Prompt

Overview#

AI features across an investigation platform depend on carefully crafted prompts, and those prompts need to be versioned, tested, and monitored just like any other critical component. The Prompt domain provides that engineering infrastructure: template management with variable substitution, version control with rollback, performance metrics per prompt, and a testing harness so changes get validated before they reach production workflows.

Key Features#

Prompt CRUD operations with categorisation and active/inactive status management
Template system with variable placeholders, validation, and rendering
Version control with sequential version numbers, comparison, and rollback capability
Performance tracking: test count, success rate, response time, token usage, and cost
Model requirements specification for LLM constraints (tokens, temperature)
Organisation-scoped prompt management with custom metadata
Prompt testing with variable injection and validation error reporting
Category-based organisation: analysis, summarisation, extraction, classification, and generation

Use Cases#

Relevant sectors include law enforcement, intelligence agencies, and financial crime investigation.

Managing and versioning AI prompts used across investigation and analysis workflows
Testing prompt templates with different variables and model configurations before deployment
Tracking prompt performance metrics to optimise cost and accuracy over time
Standardising prompt engineering practices across teams with shared templates

Integration#

The Prompt domain connects with LLM integration services, AI provider registries, intelligence analysis, and AI assistant systems.

Open Standards#

GraphQL (June 2018 specification): All prompt management operations, creation, retrieval, versioning, testing, and performance queries, are exposed exclusively through a GraphQL API using typed queries and mutations.
OAuth 2.0 (RFC 6749) and JSON Web Tokens (RFC 7519): Every GraphQL operation requires a Bearer token validated against RS256-signed JWTs issued via the platform's JWKS endpoint; the IsAuthenticated permission class enforces this on all resolvers.
JSON (RFC 8259) / JSON Schema: Prompt metadata, model requirements, and variable payloads are stored as JSON documents and exchanged as JSON in all API requests and responses; JSONB columns in PostgreSQL preserve the schema-flexible structure.
RFC 4122 UUID version 4: All prompt, version, and performance records are identified by randomly generated UUIDs, ensuring collision-resistant, globally unique identifiers with no central registry dependency.
ISO 8601 / RFC 3339 date-time: All created_at, updated_at, and last_tested_at fields are stored and surfaced as UTC-normalised ISO 8601 timestamps, enabling unambiguous cross-system temporal comparisons.
OpenAI Chat Completions API (de-facto LLM interoperability convention): The provider_id and model_name fields, together with the underlying LLM integration layer, follow the OpenAI Chat Completions message format as the standard interface for dispatching rendered prompts to multiple model providers.
NIST RBAC model (ANSI/INCITS 359-2004): Access to prompt creation, update, and deletion is gated by role-based access control; the service enforces admin-role checks in accordance with the flat RBAC tier of the NIST standard before any mutating operation proceeds.

Last Reviewed: 2026-02-05 Last Updated: 2026-04-14