Security & Compliance — @kaltura/intelligent-agents

This SDK is built for enterprise and government deployments. It is secure by default, low-friction by design: the safe path is the clear path, and where strict compliance would otherwise hurt usability the SDK keeps the ergonomic default and gives you a config knob plus a compliance note to tighten it.

• No runtime dependencies, no install scripts. Zero transitive supply-chain surface — the SDK is sourced directly from git (src/), not a package registry. Enforced in CI.
• All cryptography is delegated to the platform. The SDK never rolls its own crypto — TLS, DTLS-SRTP (the encryption protocol securing WebRTC audio and video), and base64 come from the host (Node tls/crypto, browser WebCrypto/TLS). Run Node/OpenSSL in FIPS mode and a FIPS-validated OS/browser to operate in a FIPS-validated configuration (NIST SC-13).
• Secrets never reach the client. The Admin Secret lives only server-side in Management; the browser KalturaAvatarSession takes only a short-lived, entitlement-ON conversation token.

Framework crosswalks — HIPAA, HITRUST, the OWASP LLM/Agentic Top 10, and avatar/deepfake/voice-clone law (EU AI Act Art. 50, NO FAKES, CA SB 1001, BIPA, C2PA) — are mapped control-by-control in the framework crosswalks below, with a copy-paste secure production baseline config.

Reporting a vulnerability

Email security@kaltura.com with details and a PoC if available. Please do not open a public issue for an undisclosed vulnerability. We acknowledge within a few business days and coordinate disclosure (NIST IR-6 / SI-2 is the operator's reporting duty; this is the vendor contact).

Table of contents

• AI-application controls
• KS guidance for agents
• Token lifecycle
• Audit logging
• Transport security
• Browser hardening
• Isolation & multi-tenancy
• Supply-chain integrity
• Shared-responsibility control matrix
• FIPS mode
• Data residency
• Framework crosswalks
  • HIPAA
  • HITRUST CSF
  • OWASP Top 10 for LLM Applications
  • OWASP Agentic
  • Avatar / digital-human / deepfake / voice-clone
  • Secure production baseline

AI-application controls (OWASP LLM/Agentic; HIPAA technical safeguards)

Beyond the platform controls below, the SDK exposes DX-first guardrails for the AI/agent layer, detailed in the framework crosswalks below. Most require you to opt in by passing a callback or option. Two run automatically regardless of configuration: the idle-timeout auto-logoff (900000 ms, 15 minutes, by default — pass 0 to disable) and the AI-disclosure event, which fires before the avatar's first words on every connect.

KS (Kaltura Session) guidance for agents (AC-3 / AC-6 / IA-2)

A KS carries the privileges that decide what it can do. The full privilege reference is Kaltura's own docs, not this page — see Kaltura API Authentication and Security. What follows is only what matters for agent/avatar deployments.

Default recommendation: mint conversation/agent/widget tokens for anything reaching a browser, and keep admin tokens server-side. createConversationToken/createAgentToken refuse extraPrivileges that disable entitlement, so neither method can be tricked into minting an entitlement-bypassing token — tested and gated (test/unit/scope-guard.test.js, test/integration/sessions.test.js).

Whether a given browser session should instead carry broadened (entitlement-bypassing) access is an application-level decision you make when you mint that session's token server-side — not something this SDK enforces on the client. A real KS's privileges are AES-encrypted with the partner secret and are not client-readable (inspectKs() reports disableEntitlement: null for a real token; see src/management/ks-inspect.js), so a client-side check would be inert for production tokens and isn't attempted.

Token lifecycle (RFC 9700 OAuth 2.0 Security BCP; NIST AC family)

• Short-lived by default: browser-bound tokens (conversation/agent) default to 30 minutes, admin to 1 hour. Short TTL is the primary revocation lever for a stateless KS (RFC 9700 §6.1). Override per call with ttlSeconds; absurd lifetimes on browser-bound kinds are rejected (ttl_too_long). UX note: "refresh" means your server re-mints a fresh short token, and the browser calls session.setToken(freshKs) to rotate mid-session without a reconnect.

• Least privilege / binding (RFC 9700 §2.3, §4.10): tighten a token with the structured restrictions option instead of hand-crafting privilege strings — { role, actionsLimit, ipRestrict, uriRestrict, sessionGroupId } compile to the matching Kaltura privileges (setrole/actionslimit/iprestrict/ urirestrict/sessionid). Defaults stay wide-open so nobody is surprise-locked out; tightening is opt-in.

