AI Implementation Code Guide

rulesEngine = $rulesEngine;
        $this->aiService = $aiService;
        $this->cache = $cache;
    }
    
    public function processEvidenceRequest(string $questionId, array $evidenceData): array 
    {
        $question = AssessmentEventsQuestion::find($questionId);
        
        // Check cache first
        $cacheKey = $this->generateCacheKey($question->control_id, $evidenceData);
        if ($cached = $this->cache->get($cacheKey)) {
            $this->logCostSaving('cache_hit', 0);
            return $cached;
        }
        
        // Assess complexity to determine processing tier
        $complexity = $this->assessComplexity($question, $evidenceData);
        
        if ($complexity <= 0.3) {
            // Tier 1: FREE Rules Engine (70% of requests)
            $result = $this->rulesEngine->processEvidence($question, $evidenceData);
            $this->logProcessing('rules_engine', 0);
            
        } elseif ($complexity <= 0.7 && $this->hasAIBudget()) {
            // Tier 2: Basic AI Analysis (20% of requests) 
            $result = $this->aiService->basicAnalysis($question, $evidenceData);
            $this->logProcessing('basic_ai', $this->getBasicAICost());
            
        } elseif ($this->hasAIBudget()) {
            // Tier 3: Advanced AI (10% of requests)
            $result = $this->aiService->advancedAnalysis($question, $evidenceData);
            $this->logProcessing('advanced_ai', $this->getAdvancedAICost());
            
        } else {
            // Fallback to rules if AI budget exceeded
            $result = $this->rulesEngine->processEvidence($question, $evidenceData);
            $result['ai_budget_exceeded'] = true;
            $this->logProcessing('rules_fallback', 0);
        }
        
        // Cache result for reuse
        $this->cache->put($cacheKey, $result, 3600); // 1 hour cache
        
        return $result;
    }
    
    private function assessComplexity(AssessmentEventsQuestion $question, array $evidenceData): float 
    {
        $complexity = 0.0;
        
        // Simple data types = low complexity
        if ($this->isSimpleDataValidation($evidenceData)) {
            $complexity += 0.1;
        }
        
        // Multiple data sources = medium complexity  
        if (count($evidenceData) > 3) {
            $complexity += 0.2;
        }
        
        // Complex controls require AI
        $aiRequiredControls = ['risk_analysis', 'policy_review', 'anomaly_detection'];
        if (in_array($question->control_id, $aiRequiredControls)) {
            $complexity += 0.5;
        }
        
        // Natural language requirements = high complexity
        if ($this->requiresNaturalLanguage($question)) {
            $complexity += 0.4;
        }
        
        return min(1.0, $complexity);
    }
    
    private function generateCacheKey(string $controlId, array $evidenceData): string 
    {
        return 'compliance_analysis_' . $controlId . '_' . md5(json_encode($evidenceData));
    }
    
    private function hasAIBudget(): bool 
    {
        $dailySpent = $this->getDailyAISpend();
        $dailyBudget = config('ai.daily_budget', 50); // $50 daily = $1500/month
        
        return $dailySpent < $dailyBudget;
    }
}
?>

rulesets = [
            'user_access' => new UserAccessRules(),
            'asset_inventory' => new AssetInventoryRules(), 
            'policy_compliance' => new PolicyComplianceRules(),
            'security_config' => new SecurityConfigRules(),
        ];
    }
    
    public function processEvidence(AssessmentEventsQuestion $question, array $evidenceData): array 
    {
        $controlType = $this->determineControlType($question->control_id);
        $ruleset = $this->rulesets[$controlType] ?? $this->rulesets['policy_compliance'];
        
        // Execute rules-based analysis
        $analysis = $ruleset->analyze($evidenceData);
        
        // Calculate compliance score using rules
        $score = $this->calculateComplianceScore($analysis);
        
        // Generate human-readable summary
        $summary = $this->generateRulesSummary($analysis, $score);
        
        return [
            'processing_tier' => 'rules_engine',
            'control_id' => $question->control_id,
            'compliance_score' => $score,
            'analysis' => $analysis,
            'summary' => $summary,
            'conformity_mark' => $score >= 80 ? 'met' : 'not met',
            'recommendations' => $ruleset->getRecommendations($analysis),
            'cost' => 0.00,
            'processing_time' => microtime(true) - LARAVEL_START
        ];
    }
    
    private function determineControlType(string $controlId): string 
    {
        $patterns = [
            'user_access' => ['CC6.1', 'A.9.2', 'AC-', 'IA-'],
            'asset_inventory' => ['A.8.1', 'CM-8', 'inventory'],
            'security_config' => ['CC6.7', 'A.12.6', 'SI-', 'SC-'],
            'policy_compliance' => ['CC2.1', 'A.5.1', 'policy', 'procedure']
        ];
        
        foreach ($patterns as $type => $identifiers) {
            foreach ($identifiers as $identifier) {
                if (stripos($controlId, $identifier) !== false) {
                    return $type;
                }
            }
        }
        
        return 'policy_compliance'; // Default
    }
    
    private function calculateComplianceScore(array $analysis): int 
    {
        $score = 100;
        $deductions = 0;
        
