系统设计题指南 - Go Agent Infrastructure#

// 每个阶段记录延迟
func trackLatency(stage string, duration time.Duration) {
    metrics.recordLatency(stage, duration.Milliseconds())
}

// 关键指标
- retrieval_latency_p50/p95/p99
- llm_latency_p50/p95/p99
- cache_hit_rate
- end_to_end_latency_p99 < 1000ms (alert if > 1200ms)

// 每个部门是一个tenant
type Tenant struct {
    ID          string
    Name        string
    Agents      []Agent
    ToolAccess  []string  // 可访问的工具
    DataFilter  ACLRule   // 数据级别的权限
}

// 数据查询时自动加上tenant filter
func (s *StateStore) GetByTenant(tenantID string) []State {
    return db.Query("SELECT * FROM states WHERE tenant_id = ?", tenantID)
}

// API endpoint必须验证tenant
func (h *Handler) GetAgents(w http.ResponseWriter, r *http.Request) {
    user := getCurrentUser(r)
    tenantID := user.TenantID  // 从user context取
    
    agents := agentService.ListByTenant(tenantID)
    json.NewEncoder(w).Encode(agents)
}

// Tool级别的权限矩阵
type ToolPermission struct {
    ToolID   string
    TenantID string
    Access   string  // "allow" / "deny"
}

// 执行工具前检查权限
func (tr *ToolRegistry) Execute(ctx context.Context, toolName string) error {
    tenantID := getTenantFromContext(ctx)
    
    perm, _ := permStore.Get(toolName, tenantID)
    if perm.Access == "deny" {
        return fmt.Errorf("tenant %s not allowed to use %s", tenantID, toolName)
    }
    
    return tr.execute(toolName)
}

// Context传播
type ContextKey string
const TenantContextKey ContextKey = "tenant_id"

func WithTenant(ctx context.Context, tenantID string) context.Context {
    return context.WithValue(ctx, TenantContextKey, tenantID)
}

func GetTenant(ctx context.Context) string {
    return ctx.Value(TenantContextKey).(string)
}

// 所有DB操作都加tenant filter
func (s *Service) GetChunks(ctx context.Context, query string) []Chunk {
    tenantID := GetTenant(ctx)
    
    // SELECT * FROM chunks 
    // WHERE tenant_id = tenantID AND (...)
    chunks := s.db.Query("SELECT * FROM chunks WHERE tenant_id = ? AND ...", tenantID)
    
    return chunks
}

// Tool执行前检查权限
func (tr *ToolRegistry) ExecuteWithTenantCheck(ctx context.Context, toolName string) error {
    tenantID := GetTenant(ctx)
    
    // 检查这个tenant是否有权限用这个工具
    allowed := tr.checkToolAccess(tenantID, toolName)
    if !allowed {
        slog.Warn("tenant denied access", "tenant", tenantID, "tool", toolName)
        return fmt.Errorf("access denied")
    }
    
    return tr.execute(ctx, toolName)
}

// Audit log自动包含tenant
func (a *AuditLogger) Log(ctx context.Context, event string, data interface{}) {
    tenantID := GetTenant(ctx)
    
    a.db.Exec("INSERT INTO audit_logs (tenant_id, event, data, timestamp) VALUES (?, ?, ?, NOW())",
        tenantID, event, data)
}

func TestTenantIsolation(t *testing.T) {
    // Tenant A创建的agent
    agentA := createAgent("tenant-a", "support-bot")
    
    // 用Tenant B的context查询
    ctxB := WithTenant(context.Background(), "tenant-b")
    agentsB := service.ListAgents(ctxB)
    
    // 不应该看到agentA
    for _, agent := range agentsB {
        if agent.ID == agentA.ID {
            t.Fatalf("tenant B can see tenant A's agent!")
        }
    }
}

type InputGuardrail struct {
    injectionPatterns []string
    maxInputLength    int
}

func (g *InputGuardrail) Check(input string) error {
    // 长度限制
    if len(input) > g.maxInputLength {
        return fmt.Errorf("input too long")
    }
    
    // Pattern匹配
    lowerInput := strings.ToLower(input)
    for _, pattern := range g.injectionPatterns {
        if strings.Contains(lowerInput, pattern) {
            return fmt.Errorf("suspicious pattern detected: %s", pattern)
        }
    }
    
    // 额外：token检查（防止特殊字符attack）
    if containsSuspiciousTokens(input) {
        return fmt.Errorf("invalid tokens")
    }
    
    return nil
}

func (h *Handler) ProcessRequest(w http.ResponseWriter, r *http.Request) {
    user := authenticateUser(r)
    if user == nil {
        http.Error(w, "unauthorized", http.StatusUnauthorized)
        return
    }
    
    // 立即检查权限，不要等到后面
    if !h.rbac.HasPermission(user.Role, PermViewKB) {
        http.Error(w, "forbidden", http.StatusForbidden)
        return
    }
    
