{
  "id": "security_privacy_prelude_insight",
  "type": "prelude_insight",
  "theme": "security_privacy",
  "title": "Security / Privacy 前导洞察：先定义 agentic 功能的安全底线",
  "label": "Security & Privacy",
  "status": "prelude_ready",
  "evidence_grade": "A- · Apple-source indexed transcript",
  "intent": "进入 PoC 或分工前的认知对齐材料，不承诺排期。",
  "core_thesis": "Agentic features 会放大数据访问、工具调用和自动执行的风险；安全与隐私不应是上线前审查，而应成为 action schema、tool permission、provider selection 和 telemetry 的设计输入。",
  "what_to_align_first": [
    "不要在功能完成后才补安全审查。",
    "不要让工具调用拥有默认权限，必须最小授权。",
    "不要让 provider selection 隐式发生，用户数据边界要明确。",
    "不要只看模型输出风险，还要看工具执行风险。",
    "不要缺少审计轨迹，高风险 agent action 必须可追溯。"
  ],
  "prelude_questions": [
    {
      "area": "隐私 / 安全",
      "question": "哪些数据可以进入 on-device、PCC、第三方 provider？"
    },
    {
      "area": "AI 平台",
      "question": "tool permission 和 provider policy 如何表达成配置？"
    },
    {
      "area": "客户端工程",
      "question": "本地权限、系统授权、用户确认和审计日志如何打通？"
    },
    {
      "area": "产品",
      "question": "哪些 agentic action 需要用户显式授权或二次确认？"
    },
    {
      "area": "QA",
      "question": "如何构造越权、注入、误执行和数据泄漏测试？"
    },
    {
      "area": "法务 / 合规",
      "question": "不同区域和业务线的 provider 使用边界是什么？"
    }
  ],
  "recommended_next_step": "先开一次 60-90 分钟 Security & Privacy 前导洞察评审会，只做认知对齐、方向排序和分工准备。",
  "deferred_items": [
    "Agentic security review checklist",
    "Tool permission model",
    "Provider data boundary policy",
    "Audit trail requirements"
  ],
  "source_sessions": [
    {
      "session_id": "201",
      "title": "Secure your apps with App Attest",
      "priority": "P2",
      "apple_url": "https://developer.apple.com/videos/play/wwdc2026/201"
    },
    {
      "session_id": "347",
      "title": "Secure your app: mitigate risks to agentic features",
      "priority": "P2",
      "apple_url": "https://developer.apple.com/videos/play/wwdc2026/347"
    },
    {
      "session_id": "379",
      "title": "Meet Trust Insights",
      "priority": "P2",
      "apple_url": "https://developer.apple.com/videos/play/wwdc2026/379"
    }
  ],
  "last_updated": "2026-06-09"
}