oscerd opened a new pull request, #269: URL: https://github.com/apache/camel-examples/pull/269
## What this adds A new `ai-tools-spiffe-opa` example (category **AI**): a Camel LangChain4j agent whose tools are authorized *before they run* by an Open Policy Agent policy evaluated **in-process as WebAssembly** (the `camel-opa` wasm client), with **SPIFFE** (`camel-spiffe`) authenticating the calling workload. The point is prompt-injection containment: a low-trust caller is talked into asking the model for a refund; the model tries the `refundOrder` tool, but the in-process guard denies it because that caller is not permitted, so no refund happens. A trusted caller is allowed to refund within a cap. ## How it works - Tools are Camel routes registered with the `ai-tool` component and driven by `langchain4j-agent` against a local Ollama model. - The assistant validates each caller's JWT-SVID (SPIFFE) and keeps the caller identity as an exchange property, which Camel copies into every tool call and which the model cannot change. - A shared route configuration evaluates `opa/tools.rego`, compiled to a WebAssembly bundle, in-process. `evaluationMode=wasm` means there is no OPA server and no network hop in the middle of the model's reasoning; the runtime is pure-Java (Chicory). - There is deliberately **no OPA server container**: the policy runs inside the assistant. ## Testing - `OpaWasmToolGuardTest` exercises the real WebAssembly policy allowing/denying each case, fully offline (no LLM, no SPIRE). Runs with `mvn verify`. - `opa/tools_test.rego` has Rego unit tests (`opa test`). - A manual `LlmToolCallingSmokeTest` (disabled unless `OLLAMA_SMOKE=true`) drives the whole loop against a real Ollama model. - Validated end to end with `docker compose up` (SPIRE + assistant + two callers, Ollama on the host): the public chatbot's prompt-injected refund is denied, the support console's refund is allowed. ## Notes - The WebAssembly policy bundle (`src/main/resources/opa/tools-bundle.tar.gz`) is checked in so the build and tests need no OPA toolchain; `build-policy.sh` rebuilds it from `opa/tools.rego` using the OPA container image. A RAT exclusion for `**/src/main/resources/opa/*.tar.gz` is added to the parent pom. - See `ai-tools-spiffe-opa/README.adoc` for how to run it (including a local Ollama with a tool-capable model). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
