-02 | Model configuration (system prompts, tool defs, guardrails) | R | Platform + Tenant overrides | Versioned | AES-256-GCM at rest | Internal prompts must not be exposed (constitutional rule). |
| AS-M-03 | Prompt templates | R | Platform | Versioned | Same | Same. |
| AS-M-04 | Redaction manifests per AI request | C | Tenant | With audit event | Same | Proves what was redacted before leaving the tenant boundary. |
| AS-M-05 | Prompt / completion pairs (evals + reproduction inputs) | R (may embed evidence) | Tenant | 90 days default; configurable | Same | Off by default in HR-classified environments. |
| AS-M-06 | Fine-tune / adapter artifacts (if used) | R | Platform + Tenant | Versioned | Same | Must never train on tenant data without explicit consent event. |
| AS-M-07 | Eval datasets (fixtures for detection quality) | I-C | Platform | Versioned | At rest | Never contain real tenant data. |

### 3.5 Identity Assets

| ID | Asset | Class | Owner | Retention | Encryption | Notes |
|---|---|---|---|---|---|---|
| AS-ID-01 | Human user profiles | C | Tenant | Until deleted | AES-256-GCM at rest | Minimal PII; email, display name, IdP subject. |
| AS-ID-02 | Service accounts | C | Platform / Tenant | Until deleted | Same | Machine identities. |
| AS-ID-03 | Agent identities (AI agent → tool calls) | R | Platform | Versioned | Same | Every agent has its own identity; no shared credentials. |
| AS-ID-04 | Sessions | R | Platform | Session TTL | In-memory + short-lived encrypted store | Revocable. |
| AS-ID-05 | RBAC role assignments | C | Tenant | Until changed | AES-256-GCM at rest | Audit trail on every change. |
| AS-ID-06 | Consent records (L3 hosted AI, telemetry, exports) | C | Tenant | 7 years | AES-256-GCM at rest | Legal evidence of tenant choice. |
| AS-ID-07 | IdP integration state (issuer URLs, JWKS cache) | I-C | Tenant | Until changed | AES-256-GCM at rest | Non-secret parts. |

### 3.6 Cryptographic Assets — the crown jewels

| ID | Asset | Class | Owner | Retention | Encryption | Notes |
|---|---|---|---|---|---|---|
| AS-K-01 | Root of trust / master key | **HR** | Platform | Long-lived; rotated per policy | HSM / cloud KMS; never in plaintext outside HSM | Access is 4-eyes; audited without exception. |
| AS-K-02 | Tenant data encryption keys (DEKs) | **HR** | Platform (custody) / Tenant (data) | Long-lived; rotated | Envelope-encrypted under KEK; KEK under root | Per-tenant isolation. |
| AS-K-03 | Signing keys (audit chain, evidence bundles, updates) | **HR** | Platform | Rotated per policy | HSM / KMS | Public keys published for third-party verification. |
| AS-K-04 | mTLS certificates (service identities) | R | Platform | Short-lived (hours–days) | Issued by internal CA | Rotated automatically. |
| AS-K-05 | External TLS certificates | C | Platform / Tenant | Standard TLS lifecycle | Private key in HSM/KMS | Standard hygiene. |
| AS-K-06 | API tokens / OAuth secrets | R | Tenant | Rotated | Stored encrypted; never logged | Redacted in every log line. |
| AS-K-07 | Third-party AI provider API keys | R | Platform / Tenant | Rotated | Envelope-encrypted | Off in air-gap; scoped per tenant. |
| AS-K-08 | Backup encryption keys | HR | Platform | Long-lived | HSM/KMS | Separate from live-data KEKs to enable "restore without full key exposure". |
| AS-K-09 | Update-bundle signing keys | HR | Platform | Long-lived; rotated | HSM/KMS | Verifies air-gap update integrity. |

### 3.7 Audit Assets

| ID | Asset | Class | Owner | Retention | Encryption | Notes |
|---|---|---|---|---|---|---|
| AS-A-01 | Layer A hash-chain audit records | R | Platform + Tenant | 7 years default; up to legal hold | AES-256-GCM at rest; signed | Append-only, tamper-evident. |
| AS-A-02 | Layer B signed archival batches | R | Platform | 7 years default; longer for regulated | Encrypted at rest in archive; signed batches | Independently verifiable. |
| AS-A-03 | Signing key certificates for audit | C (public keys P) | Platform | Long-lived | Public keys published | Enables third-party verification. |
| AS-A-04 | Break-glass audit events | R | Platform + Tenant | 7 years | AES-256-GCM at rest; alerted on write | High-severity, monitored. |
| AS-A-05 | Consent audit events | R | Tenant | 7 years | Same | Legal evidence. |

