CJIS Security Policy

Criminal justice information carries an access rule for every person who touches it. An agency, a court or a contractor must show attribution and auditability before an assistant goes near that data. This starter offers the traffic controls and evidence inputs that a policy review can inspect.

Nobody experiments quietly with this data. Every query is subject to audit, and every user must be attributable. Injection screening therefore sits in front of the identity check, so a prompt cannot talk its way past authentication.

Redaction here works from the built-in identifier set, because this starter configures no extra patterns. Add the patterns your agency treats as sensitive, such as local record numbers. A block list then refuses any prompt that carries controlled unclassified information, official use only material, or sensitive but unclassified content.

Automated traffic detection sits after that block list and only raises a warning. It does not stop a script, so pair it with a rate control that your agency owns. Output scoring holds every answer to a combined score of 0.80 and an accuracy floor of 0.80, and blocks the rest.

No review step ships in this chain, so nothing pauses for a human by default. Personnel screening, facility control and media handling stay entirely outside the gateway. The closing stage only marks a request as evaluated, and it never holds one back.