[
https://issues.apache.org/jira/browse/RANGER-5278?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18097833#comment-18097833
]
Yunye Zhang commented on RANGER-5278:
-------------------------------------
Hi [~sneethiraj] ,[~bpatel] , I've been prototyping this on a private branch
and would
like to propose splitting RANGER-5278 into six sub-JIRAs mapped
to the six objectives in the description, and claim the first phase
(objectives 1, 3, 6). A short design note is attached.
Proposed sub-tasks:
Phase 1 (I'd like to claim):
RANGER-XXXX [Sub of 5278] Ranger API read-only connector
+ audit fetcher SPI (obj. 1)
RANGER-XXXX [Sub of 5278] Agentic core engine: LlmProvider SPI,
anomaly detectors, PolicyAdvisor, Orchestrator (obj. 3)
RANGER-XXXX [Sub of 5278] AI decision audit trail with HMAC and
two-person approval (obj. 6)
Phase 2 (open for others):
RANGER-XXXX [Sub of 5278] Behavior analysis deep-dive (obj. 2)
RANGER-XXXX [Sub of 5278] Feedback loop / Applier writing back
to Ranger (obj. 4)
RANGER-XXXX [Sub of 5278] UI/UX in security-admin (obj. 5)
Current status of my prototype (branch feature/…):
Module 1 (connector): RangerAiClient read-only wrapper + ES/File
audit fetchers via a common SPI; real-Ranger
REST wiring still needs an integration test
Module 3 (engine): LlmProvider SPI + OpenAI-compatible + Mock;
BaselineAnomalyDetector +
IsolationForestAnomalyDetector (pure Java,
no Python sidecar); PolicyAdvisor with strict
JSON schema + confidence gate;
AgentOrchestrator implemented, unit test WIP
Module 6 (audit): FileAiDecisionAuditor + NDJSON + HMAC signer
+ two-person rule + decision lifecycle
(PROPOSED/REVIEWED/APPROVED/APPLIED/ROLLED_BACK);
`verify` CLI still a placeholder
Non-goals for Phase 1 (per the design note):
- no writes to Ranger (all mutations go through the module-6 approval
loop; the Applier itself lives in Phase 2 / obj. 4)
- no UI (obj. 5 stays in Phase 2)
- Java-only ML (no Python sidecar) to keep dependencies Apache
Category-A
I can post the first PR (module-1 skeleton, as the design note's
"minimal first-PR scope" suggests) within a few days if this split is OK.
> Build Agentic AI Agent for Apache Ranger to Automate Policy Suggestions and
> Anomaly Detection
> ---------------------------------------------------------------------------------------------
>
> Key: RANGER-5278
> URL: https://issues.apache.org/jira/browse/RANGER-5278
> Project: Ranger
> Issue Type: New Feature
> Components: Ranger
> Reporter: Selvamohan Neethiraj
> Assignee: Selvamohan Neethiraj
> Priority: Major
>
> Design and implement an Agentic AI component that integrates with Apache
> Ranger to enable autonomous access control policy recommendations, real-time
> anomaly detection, and closed-loop governance based on user behavior, audit
> logs, and contextual metadata.
> The goal is to improve proactive data security and reduce the manual overhead
> of policy management.
> h3. *Objectives / Scope:*
> *1. Connect to Apache Ranger APIs*
> * Read existing policies and audit logs
> * Access metadata about resources, users, and roles
>
> *2. Behavior Analysis Module*
> * Ingest and analyze user access logs
> * Identify frequent access patterns and policy gaps
>
> *3. Agentic AI Core Engine*
> * Implement reasoning engine (LLM-based)
> * Generate intelligent policy suggestions (e.g., “User X should not access
> Resource Y after 6PM”)
> * Detect and flag anomalous behavior (e.g., off-hours access, privilege
> escalation, etc.)
>
> *4. Policy Suggestion & Feedback Loop*
> * Generate human-readable policy change suggestions
> * Provide options for manual approval or automatic update
> * Support audit trail and rollback capability
>
> *5. UI/UX Integration*
> * Frontend dashboard to view agent outputs
> * Admin interface to approve/reject agent suggestions
>
> {*}6. Security & Logging{*}{*}{*}
> * Ensure logs of AI actions and decisions are captured
> * Add safeguards against unintended policy changes
>
> h3. *Acceptance Criteria:*
> * Agent connects to Apache Ranger and retrieves audit logs and policy
> metadata
> * AI agent analyzes patterns and recommends policy updates with confidence
> scores
> * Anomaly detection is demonstrated using historical audit log patterns
> * All agent recommendations are logged and optionally require admin approval
> * No impact to existing Ranger operations or policies without approval
> * Demo and report generated with at least 3 use cases (e.g., over-privileged
> user, abnormal access time, stale policy)
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
