Skip to main content

User Guide

Prerequisites​

  • Menu access: Access to AI Studio > Security Operations is required.
  • Permissions: Read-Write access is required for model setup, keyword maintenance, review rule maintenance, and review actions. Read-Only access supports viewing operations overview and audit logs.
  • Environment access: Security Operations tabs are managed per environment. Confirm the current environment in the top-right corner before operating.

Overview​

Security Operations is the governance and compliance entry point of AI Studio. Together with Workspace (production), Resources (distribution), and Sage AI / Automation (consumption), it completes the platform lifecycle. The top tabs map one-to-one to the documentation below, in the same order as the product menu:

OrderTabDocumentationDescription
1Security ManagementSecurity ManagementPeer submodules: Content Security (text keywords) and Command Security (execution lists)
2Review QueueReview QueueProcess listing/delisting requests (Approve / Reject)
3Review RulesReview RulesConfigure reviewer roles and users; only the latest rule is active
4Operations OverviewOperations OverviewSession and invocation summaries, distribution charts, model Token consumption
5Audit LogsAudit LogsTrace operations and invocations
6Model ManagementModel ManagementConnect LLM, embedding, and reranking models; custom request headers
7IM ChannelOverview · WeCom / Feishu / DingTalkConnect Sage AI to WeCom / Feishu / DingTalk (URL callback)

(Image: Security Operations with six top tabs)

Administrators should complete the initial setup path below before teams publish at scale and request public listing. Day-to-day work centers on the Review Queue and Operations Overview.

Why Security Operations?​

Once AI capabilities enter production, the lack of a governance layer leads to common problems:

  • No models: Sage AI and Agents cannot reason; Workspace orchestration is unavailable
  • No content boundaries: High-risk instructions or prohibited descriptions in prompts and summaries still get published
  • Uncontrolled public marketplace: Unreviewed custom Skills/Agents enter Public, with broad impact
  • No traceability: It is hard to audit who published, reviewed, or deleted what, and when
  • No observability: Usage, popular Agents, and abnormal Token consumption are invisible

Security Operations addresses these through model setup, keyword protection, review rules, review queue, operations overview, and audit logs—so AI Studio stays usable, controllable, auditable, and observable.

What Security Operations Offers​

Security Management (Tab 1)​

  • Two peer submodules:
    • Content Security: Keywords; block Skill/Agent text on save/publish;
    • Command Security: Block / Ask / Allow lists for command execution in Sage AI, IM, etc., coordinated with approval modes.
  • See Security Management.

Review Queue (Tab 2)​

  • Centralizes listing/delisting requests; tabs: All / Pending / Approved / Rejected.
  • Reviewers inspect details, use debug preview, and Approve or Reject with comments.
  • See Review Queue.

Review Rules (Tab 3)​

  • Assign reviewer roles and users (multi-select supported); only the latest rule is active.
  • Creators cannot submit listing/delisting requests without a configured rule.
  • See Review Rules.

Operations Overview (Tab 4)​

  • View Total AI sessions, Total conversation rounds, Execution statistics, Agent / Skill / tool invocation distribution, and Top 5 model Token consumption by time range and resource domain.
  • See Operations Overview.

Audit Logs (Tab 5)​

  • Four tabs: Session Records, Call Details (Agents / Skills / Tools), Execution Audit, and Model Consumption—for session-level traces, single-invocation details, approval actions, and Token usage.
  • See Audit Logs.

Model Management (Tab 6)​

  • Connect OpenAI-compatible LLM, embedding, and reranking models; connectivity is validated on save; supports custom request headers.
  • See Model Management.

IM Channel (Tab 7)​

  • Configure WeCom, Feishu, and DingTalk bots (URL callback only) to extend conversations into team IM.
  • Feishu keeps app-card interactions; DingTalk supports HTTP callback only.
  • See Overview, WeCom, Feishu, DingTalk.

Relationship with Workspace and Resources​

                    ┌── Model Management ──► Sage AI / Agent reasoning
                    │
Security Operations ├── Security Management ──► Keyword blocking on save/publish
                    │
                    ├── Review Rules ──► Define reviewers
                    │       │
Workspace ──listing─┼───────┴──► Review Queue ──Approved──► Resources > Public
    │               │                    │
    └── Publish ────┼──► Resources > My   └── Rejected ──► Workspace (Rejected)
                    │
                    ├── Operations Overview ──► Usage health
                    └── Audit Logs ──► Operation traceability
  • Creators: Publish in Workspace → visible under My Resources; request listing → Review Queue. See Workspace · User Guide.
  • Users: Resources added from Public generally went through listing review (built-in resources are an exception).
  • Administrators: Configure, approve, and operate governance in this module.

Typical Workflows​

Path 1: Administrators — Initial Setup (Recommended Order)​

Although tabs follow the product menu order, first-time enablement should follow dependencies:

  1. Model Management: Connect at least one LLM (prerequisite for Workspace and Sage AI).
  2. Security Management: Add critical sensitive words and match modes.
  3. Review Rules: Create a rule and assign reviewer roles and users.
  4. Notify creators they can publish in Workspace and request listing; reviewers process requests in Review Queue.

Path 2: Reviewers — Daily Approval​

  1. Open Security Operations > Review Queue > Pending.
  2. Open request details; read Skill/Agent content and version information.
  3. Use debug preview to validate typical scenarios.
  4. Enter review comments and Approve or Reject.

Path 3: Administrators — Daily Operations​

  1. Operations Overview: Review session volume, invocation distribution, and model Token consumption.
  2. Audit Logs: Search for abnormal operations or compliance records.
  3. Update Security Management keywords or Review Rules as needed.

Path 4: Creators — Coordination with Security Operations​

  1. Security Management keywords apply on save/publish; revise and retry if blocked.
  2. Confirm Review Rules are configured before listing/delisting requests.
  3. Withdraw while pending; after Rejected, revise per Review Queue feedback, republish in Workspace, and reapply.

Path 5: Platform Users — Sage AI Only​

  • Even without listing custom capabilities, Model Management still provides conversation ability.
  • Conversations and tool invocations may appear in Audit Logs; organizational policy depends on deployment.

Operation Overview​

  1. Access Security Operations

    • Select AI Studio > Security Operations from the left navigation.
    • Switch among the six top tabs in order; confirm the current environment.

  2. Common tabs by role

    • Administrator setup: Security Management → Review Rules → Model Management.
    • Reviewer processing: Review Queue.
    • Operations analysis: Operations Overview, Audit Logs.

  3. Workspace integration

    • Creator listing requests enter the Review Queue automatically; outcomes sync back to Workspace resource status.

Notes​

  • Review rules: Only the latest rule is active; new requests match new reviewers immediately after a change.
  • No review rule: Creators cannot submit listing/delisting requests; prompts appear in both the queue and Workspace.
  • Security Management vs review: Keyword hits block save/publish in Workspace; listing requests are handled in the Review Queue.
  • Model deletion: Deleting referenced models breaks Sage AI and Agents; assess impact first.
  • Data scope: Operations overview and audit logs follow environment and resource domain policy as shown in the UI.