aios/docs/security/user-data-isolation-deployment-runbook.md

User Data Isolation Deployment Runbook

Goal

Deploy user-data isolation controls before enabling memory search or cross-agent recall.

Current Safety State

Default:

AIOS_MEMORY_ENABLED=false

Memory search remains disabled until isolation acceptance passes.

Deployment Components

1. Memory scope guard

scripts/security/memory_scope_guard.py

2. Provider gate

scripts/security/memory_provider_gate.py

3. Isolation audit service

user-data-isolation-audit.service
user-data-isolation-audit.timer

4. Activation gate

scripts/security/memory_search_activation_check.py

Deployment Order

Install audit
        ↓
Run isolation scan
        ↓
Fix unscoped records
        ↓
Enable provider scope contract
        ↓
Run acceptance suite
        ↓
Evaluate activation gate
        ↓
Only then enable memory search

Acceptance Requirements

Before enabling memory search:

Isolation

• no untagged records;
• no cross-user records;
• no cross-project records;
• no cross-tenant records;
• no global shared memory paths;
• all records have provenance.

Provider

Required:

{
  "scope_filter_before_ranking": true,
  "provenance_required": true,
  "allow_global_index": false
}

Activation Gate

The activation check must return:

{
  "status": "allowed"
}

Anything else keeps memory disabled.

Incident Response

If contamination is detected:

1. Disable memory/search provider.
2. Enter autonomous safe mode if operational state may be affected.
3. Preserve audit evidence.
4. Identify scope violation source.
5. Migrate records into scoped namespaces.
6. Rerun acceptance before reactivation.

Redline

Convenience, recall quality, and search coverage never override user-data isolation.