# 🛡️ {{ project_name }} - Guardian Security Service

Advanced security and policy enforcement service for {{ project_name }}.

## 🎯 Overview

The Guardian Security Service provides comprehensive security monitoring, policy enforcement, and compliance checking for your ABI system.

## 🚀 Features

- **Policy Enforcement**: Real-time validation using Open Policy Agent (OPA)
- **Security Monitoring**: Continuous system security state monitoring
- **Risk Assessment**: Advanced risk scoring with contextual analysis
- **Audit Logging**: Comprehensive audit trails for compliance
- **Emergency Controls**: Fail-safe mechanisms and emergency shutdown
- **Security Dashboard**: Real-time security metrics and monitoring
- **Alert System**: Configurable alerting for security events

## 🔧 Configuration

### Environment Variables

```bash
AGENT_HOST={{ guardian_host | default('0.0.0.0') }}
AGENT_PORT={{ guardian_port | default('11438') }}
OPA_URL=http://{{ project_dir }}-opa:8181
MAX_RISK_THRESHOLD={{ max_risk_threshold | default('0.7') }}
GUARDIAL_DASHBOARD_PORT={{ dashboard_port | default('8080') }}
EMERGENCY_LOG_DIR=/app/emergency_logs
```

### Ports

- **{{ guardian_port | default('11438') }}**: Guardian API endpoint
- **{{ dashboard_port | default('8080') }}**: Security Dashboard
- **8181**: OPA Policy Server

## 📡 API Endpoints

### Security Validation
- `POST /validate` - Validate action against policies
- `POST /validate/workflow` - Validate workflow execution
- `POST /validate/communication` - Validate inter-agent communication

### Emergency Controls
- `POST /emergency/shutdown` - Emergency system shutdown
- `GET /health` - Security health check
- `GET /policies/status` - Policy engine status

### Dashboard
- `GET /` - Security dashboard (port {{ dashboard_port | default('8080') }})
- `GET /metrics` - Prometheus metrics

## 🔒 Security Policies

Guardian enforces immutable core policies:

- **Self-Replication Protection**: Blocks agent self-replication
- **Policy Protection**: Prevents policy modification by agents
- **System Access Control**: Restricts system-level access
- **Sensitive Data Protection**: Monitors sensitive data access

## 📊 Monitoring

Access the security dashboard at:
```
http://localhost:8080 | default('8080') }}
```

View metrics at:
```
http://localhost:{{ guardian_port | default('11438') }}/metrics
```

## 🚨 Emergency Response

Guardian includes an emergency response system that:
- Logs all emergency events with cryptographic signing
- Provides immediate system shutdown capabilities
- Maintains immutable emergency logs
- Alerts on critical security violations

## 📝 Audit Logs

All security decisions are logged to:
- Application logs: `./logs/guardian.log`
- Emergency logs: `./services/guardian/emergency_logs/`
- Audit database: `./services/guardian/audit.db`

## 🔍 Health Checks

Guardian provides comprehensive health checks:

```bash
curl http://localhost:{{ guardian_port | default('11438') }}/health
```

Response includes:
- Overall security status
- OPA connectivity
- Policy validation status
- Emergency system status
- Recent security metrics

## 🛠️ Development

### Local Testing

```bash
# Start OPA server
docker-compose up {{ project_dir }}-opa

# Start Guardian
docker-compose up {{ project_dir }}-guardian

# View logs
docker-compose logs -f {{ project_dir }}-guardian
```

### Policy Development

Custom policies can be added to:
```
./services/guardian/opa/policies/
```

## 📚 Documentation

For more information, see:
- [Guardian Architecture](https://docs.abi-core.dev/architecture/guardian)
- [Security Policies](https://docs.abi-core.dev/security/policies)
- [Emergency Response](https://docs.abi-core.dev/security/emergency)

---

**Generated by ABI-Core** | **Project**: {{ project_name }} | **Domain**: {{ domain }}
