PROTECTEDCODE runs the coding model, retrieval index, and build/test tools inside your department's own Azure Landing Zone. Source code, prompts, embeddings and retrieved context never reach a public AI service.
"You must consider the security classification of the code." — Treasury Board Secretariat, Guide on the use of generative AI
AI ANSWER
CustomerStatus appears to be calculated in CustomerEligibilityService.cs.
Sources used:
CustomerEligibilityService.cs
CustomerRepository.cs
EligibilityRules.cs
Microsoft EF Core docs (approved local copy)
Department Application Architecture Guide
Model: <approved model/version>
RAG index: <project/version>
Public AI service used by platform: NO
Coding and reasoning models run on approved compute inside your boundary. Embedding generation is local — code chunks never hit an external embeddings API.
egress = none
Per-project/repository indexes by default. The gateway maps identity and current solution to allowed index IDs — no global cross-project vector store.
index.scope = project
Build/test/agent tools run in disposable, no-Internet workers with least-privilege identities, tool allowlists, and diff preview before any write.
worker.egress = none
Retrieved repository content — READMEs, comments, package metadata — is always untrusted. System/tool policy outranks anything retrieved from source.
retrieval.privilege = none
Every answer cites the files and docs it drew from, plus model/version and RAG index. Tool calls, exit codes, and diffs are logged to your SIEM.
audit.sink = departmental_siem
Signed licence file, validated locally against an embedded public key, bound to tenant/subscription identifiers. No supplier call-home dependency.
license.callhome = false
Private workload, no public ingress, private AI processing. Management-plane allowlist may be permitted; data plane can remain no-egress. Azure landing zone is a natural fit once authorized.
egress: management-plane allowlist only
Stronger segmentation, private endpoints, centralized logging, deny-by-default. Explicit client-approved exceptions only — no direct data-plane Internet path.
egress: deny-by-default / explicit exception
Special high-security architecture. Treated as a later/special deployment target, not the initial Azure product profile — assume no egress until specifically authorized.
egress: none until authorized
Bring Your Own Model — custom OpenAI-compatible/Ollama-compatible endpoint. Chat, agent edits, and inline completion against your private endpoint only.
provider: Ollama-compatible
Deploys as a workload/spoke into your existing department-owned or SSC GC Cloud One-managed landing zone. Your subscription, your identity, your logging.
deploy: IaC / Bicep
.NET/C#, ASP.NET Core, EF Core, SQL Server docs, approved Microsoft Learn material, and your own department coding standards — imported, chunked, retrieved.
mode: RAG, not retraining
Signed, append-only audit of accepted requests, tool calls, and policy decisions — routed to your existing centralized logging, not a supplier-held log.
sink: existing SIEM
Authentication and project-scoped authorization run through your existing Entra tenant. No separate identity system for developers to manage.
auth: Entra-aware
Initial technical focus is .NET/C#. Java and IntelliJ integration follow the same gateway/RAG pattern once the .NET profile is validated.
status: roadmap
Azure services reached through private endpoints where feasible; public network access disabled where supported.
AI compute, RAG, build/test and storage do not require public IP addresses.
Routes, NSGs, and firewall rules follow deny-by-default / allow-by-exception.
Logs stay in approved departmental SIEM; prompt-body logging minimized/disabled unless explicitly required.
Signed model packages, docs, and NuGet updates use a controlled import route — distinct from prompt/code traffic.
No direct network from build/test workers by default; secret scanning/redaction; destination allowlist.
| THREAT | EXAMPLE | CONTROL |
|---|---|---|
| Repository prompt injection | README/comment tells agent to ignore policy or execute a command | Retrieved content is always untrusted — never becomes a privileged instruction |
| Malicious dependency content | Vendored package targets the agent with embedded instructions | Approved package provenance; sandboxed tool execution |
| Cross-project leakage | Query retrieves protected chunks from another project | Per-project indexes; no global cross-project vector store by default |
| Destructive action | Agent deletes files or runs an unexpected command | Tool allowlist, diff preview, confirmation gates, rollback |
Optimized for Government of Canada procurement. Annual platform/environment licence, included developer seats, additional seats priced per developer. You pay your own Azure compute/storage — no token billing.
Architecture reviews, technical demos, and a proof-of-concept plan scoped to a 20–25 developer pilot. Tell us your landing zone and classification target and we'll walk through the deployment demarcation.