FinOS is designed under a Zero-Trust, Read-Only Educational Posture. FinOS does not hold custody of user funds, does not store banking API credentials, and does not execute irrevocable financial transactions.

graph TD
    Attack1["Attacker: Replay Passkey Challenge"] --> Mit1["5-minute Challenge TTL & Immediate Invalidation"]
    Attack2["Attacker: Prompt Injection in RAG Docs"] --> Mit2["Regex Context Scanning & System Directive Pinning"]
    Attack3["Attacker: Jailbreak / Fund Transfer Request"] --> Mit3["Deterministic Supervisor Interceptor & Rejection"]
    Attack4["Attacker: Speculative Stock Tip Prompting"] --> Mit4["SEBI Advisory Guardrail & Regulatory Disclaimer"]

• Single-Use Challenge Invalidation: Passkey challenges are created with an explicit UTC timestamp (created_at) in PasskeyChallenge.
• Upon verification submission (/auth/webauthn/verify-registration or /auth/webauthn/verify-authentication), the challenge is:
  1. Validated against a strict 5-minute TTL (CHALLENGE_TTL_MINUTES = 5).
  2. Immediately deleted from the database before processing cryptographic signatures.
• Any subsequent attempt to reuse the challenge payload receives HTTP 400: Passkey challenge expired or No challenge found.

• Financial documents ingested into the RAG engine are scanned using regex heuristic filters targeting common prompt injection tokens (ignore all previous instructions, system directive:, you are now in maintenance mode).
• Document chunks triggering injection heuristics are rejected at ingestion time.
• Queries attempting to hijack supervisor routing are intercepted deterministically before sub-agent execution.

• Under Securities and Exchange Board of India (SEBI) regulations, automated investment advisory requires formal IA registration.
• FinOS strictly implements guardrails preventing speculative market predictions, guaranteed return claims, or stock tips.
• Every agentic output and frontend interface prominently features the mandatory statutory disclaimer:

  "FinOS is an educational and quantitative simulation tool, not a SEBI-registered investment advisory service. All estimates are for informational purposes."

• All state-altering or confidential endpoints (/agent/run, /push/trigger-anomaly, /evals/results, /data/*) require a valid Bearer JWT.
• Every HTTP transaction generates a unique X-Request-ID (UUIDv4) attached to response headers and structured application logs for end-to-end auditability.