从零搭建 AI 系统权限控制系统

从零搭建 AI 系统权限控制系统

背景

近期 Meta AI 发生重大数据泄露事故，敏感数据'全员可见'。在开发 AI 项目时，此类安全风险同样存在。本教程将带你从零开始，搭建一个完整的、可实战的 AI 权限控制系统。

环境准备

# 安装 Python 和相关依赖
pip install casbin flask sqlalchemy redis
# 安装数据库（推荐 PostgreSQL）
sudo apt-get install postgresql
# 或下载安装包：https://www.postgresql.org/download/
# 安装 Redis（用于缓存和实时权限检查）
sudo apt-get install redis-server
# 创建项目目录
mkdir ai-permission-system
cd ai-permission-system

项目结构

# 创建项目目录结构
mkdir -p src/{models,controllers,utils,config}
mkdir -p tests/{unit,integration}
mkdir -p data/{logs,backups}
mkdir -p docs/{architecture,api}
# 创建基础配置文件
touch config/settings.yaml
touch config/database.yaml
touch config/permission_policy.yaml
touch src/main.py

设计 AI 资产分类模型

首先，我们需要定义 AI 系统中的各种资源。打开 src/models/ai_assets.py：

""" AI 资产分类模型
定义了 AI 系统中的各种资源及其敏感度级别
"""
class AIAsset:
    """AI 资产基类"""
    def __init__(self, asset_id, asset_type, sensitivity_level):
        self.asset_id = asset_id
        self.asset_type = asset_type  # data, model, api, log 等
        self.sensitivity_level = sensitivity_level  # critical/high/medium/low
        # 自动计算权限基线
        self.base_permission = self._calculate_base_permission()

    def _calculate_base_permission(self):
        """根据敏感度自动计算基础权限"""
        if self.sensitivity_level == 'critical':
            return {'read': False, 'write': False, 'delete': False}
        elif self.sensitivity_level == 'high':
            return {'read': True, 'write': False, 'delete': False}
        elif self.sensitivity_level == 'medium':
            return {'read': True, 'write': True, 'delete': False}
        elif self.sensitivity_level == 'low':
            return {'read': True, 'write': True, 'delete': True}
        else:
            return {'read': False, 'write': False, 'delete': False}

    def __repr__(self):
        return f"AIAsset({self.asset_id}, {self.asset_type}, {self.sensitivity_level})"

# 具体的 AI 资产类型定义
class TrainingDataAsset(AIAsset):
    """训练数据集"""
    def __init__(self, asset_id, data_size, contains_personal_data=False):
        sensitivity = 'critical' if contains_personal_data else 'high'
        super().__init__(asset_id, 'training_data', sensitivity)
        self.data_size = data_size
        self.contains_personal_data = contains_personal_data

class ModelParameterAsset(AIAsset):
    """模型参数"""
    def __init__(self, asset_id, model_type, training_cost):
        # 根据训练成本和模型类型确定敏感度
        if training_cost > 10000 or model_type == 'proprietary':
            sensitivity = 'critical'
        elif training_cost > 1000:
            sensitivity = 'high'
        else:
            sensitivity = 'medium'
        super().__init__(asset_id, 'model_parameters', sensitivity)
        self.model_type = model_type
        self.training_cost = training_cost

class InferenceAPIAsset(AIAsset):
    """推理 API"""
    def __init__(self, asset_id, request_limit_per_minute):
        sensitivity = 'medium' if request_limit_per_minute > 100 else 'low'
        super().__init__(asset_id, 'inference_api', sensitivity)
        self.request_limit = request_limit_per_minute

class TrainingLogAsset(AIAsset):
    """训练日志"""
    def __init__(self, asset_id, contains_metrics=False):
        sensitivity = 'medium' if contains_metrics else 'low'
        super().__init__(asset_id, 'training_log', sensitivity)
        self.contains_metrics = contains_metrics

# 使用示例
if __name__ == "__main__":
    # 创建一些示例资产
    user_data = TrainingDataAsset('user_dataset_v1', 1000000, contains_personal_data=True)
    llm_model = ModelParameterAsset('llm_v2', 'llm', 50000)
    api_endpoint = InferenceAPIAsset('chat_api_v1', 50)
    training_log = TrainingLogAsset('training_log_2026_03_22', contains_metrics=True)
    print(f"用户数据集权限：{user_data.base_permission}")
    print(f"LLM 模型权限：{llm_model.base_permission}")
    print(f"API 端点权限：{api_endpoint.base_permission}")
    print(f"训练日志权限：{training_log.base_permission}")

设计用户角色体系

打开 src/models/user_roles.py：

""" 用户角色体系设计
定义了 AI 系统中的各种角色及其权限基线
"""
class UserRole:
    """用户角色基类"""
    def __init__(self, role_name, role_description):
        self.role_name = role_name
        self.role_description = role_description
        self.permission_matrix = {}  # 权限矩阵

    def add_permission(self, asset_type, permissions):
        """为特定资产类型添加权限"""
        self.permission_matrix[asset_type] = permissions

    def get_permission_for(self, asset_type):
        """获取对特定资产类型的权限"""
        if asset_type in self.permission_matrix:
            return self.permission_matrix[asset_type]
        else:
            return {'read': False, 'write': False, 'delete': False}

    def __repr__(self):
        return f"UserRole({self.role_name})"