### 3.8 Backup Assets

| ID | Asset | Class | Owner | Retention | Encryption | Notes |
|---|---|---|---|---|---|---|
| AS-B-01 | Control-plane DB backups (PostgreSQL) | Same as source | Platform | Per NF-3.4 | AES-256-GCM under AS-K-08 | Immutable copies for ransomware resilience. |
| AS-B-02 | Event-plane backups (ClickHouse) | Same as source | Platform | Per NF-3.3 | Same | Immutable copies. |
| AS-B-03 | Audit archival copies | R | Platform | 7+ years | Same | Off-site + air-gap copy required. |
| AS-B-04 | Configuration snapshots | C | Tenant | 90 days rolling | Same | Rollback fuel. |
| AS-B-05 | KMS / HSM backup material | HR | Platform | Per crypto policy | Provider-native | Recovery is a documented, audited runbook. |

### 3.9 Support / Session Assets

| ID | Asset | Class | Owner | Retention | Encryption | Notes |
|---|---|---|---|---|---|---|
| AS-S-01 | Support tickets / conversations | C | Tenant + Platform | 3 years | AES-256-GCM at rest | Redaction rules apply. |
| AS-S-02 | Screenshots / logs uploaded to support | C-R | Tenant | 90 days default | Same | Scanned for secrets on upload. |
| AS-S-03 | Break-glass support session records | R | Tenant + Platform | 7 years | AES-256-GCM + session recording integrity hash | Recorded and reviewable. |

### 3.10 AEGIS-Self Telemetry (about our own platform)

| ID | Asset | Class | Owner | Retention | Encryption | Notes |
|---|---|---|---|---|---|---|
| AS-T-01 | Operational metrics (CPU, mem, latency) | I | Platform | 90 days | At rest | Not tenant data. |
| AS-T-02 | Error traces (OpenTelemetry) | C | Platform | 30 days | At rest | Must not contain tenant PII or secrets — redaction pipeline enforced. |
| AS-T-03 | Product analytics (feature usage) | I | Platform | 1 year | At rest | Opt-in per tenant; disabled in air-gap. |
| AS-T-04 | Crash dumps | C | Platform | 30 days | At rest | Scanned for secrets before storage; ideally sanitized. |
| AS-T-05 | Update / release manifests | P | Platform | Indefinite | Signed | Verifiable by any deployment. |

### 3.11 Third-Party Assets (that AEGIS depends on but does not own)

Listed for supply-chain awareness; owners are external.

| ID | Asset | Class of impact | Notes |
|---|---|---|---|
| AS-3P-01 | Open-source dependencies | Supply chain: R | SBOM per release; SCA continuous scan. |
| AS-3P-02 | Container base images | Supply chain: R | Pinned digests; hardened base; signed. |
| AS-3P-03 | Model weights from upstream (Llama, Qwen, Mistral, etc.) | Supply chain: R | Provenance verified; hash-pinned. |
| AS-3P-04 | Sigma rule community contributions | Supply chain: C | Review before merge; signed sources preferred. |
| AS-3P-05 | Threat-intel feeds (future) | Supply chain: C | Signature verification; feed reputation tracking. |
| AS-3P-06 | Hosted AI provider APIs | Availability + confidentiality | Provider outages must not stall the platform; no data shared without policy check. |
| AS-3P-07 | Cloud provider IaaS | Availability + confidentiality | Multi-cloud viable; no lock-in. |

## 4. Jurisdictional Considerations

- **J-1.** For self-hosted deployments, jurisdiction is the customer's choice at install time; AEGIS documents which assets are stored where in the deployment.
- **J-2.** For hosted deployments (v1+), tenant selects region at provisioning; cross-region data movement requires explicit policy.
- **J-3.** Regulated categories (GDPR, HIPAA, financial, government) constrain retention, subject rights, and export. Documented in ARCH-15 (Recovery) and ARCH-16 (Deployment).
- **J-4.** L3 (hosted frontier AI) crossing a jurisdiction is treated as an export event — logged, consent-gated, and policy-gated.

## 5. Retention Policy Summary

| Data class | Default | Configurability | Legal-hold override |
|---|---|---|---|
| Raw ingested events | 90d hot + 1y warm | Per tenant / per source | Yes |
| Normalized events | Same | Same | Yes |
| Findings / cases / timelines | 7 years | Per tenant | Yes |
| Audit (Layer A + B) | 7 years | Extendable | Yes |
| Configuration versions | 90 days rolling + 1 pinned baseline | Per tenant | Yes |
| Support artifacts | 90 days–3 years by type | Per policy | Yes |
| AEGIS-self telemetry | 30–90 days | Per deployment | N/A |
| Backups | Match source class | Per deployment | Yes |

## 6. Redaction Policy (summary; detail in ARCH-13)

- **Secrets** — API keys, tokens, passwords, private keys, session cookies: **must never** be stored in cleartext anywhere except the intended secret store, and **must never** appear in logs, prompts, or telemetry. Detected via pattern + entropy scanning at ingest and at every boundary crossing.
- **PII** — configurable per tenant; default aggressive-redaction in AI prompts to L3; less aggressive to L2 local; least aggressive within the tenant boundary.
- **Redaction is additive** — the redacted view is a *view*, not a mutation of AS-I-01.

