Status: 📋 Specification
Spec: FW-51-automation-rule-copilot.md
Last Updated: 2026-03-20
Overview
FW-51 adds natural-language assistance for drafting automation rules. It extends FW-03 using Platform AI (PF-27) only—no new database tables. Suggestions apply to existingfw_automation_rules and fw_automation_actions under existing RLS and permissions.
Integration Points (from Spec)
Event / API Contracts
- No new domain events for FW-51 Phase 1.
- AI invocation: Existing Platform AI /
ai-assistantpath used byuseAIStructuredOutput(same as FW-44/FW-50). Request/response shapes are defined by the feature Zod schema in FW code; tenant and auth follow PF-27 standards. - Apply mutations: Transactional
SECURITY DEFINERRPC (fw_apply_rule_with_actions) onfw_automation_rules/fw_automation_actionswithorganization_idenforced inside the function. Existing RLS still applies for non-RPC reads.
Security and Tenant Isolation
- Suggest and apply gated by existing automation-rule edit permissions;
organization_idenforced on all writes. - Prompts: rule name + purpose description only; do not send existing rule payloads that could contain PHI/PII.
- Audit: log apply events with counts and metadata only (see spec)—no user description in audit plain text.
Permissions (Phase 1)
- No new
pf_module_permissionsrows. Use the same gates as Automation Rule Builder; spec referencesfw.automations.admin(FW_PERMISSIONS.AUTOMATIONS_ADMIN) as the canonical automation admin key—keep UI consistent with builder when implementing.