• Active revocation (RFC 9700 §5.2.1.1; SOC 2 CC6.2/CC6.3): sessions.revoke(tokenOrKs) ends a leaked token now (Kaltura session/end). Mint a family with restrictions.sessionGroupId and, by design, one revoke is intended to kill the whole group — this cascade is asserted by design and verified only at the KS-privilege-string level (the token really does carry sessionid:<id>), not independently confirmed against live backend revocation semantics. Returns a _meta revocation receipt.

• Vault/KMS (NIST IA-5): pass getAdminSecret: () => fetchFromVault() to fetch the secret per-mint instead of holding it; it is never stored as an enumerable field.

• Incident runbook — revoke a leaked conversation token:

  await management.sessions.revoke(leakedKs);   // or revoke(token)
  // if minted with restrictions.sessionGroupId: revoking any member is DESIGNED to end
  // the family (asserted by design, not independently live-verified — see above).
  

Audit logging (NIST AU-2 / AU-3 / AU-12; OWASP Logging; SOC 2 CC7)

The SDK is an event emitter, not a logging framework. Pass onAuditEvent to Management and/or KalturaAvatarSession (opt-in — no event fires until you pass this hook) to receive discrete, already-redacted, structured AuditEvent objects and route them into your SIEM:

new Management({ partnerId, adminSecret, onAuditEvent: (e) => siem.write(e) });

Event catalog

Event fields

Every event carries this AU-3 content shape:

Guarantees

• The raw KS is never included in an event — only its kind and scope.
• Free-text fields are stripped of CR/LF (CWE-117 log-injection guard).
• A throwing SIEM sink can never break a mint or a live turn — event emission is crash-safe.
• This audit stream is distinct from the chatty debug logger and is never gated behind a debug level.

Transport security (NIST SC-8; OWASP WSS/TLS)

KalturaAvatarSession rejects non-TLS conversationManagerUrl/srsBaseUrl (insecure_transport). localhost/127.0.0.1 is allowed for dev with a loud one-time warning; non-localhost cleartext requires an explicit allowInsecureTransport:true (dev/test only — never production). Prefer server-minted ephemeral TURN credentials (turnCredentials from appInit, RFC 7635) over the static fallback; the SDK warns when it falls back.

Browser hardening (OWASP ASVS / WebSocket CS)

• Memory-only token: the SDK keeps the token in a non-enumerable instance field and drops it on disconnect(). Do not put a conversation token in localStorage/sessionStorage (XSS-exfiltratable) — pass it directly and re-mint from your server on reload.
• No token in URLs: tokens travel only in the socket auth field or the Authorization header, never a query string (OWASP API2:2023).
• Prototype-pollution guard: setDynamicPrompt data is scrubbed of __proto__/constructor/prototype before it touches the wire.
• CSP: the SDK uses no eval/new Function. A working policy sets connect-src to your CM (Conversation Manager — the live-session control-plane host, conversationManagerUrl) plus your WHEP video-egress host (srsBaseUrl) plus your TURN host; media-src blob:; script-src your injected socket.io origin, pinned with SRI (see the README's "Injecting socket.io securely"). Set frame-ancestors on the embedding page — a mic-capable widget warrants anti-clickjacking headers.
• AI disclosure (EU AI Act Art. 50): a disclosure event fires before the avatar's first words. requireDisclosureAck holds the avatar greeting until acknowledgeDisclosure(). Note: ASR (Automatic Speech Recognition — the mic-to-text channel) connects before disclosure, so obtain consent before connect() in IL/TX/WA.

Isolation & multi-tenancy (NIST SC-4 / AC-6(4))

No SDK module holds credential or tenant state at module scope — the admin secret, KS, and partnerId live only as (non-enumerable) instance fields. A single process can safely run N Management and M KalturaAvatarSession instances for different tenants with fully independent tokens, transports, and teardown; nothing is shared or global (tested in test/unit/isolation.test.js).

Supply-chain integrity (SLSA / OpenSSF / EO 14028)

• Zero runtime dependencies, no install lifecycle scripts (CI-enforced).
• No registry publish step. The SDK is consumed straight from its git tags (src/, imported by path or served via jsDelivr's GitHub CDN once the repo is public) — there is no npm package, and so no registry-side supply-chain surface to audit.