        // Apply rule-based deductions
        foreach ($analysis['violations'] as $violation) {
            $deductions += $violation['severity'] * 10; // Critical = 30, High = 20, Medium = 10
        }
        
        foreach ($analysis['warnings'] as $warning) {
            $deductions += 5; // Each warning = 5 points
        }
        
        return max(0, $score - $deductions);
    }
}

// app/Services/RulesEngine/Rules/UserAccessRules.php
namespace App\Services\RulesEngine\Rules;

class UserAccessRules implements ComplianceRuleInterface 
{
    public function analyze(array $evidenceData): array 
    {
        $users = $evidenceData['users'] ?? [];
        $violations = [];
        $warnings = [];
        
        // Rule 1: Check for inactive users (SOC 2 CC6.1)
        $inactiveUsers = $this->findInactiveUsers($users);
        if (count($inactiveUsers) > 0) {
            $violations[] = [
                'rule' => 'inactive_users_found',
                'severity' => 2, // High severity
                'count' => count($inactiveUsers),
                'description' => count($inactiveUsers) . ' inactive users found with access'
            ];
        }
        
        // Rule 2: Check privileged user ratio
        $privilegedUsers = $this->findPrivilegedUsers($users);
        $privilegedRatio = count($privilegedUsers) / count($users);
        if ($privilegedRatio > 0.3) { // More than 30% privileged
            $warnings[] = [
                'rule' => 'excessive_privileged_users',
                'ratio' => round($privilegedRatio * 100, 1) . '%',
                'description' => 'High percentage of users with privileged access'
            ];
        }
        
        // Rule 3: Check for users without recent password changes
        $stalePasswords = $this->findStalePasswords($users);
        if (count($stalePasswords) > 0) {
            $violations[] = [
                'rule' => 'stale_passwords',
                'severity' => 2,
                'count' => count($stalePasswords),
                'description' => 'Users with passwords older than 90 days'
            ];
        }
        
        return [
            'total_users' => count($users),
            'active_users' => count($users) - count($inactiveUsers),
            'privileged_users' => count($privilegedUsers),
            'violations' => $violations,
            'warnings' => $warnings,
            'metrics' => [
                'inactive_ratio' => round(count($inactiveUsers) / count($users) * 100, 1),
                'privileged_ratio' => round($privilegedRatio * 100, 1)
            ]
        ];
    }
    
    private function findInactiveUsers(array $users): array 
    {
        $cutoffDate = now()->subDays(90);
        
        return array_filter($users, function($user) use ($cutoffDate) {
            $lastLogin = isset($user['last_login']) ? 
                Carbon::parse($user['last_login']) : 
                Carbon::parse($user['created_at']);
                
            return $lastLogin->lt($cutoffDate);
        });
    }
    
    private function findPrivilegedUsers(array $users): array 
    {
        $privilegedRoles = ['admin', 'administrator', 'root', 'super', 'owner'];
        
        return array_filter($users, function($user) use ($privilegedRoles) {
            $userRole = strtolower($user['role'] ?? '');
            return in_array($userRole, $privilegedRoles) || 
                   ($user['is_admin'] ?? false);
        });
    }
    
    public function getRecommendations(array $analysis): array 
    {
        $recommendations = [];
        
        foreach ($analysis['violations'] as $violation) {
            switch ($violation['rule']) {
                case 'inactive_users_found':
                    $recommendations[] = "Disable or remove {$violation['count']} inactive user accounts";
                    break;
                case 'stale_passwords':
                    $recommendations[] = "Enforce password reset for {$violation['count']} users with old passwords";
                    break;
            }
        }
        
        foreach ($analysis['warnings'] as $warning) {
            if ($warning['rule'] === 'excessive_privileged_users') {
                $recommendations[] = "Review privileged access - consider least privilege principle";
            }
        }
        
        return $recommendations;
    }
}
?>

deduplicateAssets($assets);
        
