feat: add governance-audit hook — threat detection for Copilot sessions#756
Conversation
Add real-time governance audit hook that scans prompts for threat signals: - 5 threat categories: data exfiltration, privilege escalation, system destruction, prompt injection, credential exposure - 4 governance levels: open, standard, strict, locked - Append-only JSON audit trail (logs/copilot/governance/audit.log) - Session summary with threat counts at session end - Privacy-aware: logs decisions and metadata, never prompt content Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR adds the governance-audit hook, a security-focused hook that scans user prompts for threat signals before agent processing. It's the third hook in the repository, complementing the existing session-logger and session-auto-commit hooks by adding enterprise-grade governance controls with threat categorization, severity scoring, and configurable blocking.
Changes:
- Adds governance-audit hook with threat detection for 5 categories (data exfiltration, privilege escalation, system destruction, prompt injection, credential exposure)
- Implements 4 configurable governance levels (open, standard, strict, locked) with different blocking behaviors
- Updates hooks documentation index to include the new hook
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 9 comments.
Show a summary per file
| File | Description |
|---|---|
hooks/governance-audit/hooks.json |
Hook configuration defining event handlers for sessionStart, sessionEnd, and userPromptSubmitted with environment variables for governance level and blocking behavior |
hooks/governance-audit/audit-session-start.sh |
Session start handler that logs governance context and current governance level |
hooks/governance-audit/audit-session-end.sh |
Session end handler that calculates and logs threat summary statistics |
hooks/governance-audit/audit-prompt.sh |
Core threat detection logic with regex-based pattern matching across 5 threat categories and configurable blocking |
hooks/governance-audit/README.md |
Comprehensive documentation including threat categories, governance levels, installation, configuration, and privacy notes |
docs/README.hooks.md |
Updated hooks index table to include governance-audit with description, events, and bundled assets |
- Switch from colon to tab delimiter to handle colons in evidence text - Base64-encode evidence to prevent parsing issues - Use MAX_SEVERITY in log output and JSON events - Narrow regex patterns to reduce false positives: - third[_-]?party instead of third.?party - Role reassignment scoped to AI terms - System prompt injection requires 'you are' context - Fix session-end stats to scope to current session only - Update privacy statement to clarify evidence snippets are logged - Rename credential description to 'Possible hardcoded credential' - Fix database destruction regex to also match semicolons Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
All 9 review comments addressed in commit 32d8f7f: Delimiter and encoding: Switched from colon to tab delimiter + base64-encoded evidence to handle colons in evidence text (URLs, YAML keys). MAX_SEVERITY: Now included in JSON log output and console message. Regex precision: Narrowed patterns to reduce false positives - scoped role reassignment to AI terms, system prompt injection requires context, DB destruction matches semicolons. Session-end stats: Now filters events by last session_start timestamp for accurate per-session counts. Privacy statement: Updated to clarify evidence snippets (not full prompts) are logged. Credential evidence: Description changed to "Possible hardcoded credential". |
2 participants
Summary
Adds
governance-audit— a Copilot CLI hook that scans user prompts for threat signals before agent processing. This is the third hook in the collection (aftersession-auto-commitandsession-logger).What's Included
hooks.jsonsessionStart,sessionEnd,userPromptSubmittedeventsaudit-session-start.shaudit-session-end.shaudit-prompt.shREADME.mdThreat Detection
Scans prompts for 5 threat categories:
data_exfiltrationprivilege_escalationsystem_destructionprompt_injectioncredential_exposureGovernance Levels
openstandardBLOCK_ON_THREAT=truestrictlockedPrivacy
SKIP_GOVERNANCE_AUDIT=trueHow It Complements
session-loggersession-loggerprovides general activity logging.governance-auditadds security-specific scanning with threat categorization, severity scoring, and configurable blocking — aimed at enterprise teams that need governance controls on AI coding agents.