# lukelittle/rawsug-pii-demo architecture

> Architecture diagram of the GitHub repository lukelittle/rawsug-pii-demo, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/lukelittle/rawsug-pii-demo
- Repository: https://github.com/lukelittle/rawsug-pii-demo

## Overview

Decide in Code is an AWS support-message guard: an IAM-signed client submits a message, the Lambda runs a probability-based System One circuit, and deterministic code either redacts and routes the message or sends it for human review. The review path adds a best-effort Bedrock summary and queues the message in SQS. CloudWatch records decision traces without message text. Source excerpts establish the Lambda’s internal calls and integrations; the README documents API Gateway, logging, and the hosted services.

Main entry points: [`lambda/handler.py`](https://github.com/lukelittle/rawsug-pii-demo/blob/main/lambda/handler.py) (Request handler), [`lambda/backend.py`](https://github.com/lukelittle/rawsug-pii-demo/blob/main/lambda/backend.py) (Model backend), [`lambda/review.py`](https://github.com/lukelittle/rawsug-pii-demo/blob/main/lambda/review.py) (Review enqueue), [`lambda/decide.py`](https://github.com/lukelittle/rawsug-pii-demo/blob/main/lambda/decide.py) (Decision rules)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_ingress["Request ingress"]
  node_gateway{{"API Gateway"}}
  node_handler["Request handler<br/>[handler.py]"]
end

subgraph group_decision["Decision circuit"]
  node_circuit["Probability circuit<br/>[circuit.py]"]
  node_backend["Model backend<br/>[backend.py]"]
  node_decide["Decision rules<br/>[decide.py]"]
  node_redact["Deterministic masking<br/>[redact.py]"]
end

subgraph group_review["Human review"]
  node_review["Review enqueue<br/>[review.py]"]
end

subgraph group_aws["AWS services"]
  node_bedrock{{"Amazon Bedrock"}}
  node_queue["Human-review queue"]
  node_logs[("CloudWatch Logs")]
  node_secrets[("Secrets Manager")]
end

node_client(("Signed client"))
node_model{{"System One model"}}
node_sagemaker{{"SageMaker endpoint"}}

node_client -->|"sends signed request"| node_gateway
node_gateway -->|"routes POST"| node_handler
node_handler -->|"runs circuit"| node_circuit
node_handler -->|"creates backend"| node_backend
node_backend -->|"requests answers"| node_model
node_backend -.->|"invokes endpoint"| node_sagemaker
node_backend -->|"reads API key"| node_secrets
node_handler -->|"evaluates gates"| node_decide
node_decide -->|"masks message"| node_redact
node_handler -->|"enqueues review"| node_review
node_review -->|"summarizes message"| node_bedrock
node_review -->|"sends review"| node_queue
node_handler -->|"writes traces"| node_logs

click node_handler "https://github.com/lukelittle/rawsug-pii-demo/blob/main/lambda/handler.py"
click node_circuit "https://github.com/lukelittle/rawsug-pii-demo/blob/main/lambda/circuit.py"
click node_backend "https://github.com/lukelittle/rawsug-pii-demo/blob/main/lambda/backend.py"
click node_decide "https://github.com/lukelittle/rawsug-pii-demo/blob/main/lambda/decide.py"
click node_redact "https://github.com/lukelittle/rawsug-pii-demo/blob/main/lambda/redact.py"
click node_review "https://github.com/lukelittle/rawsug-pii-demo/blob/main/lambda/review.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_gateway,node_handler,node_client toneBlue
class node_circuit,node_backend,node_decide,node_redact toneAmber
class node_review toneMint
class node_bedrock,node_queue,node_logs,node_secrets toneRose
class node_model,node_sagemaker toneIndigo
```

## Components

### Request ingress

- **API Gateway**
- [Request handler](https://github.com/lukelittle/rawsug-pii-demo/blob/main/lambda/handler.py): `lambda/handler.py`

### Decision circuit

- [Probability circuit](https://github.com/lukelittle/rawsug-pii-demo/blob/main/lambda/circuit.py): `lambda/circuit.py`
- [Model backend](https://github.com/lukelittle/rawsug-pii-demo/blob/main/lambda/backend.py): `lambda/backend.py`
- [Decision rules](https://github.com/lukelittle/rawsug-pii-demo/blob/main/lambda/decide.py): `lambda/decide.py`
- [Deterministic masking](https://github.com/lukelittle/rawsug-pii-demo/blob/main/lambda/redact.py): `lambda/redact.py`

### Human review

- [Review enqueue](https://github.com/lukelittle/rawsug-pii-demo/blob/main/lambda/review.py): `lambda/review.py`

### AWS services

- **Amazon Bedrock**
- **Human-review queue**
- **CloudWatch Logs**
- **Secrets Manager**

### Other components

- **Signed client**
- **System One model**
- **SageMaker endpoint**

## Connections

- Signed client → API Gateway: sends signed request (evidence: `README.md`)
- API Gateway → Request handler: routes POST (evidence: `README.md`)
- Request handler → Probability circuit: runs circuit (evidence: `lambda/handler.py`)
- Request handler → Model backend: creates backend (evidence: `lambda/handler.py`)
- Model backend → System One model: requests answers (evidence: `README.md`)
- Model backend → SageMaker endpoint: invokes endpoint
- Model backend → Secrets Manager: reads API key (evidence: `lambda/backend.py`)
- Request handler → Decision rules: evaluates gates (evidence: `lambda/handler.py`)
- Decision rules → Deterministic masking: masks message (evidence: `lambda/decide.py`)
- Request handler → Review enqueue: enqueues review (evidence: `lambda/handler.py`)
- Review enqueue → Amazon Bedrock: summarizes message (evidence: `lambda/review.py`)
- Review enqueue → Human-review queue: sends review (evidence: `lambda/review.py`)
- Request handler → CloudWatch Logs: writes traces (evidence: `README.md`)