Zero Trust GenAI

Zero Trust GenAI is a secure, enterprise-grade solution that integrates strict access control with powerful generative AI capabilities. Designed for organizations with sensitive data requirements, this system ensures users can only access and interact with data explicitly permitted by their roles—maintaining complete compliance and security.

Full Architecture Walkthrough:

1. Authentication via Okta (OIDC): Users authenticate through Okta. OpenID Connect (OIDC) ensures secure identity verification. This step establishes the user's identity and returns an access token reflecting their role.
2. Access Token Validation: The token is securely passed to an AWS Lambda function. Lambda validates the token, ensuring it's legitimate and hasn't expired. This Lambda function acts as the enforcement point for Zero Trust principles.
3. Role-Based Data Access from Snowflake: Based on the user's role encoded in the token, Lambda queries Snowflake using scoped access. For instance, a marketing analyst might only access customer engagement data, while financial analysts see only revenue-related tables.
4. Prompt Construction & LLM Interaction: The allowed data is embedded into a dynamic prompt. This prompt is securely passed to an LLM (e.g., AWS Bedrock). The LLM only sees and responds based on permitted data.
5. Guardrails & Moderation: Before final output, responses are moderated. Unsafe or non-compliant answers are either redacted or replaced. If a user asks for data outside their scope, the system returns: "I do not have access to that information based on my current role."
6. Audit Logging: Every request and interaction is logged (via AWS CloudWatch or OpenSearch). This provides full traceability for compliance audits.

Key Components:

• Okta (OIDC): Secure user authentication and identity federation.
• AWS Lambda: Stateless compute layer for validating tokens and managing data flow.
• Snowflake: Data warehouse with role-based access to control dataset exposure.
• LLM (e.g., Bedrock): AI-powered response generation, scoped to role-permitted data only.
• CloudWatch Logs: Complete logging for audit trails, compliance checks, and debugging.