        // Rule 1: Check asset coverage by type
        $assetTypes = $this->categorizeAssets($consolidatedAssets);
        if (empty($assetTypes['hardware'])) {
            $violations[] = [
                'rule' => 'missing_hardware_inventory',
                'severity' => 3, // Critical
                'description' => 'No hardware assets found in inventory'
            ];
        }
        
        // Rule 2: Check for assets without recent updates
        $staleAssets = $this->findStaleAssets($consolidatedAssets);
        if (count($staleAssets) > 0) {
            $warnings[] = [
                'rule' => 'stale_asset_data',
                'count' => count($staleAssets),
                'description' => 'Assets with data older than 30 days'
            ];
        }
        
        // Rule 3: Validate required asset fields
        $incompleteAssets = $this->validateAssetFields($consolidatedAssets);
        if (count($incompleteAssets) > 0) {
            $violations[] = [
                'rule' => 'incomplete_asset_data',
                'severity' => 1, // Medium
                'count' => count($incompleteAssets),
                'description' => 'Assets missing required fields (name, type, owner)'
            ];
        }
        
        return [
            'total_assets' => count($consolidatedAssets),
            'asset_types' => $assetTypes,
            'coverage_score' => $this->calculateCoverageScore($assetTypes),
            'violations' => $violations,
            'warnings' => $warnings,
            'consolidated_assets' => $consolidatedAssets,
            'deduplication_stats' => [
                'original_count' => count($assets),
                'deduplicated_count' => count($consolidatedAssets),
                'duplicates_removed' => count($assets) - count($consolidatedAssets)
            ]
        ];
    }
    
    private function deduplicateAssets(array $assets): array 
    {
        $seen = [];
        $result = [];
        
        foreach ($assets as $asset) {
            // Generate unique key based on multiple identifiers
            $keys = [
                $asset['serial_number'] ?? null,
                $asset['mac_address'] ?? null,
                strtolower($asset['name'] ?? ''),
                $asset['ip_address'] ?? null
            ];
            
            // Create composite key from non-null identifiers
            $compositeKey = implode('|', array_filter($keys));
            
            if ($compositeKey && !isset($seen[$compositeKey])) {
                $seen[$compositeKey] = true;
                $result[] = $asset;
            } elseif (!$compositeKey) {
                // Keep assets without identifiers but flag them
                $asset['missing_identifiers'] = true;
                $result[] = $asset;
            }
        }
        
        return $result;
    }
    
    private function categorizeAssets(array $assets): array 
    {
        $categories = [
            'hardware' => [],
            'software' => [],
            'network' => [],
            'virtual' => [],
            'other' => []
        ];
        
        foreach ($assets as $asset) {
            $type = strtolower($asset['type'] ?? 'other');
            $category = $this->mapAssetCategory($type);
            $categories[$category][] = $asset;
        }
        
        return array_map('count', $categories);
    }
    
    private function mapAssetCategory(string $type): string 
    {
        $mappings = [
            'server' => 'hardware',
            'workstation' => 'hardware', 
            'laptop' => 'hardware',
            'desktop' => 'hardware',
            'router' => 'network',
            'switch' => 'network',
            'firewall' => 'network',
            'application' => 'software',
            'license' => 'software',
            'vm' => 'virtual',
            'container' => 'virtual'
        ];
        
        foreach ($mappings as $pattern => $category) {
            if (stripos($type, $pattern) !== false) {
                return $category;
            }
        }
        
        return 'other';
    }
    
    private function calculateCoverageScore(array $assetTypes): int 
    {
        $score = 0;
        $weights = [
            'hardware' => 30,
            'software' => 25,
            'network' => 25,
            'virtual' => 15,
            'other' => 5
        ];
        
        foreach ($assetTypes as $type => $count) {
            if ($count > 0) {
                $score += $weights[$type] ?? 0;
            }
        }
        
        return $score;
    }
    
    public function getRecommendations(array $analysis): array 
    {
        $recommendations = [];
        
        foreach ($analysis['violations'] as $violation) {
            switch ($violation['rule']) {
                case 'missing_hardware_inventory':
                    $recommendations[] = "Configure hardware asset discovery via ConnectWise/RMM integration";
                    break;
                case 'incomplete_asset_data':
                    $recommendations[] = "Complete asset records - add missing names, types, and owners";
                    break;
            }
        }
        
        if ($analysis['coverage_score'] < 80) {
            $recommendations[] = "Improve asset coverage by enabling additional integrations";
        }
        
        return $recommendations;
    }
}
?>