004-risk-checkpoint

Risk Checkpoint

Purpose: Block operations exceeding risk thresholds. 90-95% critical incident reduction.

Risk Classification

RISK_LEVELS = {
    'CRITICAL': ['data_loss', 'security_breach', 'system_corruption'],
    'HIGH': ['service_disruption', 'config_damage', 'privacy_violation'],
    'MEDIUM': ['performance_impact', 'reversible_changes', 'resource_usage'],
    'LOW': ['read_operations', 'isolated_changes', 'logging']
}

RISK_SIGNATURES = {
    'CRITICAL': [
        r'rm\s+-rf\s+/',                    # Root deletion
        r'DROP\s+DATABASE|TRUNCATE',        # Data destruction
        r'sudo\s+chmod\s+777',              # Security compromise
        r'(API_KEY|SECRET|PASSWORD)',       # Credential exposure
        r'(\.ssh/|/etc/passwd)',           # System file mods
    ],
    'HIGH': [
        r'sudo(?!\s+apt-get)',             # Unwhitelisted sudo
        r'DELETE.*WHERE.*[><=].*1000',     # Bulk operations
        r'git\s+push.*main|master',        # Direct main push
    ]
}

Risk Assessment Pipeline

def assess_risk(operation):
    # 1. Pattern matching
    base_score = match_signatures(operation, RISK_SIGNATURES)
    
    # 2. Context multipliers
    multipliers = {
        'environment': 2.0 if prod else 1.0,
        'bulk_operation': 1.5 if count > 100 else 1.0,
        'data_sensitivity': 2.0 if has_pii else 1.0,
        'time_restriction': 1.5 if off_hours else 1.0
    }
    
    # 3. Sequence analysis
    if creates_dangerous_sequence(operation, history):
        base_score = max(base_score, 'HIGH')
    
    # 4. Final score
    return apply_multipliers(base_score, multipliers)

Decision Framework

Risk Level	Action	Requirements
CRITICAL	❌ BLOCK	Human override + justification
HIGH	⚠️ WARN	Explicit approval + safeguards
MEDIUM	🔔 NOTIFY	Confirmation + logging
LOW	✅ PROCEED	Log for audit

Implementation Patterns