Security & Compliance — @kaltura/intelligent-agents

This SDK is built for enterprise and government deployments. It is secure by default and low-friction by design: the safe path is the clear path. Where strict compliance would otherwise hurt usability, the SDK keeps the ergonomic default and gives you a config knob plus a compliance note to tighten it.

• No runtime dependencies, no install scripts. The SDK is sourced directly from git (src/), not a package registry, so there's zero transitive supply-chain surface. Enforced in CI.
• All cryptography is delegated to the platform. The SDK never rolls its own crypto: TLS, DTLS-SRTP (the encryption protocol securing WebRTC audio and video), and base64 come from the host (Node tls/crypto, browser WebCrypto/TLS). Run Node/OpenSSL in FIPS mode and a FIPS-validated OS/browser to operate in a FIPS-validated configuration (NIST SC-13).
• Secrets never reach the client. The Admin Secret lives only server-side, in Management. The browser KalturaAvatarSession takes only a short-lived, entitlement-ON conversation token.

Framework crosswalks map the SDK control-by-control to HIPAA, HITRUST, the OWASP LLM/Agentic Top 10, and avatar/deepfake/voice-clone law (EU AI Act Art. 50, NO FAKES, CA SB 1001, BIPA, C2PA). See the framework crosswalks section below, which also includes a copy-paste secure production baseline config.

Reporting a vulnerability

Email security@kaltura.com with details and a PoC if available. Please do not open a public issue for an undisclosed vulnerability. We acknowledge within a few business days and coordinate disclosure (NIST IR-6 / SI-2 is the operator's reporting duty; this is the vendor contact).

Table of contents

• AI-application controls
• KS guidance for agents
• Token lifecycle
• Audit logging
• Transport security
• Browser hardening
• Isolation & multi-tenancy
• Supply-chain integrity
• Shared-responsibility control matrix
• FIPS mode
• Data residency
• Framework crosswalks
• HIPAA
• HITRUST CSF
• OWASP Top 10 for LLM Applications
• OWASP Agentic
• Avatar / digital-human / deepfake / voice-clone
• Secure production baseline

AI-application controls (OWASP LLM/Agentic; HIPAA technical safeguards)

Beyond the platform controls below, the SDK exposes developer-friendly guardrails for the AI/agent layer, detailed in the framework crosswalks below. Most require you to opt in by passing a callback or option. Two controls run automatically, regardless of configuration. The idle-timeout auto-logoff defaults to 900000 ms (15 minutes); pass 0 to disable it. The AI-disclosure event fires before the avatar's first words on every connect.

KS (Kaltura Session) guidance for agents (AC-3 / AC-6 / IA-2)

A KS carries the privileges that decide what it can do. The full privilege reference is Kaltura's own docs, not this file. See Kaltura API Authentication and Security for that. What follows is only what matters for agent/avatar deployments.

Default recommendation: mint conversation/agent/widget tokens for anything reaching a browser, and keep admin tokens server-side. createConversationToken/createAgentToken refuse extraPrivileges that disable entitlement. Neither method can be tricked into minting an entitlement-bypassing token. This is tested and gated (test/unit/scope-guard.test.js, test/integration/sessions.test.js).

Whether a given browser session should instead carry broadened (entitlement-bypassing) access is an application-level decision you make when you mint that session's token server-side. This SDK doesn't enforce it on the client.

A real KS's privileges are AES-encrypted with the partner secret and are not client-readable. inspectKs() reports disableEntitlement: null for a real token (see src/management/ks-inspect.js). So a client-side check would be inert for production tokens, and isn't attempted.

Token lifecycle (RFC 9700 OAuth 2.0 Security BCP; NIST AC family)

• Short-lived by default: browser-bound tokens (conversation/agent) default to 30 minutes, admin to 1 hour. Short TTL is the primary revocation lever for a stateless KS (RFC 9700 §6.1). Override per call with ttlSeconds. Absurd lifetimes on browser-bound kinds are rejected (ttl_too_long). UX note: "refresh" means your server re-mints a fresh short token, and the browser calls session.setToken(freshKs) to rotate mid-session without a reconnect.

• Least privilege / binding (RFC 9700 §2.3, §4.10): tighten a token with the structured restrictions option instead of hand-crafting privilege strings. { role, actionsLimit, ipRestrict, uriRestrict, sessionGroupId } compiles to the matching Kaltura privileges (setrole/actionslimit/iprestrict/urirestrict/sessionid). Defaults stay wide-open so nobody is surprise-locked out. Tightening is opt-in.

