DCA: secureai validate

secureai validate rag <descriptor.yaml> [flags]
secureai validate guardrail <prompt-or-descriptor> [flags]

The Security Deployment Score

Both subcommands produce an SDS out of 100, where higher is safer. It is a readiness signal, not a grade: below 70 the deployment is treated as not production-ready, which is why --fail-below defaults to 70.

validate rag

Analyses a RAG pipeline descriptor across five security domains: vector DB configuration, embedding scope, metadata access controls, retrieval parameters, and data poisoning risk. It reports a score for each domain and the issues behind it.

# Score a pipeline
secureai validate rag rag-pipeline.yaml

# Enforce a higher bar than the default
secureai validate rag rag-pipeline.yaml --fail-below 80

# Machine-readable
secureai validate rag rag-pipeline.yaml --format json

What the descriptor describes

A YAML file recording how your retrieval pipeline is wired: where chunks come from, whether they carry provenance, what bounds the retrieved context, how responses are validated, and who is allowed to retrieve what. It describes the deployment, not the pipeline itself. The analysis is static and safe to run anywhere.

validate guardrail

Checks a system prompt and the controls around it across six categories: system prompt hardening, tool permission boundaries, output validation, safe-by-default baselines, input sanitisation, and monitoring. It also prints a hardened rewrite of the prompt.

secureai validate guardrail guardrail.yaml
secureai validate guardrail guardrail.yaml --fail-below 85

What the descriptor describes

A YAML or JSON file carrying the system prompt and the controls deployed around it. A control the descriptor leaves out is scored as absent.

name: support-bot
system_prompt: |
  You are ...
tools:
  least_privilege: true
  action_allowlist: [lookup_order, create_ticket]
  destructive_auth_gate: true
output:
  format_enforcement: true
  length_cap: 2000
  content_type_restrictions: true
  pii_output_blocking: true
defaults:
  default_deny: true
  temperature: 0.3
input:
  encoding: true
  template_injection_resistance: true
  structured_parsing: true
monitoring:
  logging: true
  anomaly_alerting: true
  audit_trail: true

You can also pass a bare prompt file. It is checked for hardening, but because it declares none of the other controls it cannot reach production-ready on its own. An empty file is reported as not assessed and fails the gate. A descriptor with no system_prompt, or with a setting of the wrong type, is rejected with exit code 2.

Reading the output

CoreLayer VALIDATE: RAG Security Analyzer
Subject: support-rag-insecure
Secure Deployment Score: 32 / 100  (NOT production-ready, threshold 70)

Vector DB Configuration  [LLM08]  0/100
  Critical      Authentication enforcement
      Vector database has no authentication configured; anyone with network reach can read or poison the index.
      fix: Set vector_db.auth to 'apikey' or 'iam' and enforce credentials on every connection.
  ...

Embedding Scope  [LLM08]  20/100
  ...
Metadata Access Controls  [LLM02, LLM08]  45/100
  ...
Retrieval Parameters  [LLM10]  56/100
  ...
Data Poisoning Risk  [LLM04]  38/100
  ...

• Per-domain scores show where the weakness is. A low Vector DB Configuration score and a low Data Poisoning Risk score call for entirely different work.
• Issues are listed underneath with a severity, the OWASP category, and a concrete remediation.

Score interpretation across all phases is collected on Scores & exit codes.