    // 只有这里通过了，才继续处理
    ctx := WithUser(r.Context(), user)
    h.handleChat(w, ctx)
}

type SecureRetriever struct {
    retriever RAGRetriever
    acl       ACLStore
}

func (sr *SecureRetriever) Search(ctx context.Context, query string) ([]Chunk, error) {
    user := GetUser(ctx)
    
    // 获取所有相关chunks
    chunks, _ := sr.retriever.Search(ctx, query)
    
    // 过滤：只返回用户有权访问的
    var allowedChunks []Chunk
    for _, chunk := range chunks {
        hasAccess, _ := sr.acl.CanAccess(user.ID, chunk.DocID)
        if hasAccess {
            allowedChunks = append(allowedChunks, chunk)
        } else {
            // LLM永远看不到这个文档
            slog.Info("chunk filtered", "user", user.ID, "doc", chunk.DocID)
        }
    }
    
    return allowedChunks, nil
}

type ToolExecutor struct {
    tools          ToolRegistry
    rbac           RBAC
    approvalStore  ApprovalStore
}

func (te *ToolExecutor) Execute(ctx context.Context, toolName string, input json.RawMessage) error {
    user := GetUser(ctx)
    tool := te.tools.Get(toolName)
    
    // Step 1: 这个工具存在吗？
    if tool == nil {
        return fmt.Errorf("tool not found: %s", toolName)
    }
    
    // Step 2: 用户有权调这个工具吗？
    if !te.rbac.CanExecuteTool(user.Role, toolName) {
        return fmt.Errorf("insufficient permission for tool: %s", toolName)
    }
    
    // Step 3: 这是高风险操作吗？
    if tool.RiskLevel == "high" {
        // 需要approval
        action := &PendingAction{
            ToolName:      toolName,
            Input:         input,
            CreatedBy:     user.ID,
            RequiresApprovalFrom: "admin",
        }
        te.approvalStore.Create(action)
        return fmt.Errorf("pending approval")
    }
    
    // Step 4: 执行
    result, err := tool.Execute(ctx, input)
    
    // Step 5: 记录
    te.audit(user.ID, toolName, "success")
    
    return nil
}

type OutputValidator struct {
    sensitivePatterns *regexp.Regexp
    blacklistedWords  []string
}

func (ov *OutputValidator) Validate(answer string) error {
    // 检查敏感信息（邮箱、SSN等）
    if ov.sensitivePatterns.MatchString(answer) {
        return fmt.Errorf("output contains sensitive information")
    }
    
    // 检查黑名单词
    for _, word := range ov.blacklistedWords {
        if strings.Contains(answer, word) {
            return fmt.Errorf("blacklisted word in output: %s", word)
        }
    }
    
    return nil
}

// Citation必须可验证
func (r *RAGEngine) GenerateWithValidation(ctx context.Context, chunks []Chunk) (*Answer, error) {
    answer, _ := r.llm.Generate(ctx, chunks)
    
    // 解析citations
    citations := extractCitations(answer.Text)
    
    // 验证每个citation指向的chunk确实存在且可访问
    for _, cite := range citations {
        found := false
        for _, chunk := range chunks {
            if chunk.ID == cite.ChunkID {
                found = true
                break
            }
        }
        
        if !found {
            // 是幻觉！
            return nil, fmt.Errorf("citation references non-existent chunk: %s", cite.ChunkID)
        }
    }
    
    return answer, nil
}

type AuditLog struct {
    Timestamp   time.Time
    UserID      string
    Action      string
    Resource    string
    Result      string  // "success" / "denied" / "error"
    Reason      string  // 为什么失败？
    Details     json[.RawMessage
}

func (a *AuditLogger) LogAction(ctx context.Context, action string, resource string, result string) {
    user := GetUser(ctx)
    
    log := AuditLog{
        Timestamp: time.Now(),
        UserID:    user.ID,
        Action:    action,
        Resource:  resource,
        Result:    result,
    }
    
    a.db.Exec("INSERT INTO audit_logs ... VALUES ...", log)
}

// 可审计的行为：
// - 用户登录/登出
// - 权限变更
// - Tool执行
// - Approval决定
// - Data访问
// - Configuration变更

type SecurityMonitor struct {
    alertThresholds map[string]int
}

func (sm *SecurityMonitor) DetectAnomalies(ctx context.Context) {
    // 检测异常：
    
    // 1. 高失败率
    deniedCount := sm.getRecentDeniedCount()
    if deniedCount > sm.alertThresholds["max_denied_per_hour"] {
        sm.alert("HIGH_DENIAL_RATE")
    }
    
    // 2. 异常工具调用模式
    toolCalls := sm.getToolCallsLastHour()
    if sm.isAnomalous(toolCalls) {
        sm.alert("ANOMALOUS_TOOL_USAGE")
    }
    
    // 3. 权限提升尝试
    privEscAttempts := sm.countPrivEscAttempts()
    if privEscAttempts > 0 {
        sm.alert("PRIVILEGE_ESCALATION_ATTEMPT")
    }
}