# 具体的 AI 系统角色定义
class DataEngineerRole(UserRole):
    """数据工程师"""
    def __init__(self):
        super().__init__('data_engineer', '负责数据处理和准备')
        # 数据工程师的权限配置
        self.add_permission('training_data', {'read': True, 'write': True, 'delete': False})
        self.add_permission('processed_data', {'read': True, 'write': True, 'delete': False})
        self.add_permission('model_parameters', {'read': False, 'write': False, 'delete': False})
        self.add_permission('inference_api', {'read': False, 'write': False, 'delete': False})
        self.add_permission('training_log', {'read': True, 'write': False, 'delete': False})

class MLEngineerRole(UserRole):
    """机器学习工程师"""
    def __init__(self):
        super().__init__('ml_engineer', '负责模型训练和优化')
        # ML 工程师的权限配置
        self.add_permission('training_data', {'read': True, 'write': False, 'delete': False})
        self.add_permission('processed_data', {'read': True, 'write': True, 'delete': False})
        self.add_permission('model_parameters', {'read': True, 'write': True, 'delete': False})
        self.add_permission('inference_api', {'read': True, 'write': True, 'delete': False})
        self.add_permission('training_log', {'read': True, 'write': True, 'delete': False})

class DeploymentEngineerRole(UserRole):
    """部署工程师"""
    def __init__(self):
        super().__init__('deployment_engineer', '负责模型部署和 API 管理')
        # 部署工程师的权限配置
        self.add_permission('training_data', {'read': False, 'write': False, 'delete': False})
        self.add_permission('processed_data', {'read': False, 'write': False, 'delete': False})
        self.add_permission('model_parameters', {'read': True, 'write': False, 'delete': False})
        self.add_permission('inference_api', {'read': True, 'write': True, 'delete': True})
        self.add_permission('training_log', {'read': True, 'write': False, 'delete': False})

class ProductManagerRole(UserRole):
    """产品经理"""
    def __init__(self):
        super().__init__('product_manager', '负责产品需求和用户体验')
        # 产品经理的权限配置
        self.add_permission('training_data', {'read': True, 'write': False, 'delete': False})
        self.add_permission('processed_data', {'read': True, 'write': False, 'delete': False})
        self.add_permission('model_parameters', {'read': True, 'write': False, 'delete': False})
        self.add_permission('inference_api', {'read': True, 'write': True, 'delete': False})
        self.add_permission('training_log', {'read': True, 'write': False, 'delete': False})

class CustomerRole(UserRole):
    """客户/用户"""
    def __init__(self):
        super().__init__('customer', '最终使用 AI 服务的用户')
        # 客户的权限配置
        self.add_permission('training_data', {'read': False, 'write': False, 'delete': False})
        self.add_permission('processed_data', {'read': False, 'write': False, 'delete': False})
        self.add_permission('model_parameters', {'read': False, 'write': False, 'delete': False})
        self.add_permission('inference_api', {'read': True, 'write': False, 'delete': False})
        self.add_permission('training_log', {'read': False, 'write': False, 'delete': False})

# 使用示例
if __name__ == "__main__":
    # 创建各种角色
    data_engineer = DataEngineerRole()
    ml_engineer = MLEngineerRole()
    deployment_engineer = DeploymentEngineerRole()
    print(f"数据工程师权限矩阵：{data_engineer.permission_matrix}")
    print(f"ML 工程师权限矩阵：{ml_engineer.permission_matrix}")
    print(f"部署工程师权限矩阵：{deployment_engineer.permission_matrix}")

使用 Casbin 实现权限控制

Casbin 是一个强大的开源权限控制框架。打开 src/controllers/permission_controller.py：

""" 使用 Casbin 实现 AI 系统权限控制 """
import casbin
from casbin import persist

class AIPermissionController:
    """AI 权限控制器"""
    def __init__(self):
        # 加载权限策略
        self.enforcer = casbin.Enforcer("config/permission_model.conf",  # 模型配置文件
                                        "config/permission_policy.csv")  # 策略配置文件
        # 创建适配器（连接到数据库）
        self.adapter = persist.Adapter()
        # 初始化上下文存储
        self.context_store = {}

    def check_access(self, user_id, resource_id, action):
        """检查用户是否有权限执行操作"""
        # 基础权限检查
        result = self.enforcer.enforce(user_id, resource_id, action)
        # 如果基础检查通过，进行上下文检查
        if result:
            context_result = self._check_context(user_id, resource_id, action)
            return context_result
        return False

    def _check_context(self, user_id, resource_id, action):
        """上下文检查：时间、地点、系统状态等"""
        context = self._get_context(user_id, resource_id)
        # 检查时间限制
        if context['time_restricted'] and not self._is_in_time_window():
            return False
        # 检查地点限制
        if context['location_restricted'] and not self._is_in_location():
            return False
        # 检查系统状态
        if context['system_status'] != 'normal':
            return False
        # 检查历史行为
        if self._has_abnormal_history(user_id):
            return False
        return True

    def _get_context(self, user_id, resource_id):
        """获取当前权限上下文"""
        if (user_id, resource_id) in self.context_store:
            return self.context_store[(user_id, resource_id)]
        else:
            return {'time_restricted': False, 'location_restricted': False, 'system_status': 'normal'}

    def grant_permission(self, user_id, resource_id, action, reason=""):
        """授予权限（需要审计）"""
        # 记录授予原因
        grant_record = {
            'timestamp': self._get_current_time(),
            'user_id': user_id,
            'resource_id': resource_id,
            'action': action,
            'reason': reason,
            'granted_by': self._current_admin()
        }
        # 保存到审计日志
        self._save_to_audit_log(grant_record)
        # 实际授予权限
        self.enforcer.add_policy(user_id, resource_id, action)
        return True

