Secure Development and DevSecOps
Looplex integrates security into the development, maintenance, and operation of the platform. This practice, known as DevSecOps, incorporates risk assessment and security controls into the stages of creating and evolving services.
The process covers code, infrastructure, dependencies, integrations, and artificial intelligence components. A change to a model, prompt, playbook, or tool can alter a solution’s behavior and is assessed according to its impact.
Assessment and Design
Development considers which data will be used, who can access it, which operations will be permitted, and how results will be recorded or shared. The assessment identifies the points where information crosses organizations, services, or providers.
Design decisions apply least privilege, environment separation, and reduced exposure of data and credentials. Security requirements are incorporated into the interfaces and services responsible for performing operations.
Review and Verification
Code changes undergo review or equivalent controls. Checks include dependency analysis, vulnerability identification, detection of exposed secrets, and testing of access and authorization functions.
Tests check both expected results and behaviors the application must prevent. Scenarios include unauthorized queries, access across organizations, invalid parameters, and attempts to perform actions beyond the authorized scope.
Development, testing, and production environments are separated. Using production data outside its environment requires a need, authorization, and appropriate protective measures.
Protecting Software Delivery
Looplex controls access to repositories, build tools, and deployment mechanisms. Delivery credentials have limited scope and are managed outside the application code.
Published versions remain linked to the changes that produced them. Dependencies and external components are assessed for provenance and known vulnerabilities, with remediation prioritized by risk and exposure.
Significant changes are approved and recorded. Deployment includes service monitoring and conditions for suspension or rollback when results indicate unexpected failures or risks. Data changes require their own recovery procedures; rolling back a software version does not automatically undo its effects.
Changes to AI Components
Models, prompts, playbooks, data retrieval settings, and tool interfaces have versions and designated change owners. Assessment considers the combination used during execution, because replacing one component can affect other stages.
Before release, checks cover result quality, compliance with permissions, resistance to malicious instructions, and behavior when errors occur. Tests include inputs representative of legal work, such as lengthy documents, content extracted through OCR, conflicting information, and attempts to induce an agent to misuse tools.
Assessments are repeated when significant changes may alter the solution’s behavior. Authorization controls remain in the services that perform operations, independently of the instructions supplied to the model.
Secure development of AI systems is also addressed in NIST’s generative AI profile, which supplements security practices throughout the development lifecycle.
Operations and Vulnerability Remediation
After deployment, Looplex monitors failures, operational indicators, and security events. Findings inform updates to tests, settings, and preventive controls.
Remediation priority considers severity, exposure, exploitability, update availability, and compensating measures. Depending on the situation, the response includes applying a fix, restricting a feature, or temporarily disabling a component.
Platform Standards and Customer Settings
Standard platform controls. Looplex manages the development of its components, deployment controls, dependency management, and security checks. The depth of each assessment reflects the risk of the change.
Configuration-dependent capabilities. Integrations, enabled models, execution rules, playbooks, and approval workflows vary by solution. Changes to these elements undergo assessment and acceptance testing appropriate to their scope and the deployment’s division of responsibilities.
Customer responsibilities. The customer validates business rules, legal criteria, and approval authority, and administers the components and systems it develops or maintains. It also provides suitable acceptance testing data and reports changes to integrations under its management. Penetration testing and scanning of Looplex services require prior authorization, as specified in the Corporate Security Measures Notice.