Humanitarian Aid

Field teams write case notes, donor reports and situation updates under time pressure and poor connectivity. An assistant is a genuine help there. It is also a route by which a protected name can leave a country. This starter sits on that route and blocks the obvious ways it goes wrong.

Field data can put a person in danger. A case list, a location and a status together can identify someone that a party to a conflict is looking for. A program lead therefore needs a control on every request, not a rule that lives in a handbook. That is what this starter provides for gateway traffic.

The request path has four steps. Text copied from an untrusted channel cannot rewrite the rules behind it, because screening for injection happens first. An access rule refuses a caller the gateway cannot verify, which matters where devices are shared. Redaction masks case, docket and matter numbers, and it also masks a name that follows a benefits recipient label. A block list then rejects a request that mentions controlled unclassified information, a sealed filing or an investigative file.

History capture runs in redacted mode. That record keeps a masked version of the traffic rather than the raw text. A team that must not hold beneficiary details still has something to review. Blocked requests are captured too, which keeps a refusal visible during an incident review. Capture does not fail open.

Response controls are lighter than the request side. Source checking flags a weak citation and lets the answer through. A bias signal follows as a configuration point without a set threshold. Output scoring holds a combined floor of 0.86, with relevance at 0.78 and accuracy at 0.80, and it blocks a failing reply.

Several decisions remain local. The three blocked phrases are a starting list, and every mission adds its own sensitive terms. Human review is an empty point, so protection escalation does not happen until you define it. Audit marking never blocks and never creates a retained record. Sovereign hosting, device security and consent practice all sit outside the gateway.