    def revoke_permission(self, user_id, resource_id, action, reason=""):
        """撤销权限"""
        # 记录撤销原因
        revoke_record = {
            'timestamp': self._get_current_time(),
            'user_id': user_id,
            'resource_id': resource_id,
            'action': action,
            'reason': reason,
            'revoked_by': self._current_admin()
        }
        # 保存到审计日志
        self._save_to_audit_log(revoke_record)
        # 实际撤销权限
        self.enforcer.remove_policy(user_id, resource_id, action)
        return True

    def _save_to_audit_log(self, record):
        """保存审计记录"""
        # 这里可以连接到数据库或文件系统
        print(f"[审计日志] {record}")
        # 实际实现中应该写入数据库

    def _get_current_time(self):
        """获取当前时间"""
        import datetime
        return datetime.datetime.now()

    def _current_admin(self):
        """获取当前管理员"""
        return "system_admin"
        # 实际实现中应该根据会话确定

    def _is_in_time_window(self):
        """检查是否在允许的时间窗口内"""
        import datetime
        now = datetime.datetime.now().hour  # 假设工作时间是 9-18 点
        return 9 <= now <= 18

    def _is_in_location(self):
        """检查是否在允许的地理位置"""
        # 这里可以集成 IP 地理位置检查
        return True  # 简化实现

    def _has_abnormal_history(self, user_id):
        """检查用户是否有异常历史"""
        # 这里可以检查用户的历史访问记录
        return False  # 简化实现

# 使用示例
if __name__ == "__main__":
    # 初始化权限控制器
    controller = AIPermissionController()
    # 测试权限检查
    result = controller.check_access("data_engineer_001", "user_dataset_v1", "read")
    print(f"数据工程师读取用户数据集：{result}")
    # 测试授予权限
    controller.grant_permission("ml_engineer_002", "llm_model_v2", "write", "需要修改模型参数以优化性能")
    # 测试撤销权限
    controller.revoke_permission("product_manager_003", "training_log_2026", "delete", "误操作，不应删除日志")

创建配置文件

创建 config/permission_model.conf：

# Casbin 权限模型配置文件
[request_definition]
r = sub, obj, act
[policy_definition]
p = sub, obj, act
[role_definition]
g = _, _
[policy_effect]
e = some(where (p.eft == allow))
[matchers]
m = g(r.sub, p.sub) && r.obj == p.obj && r.act == p.act

创建 config/permission_policy.csv：

p, data_engineer, training_data, read
p, data_engineer, training_data, write
p, data_engineer, training_data, delete
p, ml_engineer, model_parameters, read
p, ml_engineer, model_parameters, write
p, deployment_engineer, inference_api, read
p, deployment_engineer, inference_api, write
p, deployment_engineer, inference_api, delete
p, product_manager, training_log, read
p, customer, inference_api, read

整合所有组件

打开 src/main.py 创建完整的权限控制系统：

""" AI 权限控制系统主程序
整合所有组件，提供完整的权限管理功能
"""
from models.ai_assets import TrainingDataAsset, ModelParameterAsset, InferenceAPIAsset, TrainingLogAsset
from models.user_roles import DataEngineerRole, MLEngineerRole, DeploymentEngineerRole, ProductManagerRole, CustomerRole
from controllers.permission_controller import AIPermissionController
import json

class AIPermissionSystem:
    """完整的 AI 权限控制系统"""
    def __init__(self):
        # 初始化所有组件
        self.assets = {}  # AI 资产存储
        self.users = {}  # 用户存储
        self.controller = AIPermissionController()
        # 初始化角色
        self.roles = {
            'data_engineer': DataEngineerRole(),
            'ml_engineer': MLEngineerRole(),
            'deployment_engineer': DeploymentEngineerRole(),
            'product_manager': ProductManagerRole(),
            'customer': CustomerRole()
        }
        # 初始化审计日志
        self.audit_log = []

    def register_asset(self, asset):
        """注册 AI 资产"""
        self.assets[asset.asset_id] = asset
        # 自动根据资产敏感度设置基础权限
        self._set_base_permissions(asset)
        # 记录审计日志
        self.log_audit('asset_registered', f"注册资产：{asset}")
        return asset.asset_id

    def _set_base_permissions(self, asset):
        """根据资产敏感度自动设置基础权限"""
        if asset.sensitivity_level == 'critical':
            # 关键资产：只有管理员可以访问
            self.controller.grant_permission('system_admin', asset.asset_id, 'read', '自动设置')
            self.controller.grant_permission('system_admin', asset.asset_id, 'write', '自动设置')
        elif asset.sensitivity_level == 'high':
            # 高敏感资产：特定角色可读
            for role_name, role in self.roles.items():
                if role.get_permission_for(asset.asset_type)['read']:
                    self.controller.grant_permission(role_name, asset.asset_id, 'read', '自动设置')
        elif asset.sensitivity_level == 'medium':
            # 中等敏感资产：按角色矩阵设置
            for role_name, role in self.roles.items():
                permissions = role.get_permission_for(asset.asset_type)
                for action, allowed in permissions.items():
                    if allowed:
                        self.controller.grant_permission(role_name, asset.asset_id, action, '自动设置')

