AI applications face risks including prompt injection, unintended data exposure, and unauthorized tool use. Define the data and action boundaries for each application, then verify controls against realistic adversarial inputs. Do not infer complete protection from the presence of a model safety prompt.
Prompt injection can arrive through user messages, retrieved documents, tool outputs, or other untrusted material. It can attempt to redirect the model away from its intended task. Keep trusted instructions separate where supported, but enforce permissions and action limits in application code because prompt organization alone is not an authorization boundary.
Layer defenses around explicit trust boundaries. Validate structured tool inputs, authorize the requested operation independently, restrict available tools, and review consequential writes. Pattern filters and output classifiers may add signals, but they can miss novel attacks and should not be described as complete prevention.
Filter retrieval by the authenticated user's permissions and verify ownership again when loading the underlying record. Test cross-tenant and revoked-access cases, including cached results and alternate retrieval paths. Access-aware retrieval reduces exposure only when the surrounding authorization and cache controls are implemented correctly.
Use proportionate rate limits and abuse monitoring based on relevant request and workflow signals. Define what happens when a limit is reached, provide a recovery path for legitimate users, and review false positives. Monitoring should collect only the information needed for its stated purpose.
Create audit records that explain the actor, permitted action, relevant source references, and outcome. Redact secrets and minimize private context rather than logging every prompt and retrieved document by default. Apply access restrictions and retention rules to the audit store itself.
The security landscape for AI applications will continue to evolve as models become more capable and adversaries more sophisticated. Building security into the architecture from the start — rather than bolting it on after deployment — is the only sustainable approach.