## 7. Assets NOT Present (explicitly)

To make it easy to audit: AEGIS in v0 does **not** hold:

- Consumer payment data (no PCI scope).
- Health records as a covered entity (BAAs are future, not v0 baseline).
- Government-classified material (v0 supports air-gap but is not certified for classified data).
- Cryptocurrency wallet keys.
- Content moderation datasets.

Any future scope change here requires a threat-model update.

## 8. Decisions

### D-04-1. Preserve raw ingested events verbatim (never destructive normalization)

- **Advantages.** Reproducibility, forensic soundness, ability to fix normalization bugs without data loss, enables independent verification.
- **Disadvantages.** Storage cost roughly doubles; requires explicit redaction path for secrets in the *raw* view.
- **Security Impact.** *Positive* on integrity/forensics; *slightly negative* on secret-handling risk unless redaction is done well. Net positive with a strict secret-scanning pipeline.
- **Operational Impact.** More storage; more disciplined key management.
- **Scalability.** Managed by compression + tiered storage (ClickHouse compresses ~10-20×).
- **Maintainability.** Higher — schema changes do not corrupt history.
- **Future Expansion.** New detectors can back-process history.
- **Risk Assessment.** *Low-medium.* Depends on redaction discipline.
- **Alternatives.**
  - *Store normalized only.* Destroys forensics; violates evidence-preservation principle. Rejected.
  - *Store raw only, normalize on read.* Slower correlation, harder detection tuning. Rejected.
- **Reason.** Evidence preservation is a constitutional principle; storage is cheap; correctness is not.

### D-04-2. Per-tenant DEK, envelope-wrapped

- **Advantages.** Blast-radius reduction; per-tenant crypto-shred capability; simpler key rotation; better regulatory story.
- **Disadvantages.** Slightly higher complexity; ~+10-30μs per encrypt/decrypt for envelope wrap.
- **Security Impact.** *Strongly positive.* Compromise of one DEK does not expose others.
- **Operational Impact.** More key material to manage; solved by KMS/HSM.
- **Scalability.** Neutral to positive.
- **Maintainability.** *Positive.*
- **Future Expansion.** Enables tenant BYOK later.
- **Risk Assessment.** *Low.*
- **Alternatives.** *Single global DEK.* One key compromise = full-fleet exposure. Rejected. *No envelope wrap.* Rotation cost multiplies; rejected.
- **Reason.** Standard best practice; low cost, high defense-in-depth value.

### D-04-3. Audit trail and operational logs on separate storage substrates

- **Advantages.** An operational-log incident cannot corrupt audit; different retention and access policies enforced structurally; simpler regulatory story.
- **Disadvantages.** Two storage integrations to maintain.
- **Security Impact.** *Strongly positive.* Separation of duties in storage.
- **Operational Impact.** Slightly higher.
- **Scalability.** Neutral.
- **Maintainability.** Higher — cleaner ownership.
- **Future Expansion.** Compliance modes can enforce stricter substrate choices.
- **Risk Assessment.** *Low.*
- **Alternatives.** *Shared substrate with schema separation.* Weaker guarantee; a single compromise can affect both. Rejected.
- **Reason.** Audit integrity is a foundational trust property.

### D-04-4. Classify one level higher when in doubt

- **Advantages.** Bias toward caution; avoids inadvertent leakage from misclassification.
- **Disadvantages.** Slightly higher operational cost when overclassified.
- **Security Impact.** *Positive.*
- **Operational Impact.** Marginal.
- **Scalability.** Neutral.
- **Maintainability.** *Positive* — simpler mental rule.
- **Future Expansion.** Explicit downgrade paths with approval keep this workable.
- **Risk Assessment.** *Low.*
- **Alternatives.** *Symmetric bias.* Increases leakage risk. Rejected.
- **Reason.** Constitutional bias to safest option.

## 9. Open Questions

- Q-04-1. HSM strategy per deployment topology (cloud KMS in cloud; software HSM or PKCS#11 device for air-gap). Resolved in ARCH-11.
- Q-04-2. Retention defaults per compliance target (HIPAA 6y minimum, financial 7-10y, GDPR data minimization tension). Resolved in ARCH-13/15.
- Q-04-3. Tenant BYOK sequencing (v1 or v1.x?). Resolved in ARCH-11 / ARCH-18.
- Q-04-4. Legal-hold workflow ownership. Resolved in ARCH-14.

## 10. Change Log

- **0.1 (2026-07-10)** — Initial draft for Phase A review.