    def register_user(self, user_id, role_name):
        """注册用户"""
        if role_name not in self.roles:
            raise ValueError(f"角色 {role_name} 不存在")
        self.users[user_id] = {
            'role': role_name,
            'created_at': self._get_current_time(),
            'last_access': None
        }
        # 记录审计日志
        self.log_audit('user_registered', f"注册用户：{user_id} 角色：{role_name}")
        return True

    def check_user_access(self, user_id, asset_id, action):
        """检查用户访问权限"""
        # 检查用户是否存在
        if user_id not in self.users:
            self.log_audit('access_denied', f"用户不存在：{user_id}")
            return False
        # 获取用户角色
        user_role = self.users[user_id]['role']
        # 检查资产是否存在
        if asset_id not in self.assets:
            self.log_audit('access_denied', f"资产不存在：{asset_id}")
            return False
        # 使用控制器检查权限
        result = self.controller.check_access(user_role, asset_id, action)
        # 记录审计日志
        if result:
            self.log_audit('access_granted', f"用户 {user_id} ({user_role}) 成功访问 {asset_id} ({action})")
            self.users[user_id]['last_access'] = self._get_current_time()
        else:
            self.log_audit('access_denied', f"用户 {user_id} ({user_role}) 被拒绝访问 {asset_id} ({action})")
        return result

    def log_audit(self, event_type, message):
        """记录审计日志"""
        audit_entry = {
            'timestamp': self._get_current_time(),
            'event_type': event_type,
            'message': message,
            'system_state': self._get_system_state()
        }
        self.audit_log.append(audit_entry)
        # 打印到控制台（实际应用中应该写入数据库）
        print(f"[审计] {audit_entry}")

    def _get_current_time(self):
        """获取当前时间"""
        import datetime
        return datetime.datetime.now().isoformat()

    def _get_system_state(self):
        """获取系统状态"""
        return {
            'total_assets': len(self.assets),
            'total_users': len(self.users),
            'audit_log_count': len(self.audit_log)
        }

    def export_configuration(self):
        """导出配置"""
        config = {
            'assets': {id: vars(asset) for id, asset in self.assets.items()},
            'users': self.users,
            'roles': {name: vars(role) for name, role in self.roles.items()},
            'audit_log': self.audit_log[-100:]  # 最近 100 条审计日志
        }
        return json.dumps(config, indent=2)

    def import_configuration(self, config_json):
        """导入配置"""
        config = json.loads(config_json)
        # 这里可以实现配置导入逻辑
        print(f"导入配置：{len(config['assets'])} 个资产，{len(config['users'])} 个用户")

# 使用示例
if __name__ == "__main__":
    # 创建完整的权限系统
    system = AIPermissionSystem()
    # 注册一些 AI 资产
    user_dataset = TrainingDataAsset('user_dataset_v1', 1000000, contains_personal_data=True)
    llm_model = ModelParameterAsset('llm_v2', 'llm', 50000)
    chat_api = InferenceAPIAsset('chat_api_v1', 50)
    asset_ids = [
        system.register_asset(user_dataset),
        system.register_asset(llm_model),
        system.register_asset(chat_api)
    ]
    print(f"注册了 {len(asset_ids)} 个 AI 资产")
    # 注册一些用户
    user_ids = [
        system.register_user('john_data_engineer', 'data_engineer'),
        system.register_user('mary_ml_engineer', 'ml_engineer'),
        system.register_user('tom_product_manager', 'product_manager')
    ]
    print(f"注册了 {len(user_ids)} 个用户")
    # 测试权限检查
    print("\n=== 权限测试 ===\n")
    # 测试 1: 数据工程师读取用户数据集
    result1 = system.check_user_access('john_data_engineer', 'user_dataset_v1', 'read')
    print(f"数据工程师读取用户数据集：{result1}")
    # 测试 2: ML 工程师写入模型参数
    result2 = system.check_user_access('mary_ml_engineer', 'llm_v2', 'write')
    print(f"ML 工程师写入模型参数：{result2}")
    # 测试 3: 产品经理删除训练日志（应该被拒绝）
    result3 = system.check_user_access('tom_product_manager', 'llm_v2', 'delete')
    print(f"产品经理删除模型参数：{result3}")
    # 导出配置
    print("\n=== 配置导出 ===\n")
    config_json = system.export_configuration()
    print(f"配置导出大小：{len(config_json)} 字符")

自动化测试

创建 tests/unit/test_permission_system.py：

""" AI 权限系统单元测试 """
import unittest
from src.main import AIPermissionSystem
from src.models.ai_assets import TrainingDataAsset, ModelParameterAsset
from src.models.user_roles import DataEngineerRole, MLEngineerRole

class TestAIPermissionSystem(unittest.TestCase):
    """AI 权限系统测试类"""
    def setUp(self):
        """测试初始化"""
        self.system = AIPermissionSystem()
        # 注册测试资产
        self.user_data = TrainingDataAsset('test_user_data', 1000, contains_personal_data=True)
        self.model_param = ModelParameterAsset('test_model', 'classification', 500)
        self.system.register_asset(self.user_data)
        self.system.register_asset(self.model_param)
        # 注册测试用户
        self.system.register_user('test_data_engineer', 'data_engineer')
        self.system.register_user('test_ml_engineer', 'ml_engineer')

    def test_critical_asset_access(self):
        """测试关键资产访问"""
        # 数据工程师应该不能删除包含个人数据的资产
        result = self.system.check_user_access('test_data_engineer', 'test_user_data', 'delete')
        self.assertFalse(result, "数据工程师不应能删除包含个人数据的资产")

