Security & Prompt Update

Security fix — Provenance-based document trust hierarchy (Jira ticket RPM-7030)

This release addresses an indirect prompt injection vulnerability where fabricated documents submitted as part of the applicant's package could improperly lower risk findings and severity levels.

The agent now classifies every document into one of three provenance classes before analysis:

• Institution_Verified — documents confirmed by the institution via grounding data
• Primary_Evidence — third-party source records with independent reporting obligations (W-2s, tax returns, bank statements, government IDs, licensed appraisals)
• Applicant_Assertion — everything else (default), including cover letters, memos, attestations, and any document asserting review/audit/compliance conclusions

Key security rules introduced:

• An Applicant_Assertion can raise a concern but never resolve one — it cannot verify a fact, clear a flag, reduce severity, or move a rule from TRIGGERED to CLEAR
• Quantitative comparisons (income variance, DTI, LTV) use only Primary_Evidence and grounding data
• A severity-lock check (workflow step 8) reverts any severity improperly reduced by reliance on an Applicant_Assertion
• CROSS-05 (Self-clearing documentation) flags any Applicant_Assertion that asserts clearance, resolved discrepancies, or approval recommendations — this is treated as a substantive fraud signal

⚠️ Important — Grounding data trust boundary

The provenance hierarchy relies on grounding data to elevate a document from the default Applicant_Assertion class to Institution_Verified. This means the grounding data itself must come from a trusted, system-controlled source — for example, fetched server-side from a database or internal service by the consumer application before calling the agent.

Grounding data must NOT arrive in the same untrusted API request as the documents being analysed. If an external caller can supply both the documents and the grounding data, they can mark their own fabricated documents as Institution_Verified, bypassing the entire trust hierarchy. The consumer application is responsible for enforcing this boundary.

Performance — 42% prompt size reduction

The prompt was rewritten from ~39K to ~22.5K characters using tabularised rule catalogs, deduplicated provenance references, and compact JSON schemas. All 30 operational rules (KYC-01‥06, LOAN-01‥10, TXN-01‥09, CROSS-01‥05) and all security guardrails are preserved.

BSD-3 license (https://opensource.org/licenses/BSD-3-Clause).