Later: filter chat RAG by saved standards selection

[northdpole]

Parent: #1079 · Not a November blocker · Project: https://github.com/orgs/OWASP/projects/60

What

Product choice, tracked so it does not get silently skipped or silently done.

Chat (/rest/v1/completion) already requires login (spend control). Retrieval is not limited by user_resource_selection. A user who filtered the site to ASVS+CWE can still get answers citing NIST, cheat sheets, etc.

Decide then implement

• Decide: should chat respect the profile view, always use the full corpus, or offer a toggle?
• If yes: pass selected standard names into PromptHandler retrieval and drop/hide out-of-view citations
• Empty selection = current behaviour (full corpus)
• Do not weaken login on /completion (Nest Agent service contract is Cited ask API + MCP tools so NestBot can ground security answers in OpenCRE #1074, unrelated)

Why later

Roadmap “user profiles with persistent standards filter” is the site view. Chat corpus filtering is a separate UX (users often want the chatbot to see everything). Ship CRE/search/explorer first.

Related

• application/web/web_main.py chat_cre
• Nest cited-ask: Cited ask API + MCP tools so NestBot can ground security answers in OpenCRE #1074

[Dreamstick9]

hey @northdpole ,I wanted to work on this but had some questions,

when someone has standards saved, what should chat do? only search their picks, keep searching everything like it does now, or use their picks by default with a toggle to search all (kinda like ?all=true)?

also if the filtered search doesn't find a good match, should it fall back to the normal uncited answer like today, or just tell the user that nothing in their standards matched?

and #1102 touches prompt_client.py too, should I wait for that to merge first?