    def test_role_permission_matrix(self):
        """测试角色权限矩阵"""
        # ML 工程师应该能读取模型参数
        result = self.system.check_user_access('test_ml_engineer', 'test_model', 'read')
        self.assertTrue(result, "ML 工程师应能读取模型参数")

    def test_audit_logging(self):
        """测试审计日志"""
        # 执行一个访问操作
        self.system.check_user_access('test_data_engineer', 'test_user_data', 'read')
        # 检查审计日志
        audit_log = self.system.audit_log
        self.assertGreater(len(audit_log), 0, "审计日志应包含记录")
        # 检查最新的审计记录
        latest_event = audit_log[-1]['event_type']
        self.assertIn(latest_event, ['access_granted', 'access_denied'], "审计事件类型应为 access_granted 或 access_denied")

    def test_asset_auto_permission(self):
        """测试资产自动权限设置"""
        # 关键资产应只有管理员权限
        # 这里简化测试：检查基础权限设置
        print("资产自动权限设置测试通过")

    def test_config_export(self):
        """测试配置导出"""
        config_json = self.system.export_configuration()
        self.assertIsInstance(config_json, str, "配置导出应为字符串")
        self.assertGreater(len(config_json), 100, "配置导出应有足够的内容")

if __name__ == '__main__':
    unittest.main()

部署与监控

部署到生产环境

创建 docker-compose.yml 用于容器化部署：

version: '3.8'
services:
  # AI 权限服务
  ai-permission-service:
    build: .
    ports:
      - "8000:8000"
    environment:
      - DATABASE_URL=postgresql://admin:password@db:5432/ai_permission_db
      - REDIS_URL=redis://redis:6379
      - LOG_LEVEL=INFO
    depends_on:
      - db
      - redis
  # PostgreSQL 数据库
  db:
    image: postgres:14
    environment:
      - POSTGRES_DB=ai_permission_db
      - POSTGRES_USER=admin
      - POSTGRES_PASSWORD=password
    volumes:
      - db_data:/var/lib/postgresql/data
      - ./config/database_init.sql:/docker-entrypoint-initdb.d/init.sql
  # Redis 缓存
  redis:
    image: redis:7
    ports:
      - "6379:6379"
    volumes:
      - redis_data:/data
  # 监控服务
  monitor:
    image: grafana/grafana:latest
    ports:
      - "3000:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=admin
    volumes:
      - grafana_data:/var/lib/grafana
volumes:
  db_data:
  redis_data:
  grafana_data:

创建 Dockerfile：

FROM python:3.9-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
EXPOSE 8000
CMD ["python", "src/main.py"]

创建监控面板

创建 config/monitoring_config.yaml：

# AI 权限系统监控配置
monitoring:
  metrics:
    - permission_check_count
    - access_granted_count
    - access_denied_count
    - audit_log_size
    - user_count
    - asset_count
  alerts:
    high_risk_access:
      threshold: 10  # 每小时超过 10 次高风险访问
      action: email_to_admin
    abnormal_pattern:
      threshold: 5  # 连续 5 次异常模式
      action: block_user_temporarily
    system_overload:
      threshold: 1000  # 每秒权限检查超过 1000 次
      action: scale_up_service
  dashboards:
    realtime_monitoring:
      panels:
        - permission_heatmap
        - user_activity
        - asset_access_pattern
    security_report:
      panels:
        - risk_assessment
        - audit_summary
        - compliance_check
    performance:
      panels:
        - response_time
        - system_load
        - error_rate

自动化运维脚本

创建 scripts/automated_ops.py：

""" AI 权限系统自动化运维脚本 """
import subprocess
import json
import time
from datetime import datetime

class AutomatedOps:
    """自动化运维"""
    def daily_backup(self):
        """每日备份"""
        timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
        backup_file = f"data/backups/system_backup_{timestamp}.json"
        # 导出当前配置
        subprocess.run(["python", "src/main.py", "--export", backup_file])
        print(f"[备份] 创建备份文件：{backup_file}")

    def check_system_health(self):
        """检查系统健康"""
        health_report = {
            'timestamp': datetime.now().isoformat(),
            'database_connection': self._check_db(),
            'redis_connection': self._check_redis(),
            'service_response': self._check_service(),
            'audit_log_rotation': self._check_log_rotation(),
            'permission_policy_validity': self._check_policy()
        }
        # 保存健康报告
        with open("data/logs/health_report.json", "w") as f:
            json.dump(health_report, f, indent=2)
        # 如果有问题，发送警报
        if not all(health_report.values()):
            self.send_alert(health_report)

    def rotate_audit_logs(self):
        """审计日志轮转"""
        # 将旧的审计日志归档
        archive_file = f"data/logs/audit_archive_{datetime.now().strftime('%Y%m')}.json"
        subprocess.run(["python", "scripts/log_rotation.py", archive_file])
        print(f"[日志轮转] 归档审计日志：{archive_file}")

    def update_permission_policies(self):
        """更新权限策略"""
        # 从 Git 获取最新策略
        subprocess.run(["git", "pull", "origin", "main"])
        # 重新加载策略
        subprocess.run(["python", "scripts/policy_update.py"])
        print("[策略更新] 更新权限策略完成")

    def _check_db(self):
        """检查数据库连接"""
        try:
            # 这里应该实现实际的数据库检查
            return True
        except Exception as e:
            print(f"[健康检查] 数据库连接失败：{e}")
            return False

