Skip to content

ai-offboard 0.2.0 — Zero Trust for AI

Choose a tag to compare

View all tags
@joemanis joemanis released this 16 Aug 03:13
· 29 commits to main since this release
v0.2.0
863d119

ai-offboard 0.2.0 — Zero Trust for AI arrives

The full v1 → v3 roadmap from SPEC.md is delivered: audit → execute → Zero Trust policy engine.

What's new since 0.1.0

⚡ Zero Trust policy engine (v3)

Declarative policy-as-code evaluated against the scan inventory. Policies use named checks only — no eval, so opening a policy file can never execute code.

offboard policy list          # checks + bundled policies
offboard policy check         # scan → evaluate → exit 0 (PASS) / 2 (FAIL)
offboard policy check --json  # machine-readable compliance report

Bundled baseline (5 policies):

  • ZT-001 No stale or orphaned access (high)
  • ZT-002 MFA enforced on all principals (high)
  • ZT-003 No high-privilege AI app assignments (high)
  • ZT-004 No broad OAuth grants (high)
  • ZT-005 Approved AI-app allowlist — default-deny Zero Trust (critical)

🎯 offboard execute — real remediation (v2)

Audit findings become real actions — block sign-in, revoke tokens, remove app assignments — behind an explicit approval gate. Every mutation is appended to the local audit log.

offboard plan --tenant <id>     # review what will change (read-only)
offboard execute --tenant <id>  # approve each step, then it applies

📅 Scheduled recurring audits

offboard schedule add/remove/list/run-due — daily/weekly/monthly audits driven from cron or Task Scheduler, with SMTP report delivery.

🏢 Multi-tenant (MSP mode)

offboard tenant add/remove/list + offboard audit --all sweeps every registered tenant into a findings matrix.

📈 Trend comparison + exports

offboard report --compare diffs the last two scans (new/resolved/unchanged); audit --csv exports findings for ConnectWise/Ninja/spreadsheets.

🔌 Google Workspace connector (v1b)

Reads users + their OAuth-connected AI apps (ChatGPT, Fireflies, Zapier, …) through the Admin SDK Directory API — same risk rules as Entra.

🗂️ 41-app AI catalog

apps.json grew from 5 → 41 real AI tools with DLP tiers, plus a specificity-aware matcher (no more "GitHub Copilot → Microsoft Copilot" false positives).

🖥️ Web UI polish

Scan progress in CLI + pre-seeded sample report on first load + severity filter.

Quick start

pip install git+https://github.com/joemanis/ai-offboard.git
offboard policy check --mock   # try the policy engine with a demo snapshot

Full changelog

See CHANGELOG.md for the complete list.

Installing: Live on PyPI: pip install "ai-offboard[web]"

Assets 2
Loading