A Shiny app for InfoSec: which models may see which data
Once a bank lets analysts use language models, someone has to decide which models may see what. Customer PANs to the in-house model on the analyst's laptop: probably fine. To a shared GPU server: perhaps not. To an external provider: no. A card number with its CVV: never. That someone is usually InfoSec or compliance, and they should not have to edit YAML to say it.
credgate keeps these decisions in a policy, and its R package includes a Shiny app to edit one. This post walks through it.