    def _check_redis(self):
        """检查 Redis 连接"""
        try:
            # 这里应该实现实际的 Redis 检查
            return True
        except Exception as e:
            print(f"[健康检查] Redis 连接失败：{e}")
            return False

    def _check_service(self):
        """检查服务响应"""
        try:
            response = subprocess.run(["curl", "http://localhost:8000/health"], capture_output=True, text=True)
            return response.stdout.strip() == "OK"
        except Exception as e:
            print(f"[健康检查] 服务响应失败：{e}")
            return False

    def _check_log_rotation(self):
        """检查日志轮转"""
        # 检查日志文件大小
        log_size = subprocess.run(["du", "-sh", "data/logs/audit.log"], capture_output=True, text=True)
        size_str = log_size.stdout.split()[0]
        # 如果大于 100MB，需要轮转
        if "M" in size_str:
            size_mb = float(size_str.replace("M", ""))
            return size_mb < 100
        else:
            return True

    def _check_policy(self):
        """检查权限策略有效性"""
        # 运行策略测试
        test_result = subprocess.run(["python", "tests/unit/test_permission_policy.py"], capture_output=True, text=True)
        return test_result.returncode == 0

    def send_alert(self, health_report):
        """发送警报"""
        problem_areas = []
        for area, status in health_report.items():
            if not status:
                problem_areas.append(area)
        alert_message = f"AI 权限系统健康问题：{', '.join(problem_areas)}"
        # 这里可以发送邮件、短信或通知
        print(f"[警报] {alert_message}")

if __name__ == "__main__":
    ops = AutomatedOps()
    print("=== 开始自动化运维 ===\n")
    # 执行每日备份
    ops.daily_backup()
    # 检查系统健康
    ops.check_system_health()
    # 如果需要，轮转审计日志
    if not ops._check_log_rotation():
        ops.rotate_audit_logs()
    print("\n=== 自动化运维完成 ===")

安全演练：模拟数据泄露

创建 scripts/simulate_meta_leak.py：

""" 模拟 Meta AI 数据泄露事故
演示权限配置错误导致的敏感数据暴露
"""
import time
from src.main import AIPermissionSystem
from src.models.ai_assets import TrainingDataAsset, ModelParameterAsset

def simulate_leak_scenario():
    """模拟数据泄露场景"""
    print("=== 模拟 Meta AI 数据泄露事故 ===\n")
    # 创建权限系统
    system = AIPermissionSystem()
    # 创建一些敏感资产
    sensitive_data = TrainingDataAsset('meta_sensitive_data', 5000000, contains_personal_data=True)
    proprietary_model = ModelParameterAsset('meta_proprietary_model', 'llm', 100000)
    system.register_asset(sensitive_data)
    system.register_asset(proprietary_model)
    # 注册一些用户
    system.register_user('engineer_john', 'data_engineer')
    system.register_user('engineer_mary', 'ml_engineer')
    system.register_user('admin_tom', 'system_admin')
    print("初始状态：敏感数据只有管理员可访问")
    print(f"管理员访问敏感数据：{system.check_user_access('admin_tom', 'meta_sensitive_data', 'read')}")
    print(f"工程师访问敏感数据：{system.check_user_access('engineer_john', 'meta_sensitive_data', 'read')}")
    print("\n=== 模拟配置错误 ===\n")
    # 模拟 Meta 的配置错误：将敏感数据权限设置为'全员可见'
    print("模拟错误：手动将敏感数据权限设置为全员可见")
    # 错误配置：授予所有角色读取权限
    all_roles = ['data_engineer', 'ml_engineer', 'deployment_engineer', 'product_manager', 'customer']
    for role in all_roles:
        # 模拟权限配置错误
        system.controller.grant_permission(role, 'meta_sensitive_data', 'read', '错误配置：全员可见')
    print("配置错误已发生！敏感数据现在全员可见")
    print("\n=== 检测到泄露 ===\n")
    # 模拟泄露检测
    leak_detected = False
    for role in all_roles:
        access_result = system.check_user_access(f'test_{role}', 'meta_sensitive_data', 'read')
        if access_result:
            print(f"检测到：{role} 角色可以访问敏感数据")
            leak_detected = True
    if leak_detected:
        print("\n[警报] 检测到敏感数据泄露！")
        print("立即执行应急响应...")
        # 模拟应急响应
        print("1. 立即撤销错误权限")
        for role in all_roles:
            system.controller.revoke_permission(role, 'meta_sensitive_data', 'read', '紧急修复')
        print("2. 锁定系统")
        print("3. 通知安全团队")
        print("4. 审计日志分析")
        print("\n应急响应完成，系统已修复")
    # 检查修复结果
    print("\n=== 修复验证 ===\n")
    print(f"管理员访问：{system.check_user_access('admin_tom', 'meta_sensitive_data', 'read')}")
    print(f"工程师访问：{system.check_user_access('engineer_john', 'meta_sensitive_data', 'read')}")
    print("\n=== 经验教训 ===\n")
    print("1. 权限变更必须经过风险评估")
    print("2. 自动权限审计系统必须实时运行")
    print("3. 敏感资产的权限变更需要多重审批")
    print("4. 定期进行权限配置检查")

def run_leak_prevention_demo():
    """运行泄露预防演示"""
    print("\n=== 泄露预防措施演示 ===\n")
    system = AIPermissionSystem()
    # 创建敏感资产
    sensitive_asset = TrainingDataAsset('prevention_demo_data', 'critical')
    system.register_asset(sensitive_asset)
    print("预防措施 1：权限变更风险评估")
    print(" - 每次权限变更前评估风险等级")
    print(" - 高风险变更需要额外审批")
    print("\n预防措施 2：自动化权限测试")
    print(" - 权限变更后自动运行测试")
    print(" - 确保权限矩阵保持一致")
    print("\n预防措施 3：实时监控和警报")
    print(" - 监控异常访问模式")
    print(" - 实时发送警报")
    print("\n预防措施 4：定期审计")
    print(" - 每周自动审计权限配置")
    print(" - 生成安全报告")
    print("\n预防措施 5：灾难恢复演练")
    print(" - 定期模拟权限泄露事故")
    print(" - 测试应急响应流程")

if __name__ == "__main__":
    simulate_leak_scenario()
    run_leak_prevention_demo()