• Active revocation (RFC 9700 §5.2.1.1; SOC 2 CC6.2/CC6.3): sessions.revoke(tokenOrKs) ends a leaked token now (Kaltura session/end). Mint a family with restrictions.sessionGroupId so revoking any member is intended by design to end the whole family. The SDK checks that the KS carries the matching privilege string, but the server-side cascade itself is outside its control. Returns a _meta revocation receipt.

• Vault/KMS (NIST IA-5): pass getAdminSecret: () => fetchFromVault() to fetch the secret per-mint instead of holding it; it is never stored as an enumerable field.

• Incident runbook for revoking a leaked conversation token:

  await management.sessions.revoke(leakedKs);   // or revoke(token)
  // if minted with restrictions.sessionGroupId: revoking any member is
  // intended by design to end the whole family (server-side behavior).

Audit logging (NIST AU-2 / AU-3 / AU-12; OWASP Logging; SOC 2 CC7)

The SDK is an event emitter, not a logging framework. Pass onAuditEvent to Management and/or KalturaAvatarSession to receive discrete, already-redacted, structured AuditEvent objects, and route them into your SIEM. This is opt-in: no event fires until you pass this hook.

new Management({ partnerId, adminSecret, onAuditEvent: (e) => siem.write(e) });

Event catalog

Event fields

Every event carries this AU-3 content shape:

Guarantees

• The raw KS is never included in an event. Only its kind and scope are.
• Free-text fields are stripped of CR/LF (CWE-117 log-injection guard).
• A throwing SIEM sink can never break a mint or a live turn. Event emission is crash-safe.
• This audit stream is distinct from the chatty debug logger and is never gated behind a debug level.

Transport security (NIST SC-8; OWASP WSS/TLS)

• KalturaAvatarSession rejects non-TLS conversationManagerUrl/srsBaseUrl (insecure_transport).
• Loopback and private hosts (localhost/127.0.0.1, RFC 1918 ranges, link-local, and their IPv6 equivalents; see isPrivateOrLoopbackHost in src/core/net-guard.js) are allowed for dev, with a loud one-time warning.
• Cleartext to a public host requires an explicit allowInsecureTransport:true (dev/test only, never production).
• Prefer server-minted ephemeral TURN credentials (turnCredentials from appInit, RFC 7635) over the static fallback. The SDK warns when it falls back.

Browser hardening (OWASP ASVS / WebSocket CS)

• Memory-only token: the SDK keeps the token in a non-enumerable instance field and drops it on disconnect(). Do not put a conversation token in localStorage/sessionStorage (XSS-exfiltratable). Pass it directly and re-mint from your server on reload.

• No token in URLs: tokens travel only in the socket auth field or the Authorization header, never a query string (OWASP API2:2023).

• Prototype-pollution guard: setDynamicPrompt data is scrubbed of __proto__/constructor/prototype before it touches the wire.

• CSP: the SDK uses no eval/new Function. A working policy sets:

  • connect-src to your live-session control-plane host (conversationManagerUrl), the WHEP video-egress host (srsBaseUrl), and your TURN host
  • media-src blob:
  • script-src to your injected socket.io origin, pinned with SRI (see the README's "Injecting socket.io securely")

  Also set frame-ancestors on the embedding page. A mic-capable widget needs anti-clickjacking headers.

• AI disclosure (EU AI Act Art. 50): a disclosure event fires before the avatar's first words. requireDisclosureAck holds the avatar greeting until acknowledgeDisclosure(). Note: ASR (Automatic Speech Recognition, the mic-to-text channel) connects before disclosure, so obtain consent before connect() in IL/TX/WA.

Isolation & multi-tenancy (NIST SC-4 / AC-6(4))

No SDK module holds credential or tenant state at module scope. The admin secret, KS, and partnerId live only as (non-enumerable) instance fields. A single process can safely run N Management and M KalturaAvatarSession instances for different tenants, each with fully independent tokens, transports, and teardown. Nothing is shared or global (tested in test/unit/isolation.test.js).

Supply-chain integrity (SLSA / OpenSSF / EO 14028)

• Zero runtime dependencies, no install lifecycle scripts (CI-enforced).
• No registry publish step. The SDK is consumed straight from its git tags (src/, imported by path or served via jsDelivr's GitHub CDN once the repo is public). There is no npm package, and so no registry-side supply-chain surface to audit.

Shared-responsibility control matrix (NIST 800-53)

The SDK generates and protects the records and enforces the client-side controls below; the operator owns storage-side controls a client library cannot provide (retention, tamper-evidence, non-repudiation).

FIPS mode (how-to)

# Node with an OpenSSL FIPS provider:
node --enable-fips your-server.js
# or via OpenSSL 3 FIPS provider config (OPENSSL_CONF / fipsmodule.cnf)

In the browser, FIPS validation is a property of the OS/browser crypto module. Deploy on a FIPS-validated platform; the SDK adds no non-validated crypto.