Shared-responsibility control matrix (NIST 800-53)

The SDK generates and protects the records and enforces the client-side controls below; the operator owns storage-side controls a client library cannot provide (retention, tamper-evidence, non-repudiation).

FIPS mode (how-to)

# Node with an OpenSSL FIPS provider:
node --enable-fips your-server.js
# or via OpenSSL 3 FIPS provider config (OPENSSL_CONF / fipsmodule.cnf)

In the browser, FIPS validation is a property of the OS/browser crypto module. Deploy on a FIPS-validated platform; the SDK adds no non-validated crypto.

Data residency (SC-7)

The SDK is a thin client. It contacts only the Kaltura endpoints you configure (agenticUrl/genieUrl/ovpUrl/conversationManagerUrl/srsBaseUrl/ turnServerUrl) — no telemetry, analytics, or hidden beacons. Point every URL at your in-boundary (e.g. US-Gov) hosts to keep all data within your authorization boundary.

Framework crosswalks

This section maps the SDK to the specific frameworks an enterprise, government, or healthcare buyer audits against — the companion to the posture and NIST 800-53 matrix above.

Shared responsibility: a client SDK can implement technical controls and generate the records, but it cannot sign a contract, retain logs, or authenticate the human user. Each table marks SDK (the library provides it) vs Operator (your duty, fed by the SDK's hooks/events).

HIPAA (45 CFR Part 164)

Gating item: Kaltura offers a Business Associate Agreement, covering Kaltura and its avatar/ASR/TTS/brain subprocessors, as required before any PHI flows (164.308(b), 164.502(e)). Contact your Kaltura Account Manager or CSM to execute one.

PHI note: a patient may speak PHI to the avatar, so captions, transcripts, screenshots, and setDynamicPrompt context can carry PHI. The SDK surfaces these to your app but persists none of them; treat them as PHI in your app.

HITRUST CSF (incl. the AI Security Assessment)

The SDK is an AI Application Provider component you can largely inherit in a HITRUST assessment; Kaltura's platform posture is the upstream inheritance source.

Prompt-injection note: the prototype-pollution scrub on setDynamicPrompt/inbound is object-injection defense, not prompt-injection defense, and redact() is log-scoped, not an output content filter. Don't pass unsanitized end-user text into setDynamicPrompt; instruction/data separation, source allow-listing, and model guardrails are operator/platform duties.

OWASP Top 10 for LLM Applications (2025)

Bounded-parser contract: nav/action commands parsed out of avatar text must be bounded allow-lists, never eval/dispatch of arbitrary strings — parseSlideNumber (integer-bounded, range-checked) is the template.

OWASP Agentic (Agentic Security Initiative / Top 10 for Agentic Apps)

The avatar's brain is an agent (navigates, renders GenUI, captures leads, searches knowledge). The SDK is the client boundary where agent-initiated actions surface.

Avatar / digital-human / deepfake / voice-clone

Secure production baseline (CM-6)

Copy-paste hardened configuration for a regulated deployment:

// Server — Management
new Management({
  partnerId, getAdminSecret: () => vault.fetch('kaltura-admin'),  // or adminSecret
  onAuditEvent: (e) => siem.write(e),
});
const token = await mgmt.sessions.createConversationToken({
  configId, ttlSeconds: 1800,                 // short-lived (RFC 9700)
  restrictions: { actionsLimit: 200, sessionGroupId: caseId },   // least privilege + revocable family
});

// Browser — Experience
new KalturaAvatarSession({
  token, conversationManagerUrl, srsBaseUrl, turnServerUrl,      // all https/wss
  turnCredentials,                            // ephemeral (RFC 7635), not the static fallback
  allowInsecureTransport: false,              // never true in production
  requireDisclosureAck: true,                 // EU AI Act / biometric jurisdictions
  idleTimeoutMs: 900000,                      // HIPAA auto-logoff
  subjectId: opaqueUserId,                    // HIPAA unique-user-id (never PHI)
  maxTurnsPerMinute: 30,                      // LLM10 valve
  onBeforeSend: (t) => myGuardrail(t),        // LLM01 input filter
  onAgentAction: (a) => myPolicy(a),          // LLM06 / Agentic action gate
  onAuditEvent: (e) => siem.write(e),
});

Plus: pin the injected socket.io with SRI; set a strict CSP (connect-src your CM + WHEP host + TURN; media-src blob:; no inline script/unsafe-eval) and frame-ancestors on the embedding page; render the disclosure accessibly.