性能优化

创建 scripts/performance_optimization.py：

""" AI 权限系统性能优化 """
import time
from functools import lru_cache

class PermissionCache:
    """权限缓存优化"""
    def __init__(self):
        self.cache = {}
        self.hit_count = 0
        self.miss_count = 0

    @lru_cache(maxsize=1000)
    def cached_check(self, user_role, asset_id, action):
        """缓存权限检查"""
        # 模拟权限检查
        key = f"{user_role}_{asset_id}_{action}"
        if key in self.cache:
            self.hit_count += 1
            return self.cache[key]
        else:
            self.miss_count += 1
            result = self._actual_check(user_role, asset_id, action)
            self.cache[key] = result
            return result

    def _actual_check(self, user_role, asset_id, action):
        """实际的权限检查"""
        # 这里应该是实际的权限检查逻辑
        time.sleep(0.001)  # 模拟耗时
        return True  # 简化实现

    def get_cache_stats(self):
        """获取缓存统计"""
        return {
            'total_cache_size': len(self.cache),
            'hit_count': self.hit_count,
            'miss_count': self.miss_count,
            'hit_rate': self.hit_count / (self.hit_count + self.miss_count) if (self.hit_count + self.miss_count) > 0 else 0
        }

class BulkPermissionProcessor:
    """批量权限处理优化"""
    def process_bulk_checks(self, check_list):
        """批量处理权限检查"""
        # 批量处理减少 IO 开销
        results = []
        # 分组处理
        grouped_by_role = {}
        for check in check_list:
            role = check['user_role']
            if role not in grouped_by_role:
                grouped_by_role[role] = []
            grouped_by_role[role].append(check)
        # 为每个角色批量处理
        for role, checks in grouped_by_role.items():
            batch_results = self._process_role_batch(role, checks)
            results.extend(batch_results)
        return results

    def _process_role_batch(self, role, checks):
        """处理角色批量检查"""
        # 这里可以实现批量数据库查询等优化
        results = []
        for check in checks:
            results.append({'check': check, 'result': True})  # 简化实现
        return results

if __name__ == "__main__":
    print("=== 性能优化演示 ===\n")
    # 缓存优化测试
    cache = PermissionCache()
    # 模拟多次权限检查
    test_checks = [
        ('data_engineer', 'dataset_v1', 'read'),
        ('ml_engineer', 'model_v2', 'write'),
        ('data_engineer', 'dataset_v1', 'read'),  # 重复检查
        ('ml_engineer', 'model_v2', 'write'),  # 重复检查
    ]
    for check in test_checks:
        cache.cached_check(*check)
    stats = cache.get_cache_stats()
    print(f"缓存统计：{stats}")
    print(f"命中率：{stats['hit_rate']:.2%}")
    # 批量处理测试
    bulk_processor = BulkPermissionProcessor()
    bulk_checks = [
        {'user_role': 'data_engineer', 'asset_id': 'asset1', 'action': 'read'},
        {'user_role': 'data_engineer', 'asset_id': 'asset2', 'action': 'write'},
        {'user_role': 'ml_engineer', 'asset_id': 'asset3', 'action': 'read'},
        {'user_role': 'ml_engineer', 'asset_id': 'asset4', 'action': 'write'},
    ]
    results = bulk_processor.process_bulk_checks(bulk_checks)
    print(f"\n批量处理结果数：{len(results)}")

AI 驱动的权限优化

创建 scripts/ai_driven_permission_optimizer.py：

""" AI 驱动的权限优化
使用机器学习优化权限配置
"""
import numpy as np
from sklearn.cluster import KMeans
from sklearn.preprocessing import StandardScaler

class PermissionPatternLearner:
    """权限模式学习器"""
    def __init__(self):
        self.access_patterns = []
        self.user_clusters = {}
        self.asset_clusters = {}

    def collect_access_data(self, access_logs):
        """收集访问数据"""
        for log in access_logs:
            pattern = {
                'user_role': log['user_role'],
                'asset_type': log['asset_type'],
                'action': log['action'],
                'time_of_day': log['time_of_day'],
                'success_rate': log['success_rate']
            }
            self.access_patterns.append(pattern)

    def cluster_users_by_access_pattern(self):
        """根据访问模式聚类用户"""
        # 准备数据
        feature_matrix = []
        for pattern in self.access_patterns:
            # 将访问模式转换为特征向量
            features = [
                pattern['time_of_day'],
                pattern['success_rate'],
                len(pattern['action']),
                hash(pattern['asset_type']) % 100
            ]
            feature_matrix.append(features)
        # 使用 K-means 聚类
        scaler = StandardScaler()
        scaled_features = scaler.fit_transform(feature_matrix)
        kmeans = KMeans(n_clusters=3, random_state=42)
        clusters = kmeans.fit_predict(scaled_features)
        # 将用户分配到聚类
        for i, pattern in enumerate(self.access_patterns):
            cluster_id = clusters[i]
            user_role = pattern['user_role']
            if user_role not in self.user_clusters:
                self.user_clusters[user_role] = cluster_id
        return self.user_clusters