Data residency (SC-7)

The SDK is a thin client. It contacts only the Kaltura endpoints you configure (agenticUrl/genieUrl/ovpUrl/conversationManagerUrl/srsBaseUrl/turnServerUrl). There is no telemetry, analytics, or hidden beacons. Point every URL at your in-boundary (e.g. US-Gov) hosts to keep all data within your authorization boundary.

This residency guarantee covers the SDK's own configured endpoints only. A lifecycle rule's sendInsightEmail action is a server-side, operator-configured email delivery of thread-derived content to an arbitrary recipients list. It has no residency control and isn't covered by the URL-pinning above.

A deployment that must protect PHI/PII boundaries and uses this action is responsible for its own recipient vetting and residency review. The HIPAA BAA (below) names avatar/ASR/TTS/brain subprocessors, not an email-delivery subprocessor for insight content.

Framework crosswalks

This section maps the SDK to the specific frameworks an enterprise, government, or healthcare buyer audits against. It's the companion to the posture and NIST 800-53 matrix above.

Shared responsibility: a client SDK can implement technical controls and generate the records, but it cannot sign a contract, retain logs, or authenticate the human user. Each table marks SDK (the library provides it) vs Operator (your duty, fed by the SDK's hooks/events).

HIPAA (45 CFR Part 164)

Gating item: Kaltura offers a Business Associate Agreement, covering Kaltura and its avatar/ASR/TTS/brain subprocessors, as required before any PHI flows (164.308(b), 164.502(e)). Contact your Kaltura Account Manager or Customer Success Manager to execute one.

PHI note: a patient may speak PHI to the avatar, so captions, transcripts, screenshots, and request-variable context (setDynamicPrompt's page_context) can carry PHI. The SDK surfaces these to your app but persists none of them. Treat them as PHI in your app. Remember that request variables persist on the conversation thread server-side for the rest of the thread.

HITRUST CSF (incl. the AI Security Assessment)

The SDK is an AI Application Provider component you can largely inherit in a HITRUST assessment. Kaltura's platform posture is the upstream inheritance source.

Prompt-injection note: the prototype-pollution scrub on setDynamicPrompt/inbound is object-injection defense, not prompt-injection defense. redact() is log-scoped, not an output content filter. Don't pass unsanitized end-user text into setDynamicPrompt or any request variable. Request variables are thread-persistent, so a poisoned value outlives its turn and keeps interpolating into prompts and server-side tool calls for the rest of the thread. Instruction/data separation, source allow-listing, and model guardrails are operator/platform duties.

OWASP Top 10 for LLM Applications (2025)

Bounded-parser contract: nav/action commands parsed out of avatar text must be bounded allow-lists, never eval/dispatch of arbitrary strings. parseSlideNumber (integer-bounded, range-checked) is the template.

OWASP Agentic (Agentic Security Initiative / Top 10 for Agentic Apps)

The avatar's brain is an agent (navigates, renders GenUI, captures leads, searches knowledge). The SDK is the client boundary where agent-initiated actions surface.

Avatar / digital-human / deepfake / voice-clone

Secure production baseline (CM-6)

Copy-paste hardened configuration for a regulated deployment:

// Server: Management
const mgmt = new Management({
  partnerId, getAdminSecret: () => vault.fetch('kaltura-admin'),  // or adminSecret
  onAuditEvent: (e) => siem.write(e),
});
const token = await mgmt.sessions.createConversationToken({
  configId, ttlSeconds: 1800,                 // short-lived (RFC 9700)
  restrictions: { actionsLimit: 200, sessionGroupId: caseId },   // least privilege + revocable family
});

// Browser: Experience
new KalturaAvatarSession({
  token, conversationManagerUrl, srsBaseUrl, turnServerUrl,      // all https/wss
  turnCredentials,                            // ephemeral (RFC 7635), not the static fallback
  allowInsecureTransport: false,              // never true in production
  requireDisclosureAck: true,                 // EU AI Act / biometric jurisdictions
  idleTimeoutMs: 900000,                      // HIPAA auto-logoff
  subjectId: opaqueUserId,                    // HIPAA unique-user-id (never PHI)
  maxTurnsPerMinute: 30,                      // LLM10 valve
  onBeforeSend: (t) => myGuardrail(t),        // LLM01 input filter
  onAgentAction: (a) => myPolicy(a),          // LLM06 / Agentic action gate
  onAuditEvent: (e) => siem.write(e),
});

Plus: pin the injected socket.io with SRI; set a strict CSP (connect-src your control-plane, WHEP and TURN hosts; media-src blob:; no inline script/unsafe-eval) and frame-ancestors on the embedding page; render the disclosure accessibly.