Later: filter chat RAG by saved standards selection

Parent: #1079 · Not a November blocker · Project: https://github.com/orgs/OWASP/projects/60

What

Product choice, tracked so it does not get silently skipped or silently done.

Chat (/rest/v1/completion) already requires login (spend control). Retrieval is not limited by user_resource_selection. A user who filtered the site to ASVS+CWE can still get answers citing NIST, cheat sheets, etc.

Decide then implement

• Decide: should chat respect the profile view, always use the full corpus, or offer a toggle?
• If yes: pass selected standard names into PromptHandler retrieval and drop/hide out-of-view citations
• Empty selection = current behaviour (full corpus)
• Do not weaken login on /completion (Nest Agent service contract is #1074, unrelated)

Why later

Roadmap “user profiles with persistent standards filter” is the site view. Chat corpus filtering is a separate UX (users often want the chatbot to see everything). Ship CRE/search/explorer first.

Related

• application/web/web_main.py chat_cre
• Nest cited-ask: #1074

Start with application/web/web_main.py and the chat_cre entry point for /rest/v1/completion, then trace how PromptHandler performs retrieval. Resolve whether chat should use the saved standards selection, the full corpus, or a toggle before implementing; preserve full-corpus behavior for an empty selection and keep the existing login requirement.