    def suggest_optimized_permissions(self):
        """建议优化的权限配置"""
        optimized_permissions = {}
        for user_role, cluster_id in self.user_clusters.items():
            # 获取该聚类的典型访问模式
            cluster_patterns = []
            for i, pattern in enumerate(self.access_patterns):
                if pattern['user_role'] == user_role:
                    cluster_patterns.append(pattern)
            # 计算最优权限
            suggested_permission = self._calculate_optimal_permission(cluster_patterns)
            optimized_permissions[user_role] = suggested_permission
        return optimized_permissions

    def _calculate_optimal_permission(self, patterns):
        """计算最优权限"""
        # 基于模式计算权限
        permission = {}
        for pattern in patterns:
            asset_type = pattern['asset_type']
            action = pattern['action']
            success_rate = pattern['success_rate']
            # 如果成功率高于阈值，建议保留权限
            if success_rate > 0.7:
                permission_key = f"{asset_type}_{action}"
                permission[permission_key] = True
            else:
                permission[permission_key] = False
        return permission

    def predict_access_risk(self, new_access_pattern):
        """预测新访问的风险"""
        # 基于历史数据预测
        risk_score = 0
        # 检查异常特征
        if new_access_pattern['time_of_day'] > 23 or new_access_pattern['time_of_day'] < 6:
            risk_score += 0.3
        if new_access_pattern['asset_type'] == 'critical' and new_access_pattern['action'] == 'write':
            risk_score += 0.4
        if new_access_pattern['user_role'] not in self.user_clusters:
            risk_score += 0.2
        return risk_score

class PermissionAutomation:
    """权限自动化管理"""
    def auto_grant_permissions(self, user_role, access_history):
        """自动授予权限"""
        # 分析历史访问模式
        frequently_accessed = self._analyze_frequency(access_history)
        # 自动授予频繁访问的权限
        for asset_action in frequently_accessed:
            asset_type, action = asset_action.split('_')
            print(f"自动授予 {user_role}{asset_type} 的 {action} 权限")
            # 这里应该调用实际的权限授予函数

    def auto_revoke_permissions(self, user_role, inactive_periods):
        """自动撤销权限"""
        # 检查长期不使用的权限
        unused_permissions = self._find_unused_permissions(user_role, inactive_periods)
        for permission in unused_permissions:
            print(f"自动撤销 {user_role} 的 {permission} 权限")
            # 这里应该调用实际的权限撤销函数

    def _analyze_frequency(self, access_history):
        """分析访问频率"""
        frequency_map = {}
        for record in access_history:
            key = f"{record['asset_type']}_{record['action']}"
            if key not in frequency_map:
                frequency_map[key] = 0
            frequency_map[key] += 1
        # 返回高频访问项（超过阈值）
        return [k for k, v in frequency_map.items() if v > 10]

    def _find_unused_permissions(self, user_role, inactive_periods):
        """查找未使用的权限"""
        unused_permissions = []
        for permission, last_used in inactive_periods.items():
            # 如果超过 30 天未使用
            if last_used > 30:
                unused_permissions.append(permission)
        return unused_permissions

if __name__ == "__main__":
    print("=== AI 驱动的权限优化演示 ===\n")
    # 权限模式学习器演示
    learner = PermissionPatternLearner()
    # 模拟一些访问日志
    access_logs = [
        {'user_role': 'data_engineer', 'asset_type': 'training_data', 'action': 'read', 'time_of_day': 10, 'success_rate': 0.95},
        {'user_role': 'data_engineer', 'asset_type': 'training_data', 'action': 'write', 'time_of_day': 15, 'success_rate': 0.85},
        {'user_role': 'ml_engineer', 'asset_type': 'model_parameters', 'action': 'read', 'time_of_day': 11, 'success_rate': 0.90},
        {'user_role': 'ml_engineer', 'asset_type': 'model_parameters', 'action': 'write', 'time_of_day': 13, 'success_rate': 0.75},
    ]
    learner.collect_access_data(access_logs)
    # 聚类用户
    user_clusters = learner.cluster_users_by_access_pattern()
    print(f"用户聚类结果：{user_clusters}")
    # 建议优化权限
    optimized_permissions = learner.suggest_optimized_permissions()
    print(f"优化权限建议：{optimized_permissions}")
    # 预测新访问风险
    new_pattern = {'user_role': 'data_engineer', 'asset_type': 'critical', 'action': 'write', 'time_of_day': 2, 'success_rate': 0.5}
    risk_score = learner.predict_access_risk(new_pattern)
    print(f"新访问风险评分：{risk_score}")
    # 权限自动化演示
    automation = PermissionAutomation()
    # 模拟访问历史
    user_history = [
        {'asset_type': 'training_data', 'action': 'read'},
        {'asset_type': 'training_data', 'action': 'write'},
        {'asset_type': 'training_data', 'action': 'read'},
        {'asset_type': 'processed_data', 'action': 'read'},
    ]
    automation.auto_grant_permissions('data_engineer', user_history)
    # 模拟未使用权限
    inactive_periods = {'training_data_delete': 45, 'model_parameters_write': 30}  # 示例值
    automation.auto_revoke_permissions('data_engineer', inactive_periods)