Skip to main content

AI Cost Firewall v0.8.6 — Usage Guard Compatibility and Security Hardening

AI Cost Firewall v0.8.6 improves integration with VCAL Usage Guard v0.2.0 and addresses four vulnerabilities in the transitive rustls dependency. This maintenance release extends Usage Guard inspection to supported structured message content and strengthens handling of invalid guard responses.

The release builds on the Privacy Guard structured-content improvements in v0.8.4 and Security Guard compatibility fixes in v0.8.5. Existing Observe → Enforce behavior, controlled streaming, Assessment Context, and OpenAI-compatible APIs remain available.

Structured-content Usage Guard integration​

AIF now forwards the original JSON message content (serde_json::Value) to Usage Guard for request-side policy evaluation, including plain strings and structured arrays containing supported typed text and input_text parts.

Previously, the AIF Usage Guard adapter relied on string-only message content, so text nested inside structured arrays could be omitted from policy evaluation. With Usage Guard v0.2.0, supported text-bearing structures can be inspected without flattening or silently discarding them.

Unsupported message-content shapes are submitted to the Guard for explicit validation rather than treated as absent. Usage Guard determines which structures it accepts under its input-validation rules.

Inspection coverage and enforcement safety​

Usage Guard evaluates applicable request content before cache lookup or upstream LLM execution. A block or escalate decision remains non-executable: AIF does not forward a denied request to the model or serve it from cache.

The integration also distinguishes operational failures from invalid policy or response contracts:

  • Operational timeouts and service unavailability follow the configured guard_fail_open behavior.
  • Invalid requests, authentication/authorization failures, and malformed or empty Guard responses are not interpreted as fail-open approval.
  • Invalid Guard responses cannot silently turn a restrictive decision into an allowed request.

For strict usage-policy enforcement, the recommended configuration remains guard_fail_open false;.

TLS dependency vulnerability mitigation​

The resolved rustls dependency is updated from 0.23.45 to 0.23.46, addressing four advisories published on October 14, 2026:

  • RUSTSEC-2026-0346 — debug formatting of client session values could expose TLS secrets.
  • RUSTSEC-2026-0347 — buffered application data could be sent to the outer server following ECH rejection.
  • RUSTSEC-2026-0348 — Brotli certificate decompression could allocate excessive memory before authentication.
  • RUSTSEC-2026-0349 — an unauthenticated ServerHello could influence key-exchange selection on subsequent connections.

This is a dependency-level mitigation; no AIF API changes are required for the TLS fixes.

Testing and validation​

The v0.8.6 integration validation with VCAL Usage Guard v0.2.0 completed with 45 PASS / 0 FAIL / 3 SKIP.

Validated scenarios included structured-content forwarding, policy blocking and escalation before upstream execution, unsupported-content rejection, invalid-response handling, and controlled-streaming compatibility. The skipped scenarios are not represented as validated by this result.

For source builds, confirm the resolved version with cargo tree -i rustls and run cargo test --locked and cargo audit against the release lockfile.

Compatibility​

  • No breaking changes to the public OpenAI-compatible API or AIF configuration schema are introduced.
  • Evaluation Mode (observe / enforce) and its isolated shadow caches remain available; this mode controls AIF cache evaluation, not Usage Guard policy enforcement.
  • Controlled streaming and existing JSON/SSE handling remain supported.
  • Existing Privacy Guard v0.3.0 and Security Guard v0.3.0 integrations are retained.
  • Exact Redis and semantic Qdrant caching retain their existing eligibility and isolation rules.
  • GET /assessment-context, aif_runtime_info, and existing assessment workflows remain available.
  • Docker, Docker Compose, Kubernetes, and OpenShift deployment patterns remain supported.
  • Evidence schema remains vcal.evidence.event 1.1.

Scope and limitations​

Usage Guard v0.2.0 is a separately licensed, optional module; it is not bundled with the open-source AIF gateway. Structured-content support applies to recognized request-side text parts, not inspection of image, audio, document, or attachment contents. This release does not introduce Usage Guard response-direction scanning or expand semantic-cache eligibility beyond supported plain-string content.

Usage Guard v0.2.0 introduces a foundation for trusted gateway identity context, but AIF v0.8.6 does not forward verified per-user or department identity. Keep VCAL_USAGE_GUARD_TRUSTED_CONTEXT_KEY unset/disabled for this integration. Client-provided identity headers are not, by themselves, authenticated context. Department authorization, budget governance, and a Usage Guard-specific Evaluation Mode are not included.

Upgrade guidance​

Upgrade AIF to v0.8.6 to receive the patched rustls dependency. If using Usage Guard for structured message content, deploy VCAL Usage Guard v0.2.0 alongside it.

After upgrading, verify that structured-content requests are evaluated, block and escalate decisions prevent cache lookup and upstream execution, unsupported content is rejected as configured, and malformed Guard responses do not bypass enforcement. Confirm controlled-streaming behavior and test outage handling with the intended guard_fail_open setting.

Build container images using the updated Cargo.lock, rerun vulnerability scans, and keep trusted-context credentials disabled until an authenticated AIF-to-Usage-Guard identity integration is implemented. No configuration-schema migration is required for this update.