Goal Summary:

RHACS Customers would like to better understand Risk data for deployments that ACS presents today and possible ways to remediate against those risk factors. A way to provide this capability is via integration with LLMs. 

Goals and expected user outcomes:

This is a Discovery/Exploratory feature with Preview capabilities, hence the goals will be to:

1. Explore ways to fetch data from ACS Risk APIs and provide that as input to an LLM configured by User.
2. Present the AI generated output from the LLM to the user that shows "easy to understand" risks and  remediations.
3. Since the output is from an LLM on which we have no further control, we need to Include a warning message saying this is AI generated output and needs whetting by Security teams.
4. Add Note that we encourage use of Red Hat Validated LLMs https://www.redhat.com/en/products/ai/validated-models  and that we will not be responsible for whetting of the Models or their associated Output in this release 

Preview Release Goal is to provide this in UI Only.  CLI is NOT A GOAL FOR PREVIEW.

Simple Workflow

• Admin sets up LLM Integration: Allow ACS Admin User to Create a new Integration in the ACS Dashboard
  • URL of LLM endpoint

• • API Key for authenticating to the LLM. (Similar to how OpenShift lightspeed does LLM integration[ *https://docs.redhat.com/en/documentation/red_hat_openshift_lightspeed/1.0/html-single/configure/index*|https://docs.redhat.com/en/documentation/red_hat_openshift_lightspeed/1.0/html-single/configure/index]

• ACS Users, admin/non-admin, who want to take a look at risk for a specific deployment can go to the RHACS Dashboard->Risk-> Deployments menu, choose the specific deployment -> Select a Button such as, “Get LLM generated Risk output and Recommendations”, and view the output in the dashboard. 

• If No LLM Integration is found, UI will provide a warning saying no LLM integration is available and please ask ACS admin to configure LLM with a link to the Integrations page. 

Acceptance Criteria:

User is able to view AI generated output per Deployment in ACS detailing the risks and remediation options. 

User sees appropriate error messages for failures 

User is able to connect to provide endpoint for LLM connection 

Success Criteria or KPIs measured:

1. AI generated output for deployments seen in the Dashboard and ACS Users are able to consume it easily.
2. Increased ACS usage by developer/non-admin personas 
3. No changes/disruptions to existing Risk functionality in ACS 

Out of Scope :

No Integration planned with ACS MCP Server at this point. The usecase is too simple and integration with MCP will likely complicate the workflow. 

Potential Future Concerns:

Is this code reusable once we have refactored our Risk UI: Most of this code is reusable as we are essentially just using an application (in this case our front end application) to prompt an LLM application and present data. 

QUESTIONS:

• ACSCS Integration: How do we expose or let customers configure LLM
• Do we need any legal review for LLM integration - tbd, need to ask OpenShift LightSpeed