Create design documents with Fabric

cat PROJECT.md | fabric -p create_design_document > design.md

# AI Nutrition-Pro

## Business background

Dietitians use online applications to create meals, diets and calculate calories called meal planners. Different professionals have different ways of creating diets, which gives a personal style to it. LLMs can reproduce this personal style of writing based on samples of already created content. Meal planners can use LLMs to speed up diet creation for dietitians.
[...]

## BUSINESS POSTURE

The business priorities and goals for AI Nutrition-Pro [...]

## SECURITY POSTURE

Existing Security Controls:
- security control: Use of AWS cloud services with built-in security features for data storage and processing.
- security control: Integration with ChatGPT 3.5 will be secured using OpenAI's recommended practices.
- security control: API access will be secured using API keys and OAuth2.

Accepted Risks:
- accepted risk: Dependency on third-party services like OpenAI for LLM functionality, which may introduce latency or service outages.

Recommended Security Controls:
- Implement encryption for data at rest and in transit.
- Establish a comprehensive logging and monitoring system to detect and respond to security incidents.
- Conduct regular security audits and vulnerability assessments.

Security Requirements:
- The system must comply with data protection regulations such as GDPR and HIPAA.
- Role-based access control should be implemented to restrict access to sensitive data.
- Data anonymization techniques should be applied to reduce the risk of exposing PII.

## RISK ASSESSMENT

- What are critical business processes we are trying to protect?
  The critical business processes include secure data handling, content generation, and maintaining service availability for meal planner integrations.

- What data are we trying to protect, and what is their sensitivity?
  We are trying to protect PII and personal health data of customers, which are highly sensitive and subject to data protection regulations.

[...]

cat design.md | fabric -p review_design > review.md

## 1. Architecture Clarity and Component Design

The architecture diagram provides a clear overview [...]

## 3. Security Architecture

**Current security mechanisms**:

- **Authentication**: Each Meal Planner application uses an individual API key.
- **Authorization**: API Gateway utilizes ACL rules to allow or deny actions.
- **Encryption**: All network traffic between clients and the API Gateway is encrypted using TLS.

**Potential weaknesses**:

- API keys can be compromised; lacking mechanisms for rotation or expiration.
- No mention of security measures for communication between internal components.
- Data at rest encryption is not specified for the databases.

**Improvements**:

- Adopt token-based authentication (e.g., OAuth 2.0) for enhanced security and easier key management.
- Implement mutual TLS or internal API keys for secure communication between internal services.
- Enable encryption at rest for databases to protect sensitive data.
- Establish a security monitoring and incident response plan to detect and handle breaches.

## 5. Data Management and Storage Security

**Security considerations**:

- No explicit mention of data encryption at rest or in backups.
- Potential risk of data leaks if client data is not properly segregated.

**Improvements**:

- Implement database encryption to secure data at rest.
- Enforce strict access controls and auditing on database operations.
- Use tenant-specific schemas or databases to ensure data segregation and client isolation.
- Regularly update and maintain database indexes for optimized performance.

[...]

echo "DESIGN DOCUMENT" > design-document.md
cat PROJECT.md | fabric -p create_design_document >> design-document.md

echo "DESIGN REVIEW" > design-review.md
cat design-document.md | fabric -p review_design >> design-review.md

cat design-document.md design-review.md | fabric -p refine_design_document >> design-document-refined.md

## SECURITY POSTURE

### Existing Security Controls

- **Use of AWS Cloud Services**: Leveraging AWS cloud services with built-in security features for data storage and processing.
- **Secure Integration with ChatGPT 3.5**: Integration with ChatGPT 3.5 secured using OpenAI's recommended practices and API key management.
- **API Access Security**: API access secured using **OAuth 2.0** for enhanced security and easier key management.

### Accepted Risks

- **Dependency on Third-party Services**: Dependency on third-party services like OpenAI for LLM functionality, which may introduce latency or service outages.

### Recommended Security Controls

- **Encryption**: Implement encryption for data at rest and in transit, including internal communications between components.
- **Logging and Monitoring**: Establish a comprehensive logging and monitoring system to detect and respond to security incidents.
- **Regular Security Audits**: Conduct regular security assessments, vulnerability scans, and penetration testing.
- **Data Anonymization**: Apply data anonymization techniques to reduce the risk of exposing PII.

### Security Requirements

- **Regulatory Compliance**: The system must comply with data protection regulations such as GDPR and HIPAA.
- **Role-Based Access Control (RBAC)**: Implement RBAC to restrict access to sensitive data based on user roles.
- **Tenant Data Isolation**: Enforce strict data segregation to ensure client data remains isolated and secure.

## RISK ASSESSMENT

- **Critical Business Processes**: Protecting sensitive data (PII, health information), ensuring reliable content generation, and maintaining service availability for clients.
- **Data Sensitivity**: High sensitivity due to handling of PII and personal health information, requiring strict compliance with GDPR, HIPAA, and other regulations.

[...]