whitepaper

AI Security: An Engineering Reference.

Assume the model can be persuaded on some fraction of requests, permanently, then design for what happens next. This reference holds twenty-one controls across seven families, each written as a requirement, a test that proves the requirement holds, and the place in an ordinary stack where it lives. Every family carries OWASP, MITRE ATLAS and NIST AI 600-1 identifiers, so the controls can be cited inside your own security standard rather than argued from first principles every time a customer sends a questionnaire.

Download whitepaper Talk to Our Engineers

In depth

Three Controls Almost Everyone Believes They Already Have.

Retrieval that respects permissions is usually a post-filter.

The implementation retrieves broadly with a service account and drops unauthorised documents before composing the answer, which then fails on a ranking change, on a summariser that runs ahead of the filter, and on a citation panel that renders candidates. Entitlements belong in the query, applied before ranking rather than after it. Settle it one way this week: pick a document, name three roles, and assert that it is absent from the candidate set.

In shortassert that it is absent from the candidate set

Least privilege on tools is often a single credential.

Every tool has a narrow name, a schema and a carefully worded description, and behind all of them sits one integration account holding the union of every permission any tool has ever needed. The scoping lives where the model reads it and nowhere that enforces it. Take the read-only token, attempt the write, and see which of those two stories your stack actually tells.

In shortsee which of those two stories your stack actually tells

Output validation happens once, in the wrong place.

A schema check at the model client confirms the completion parses into the expected shape, and nothing after that encodes the value for the sink it reaches, so a well-formed string arrives unescaped at a query, a shell, a DOM node or an image URL. Treat every completion as hostile input to whatever consumes it next, since this class exploits deterministically. One injection case per sink, running in CI, is most of the fix.

In shortis most of the fix

The detail

Where The Blast Radius Gets Set, And What Proves The Limit Holds.

Seven families is a lot to hold in your head at once. These three decide how far a single persuaded completion travels, and each carries a test you can run this week rather than a principle everyone in the review can agree with.

Zone · 01

Trust zones

Retrieved content is data and never instruction. Each segment is tagged trusted, semi-trusted or untrusted and passed in structured fields, with system policy re-asserted server-side on every call. The component that chooses tools reads no untrusted content at all, which a trace assertion proves: no retrieval payload in the planner context, ever.

Zone · 02

Tool scoping

Each tool holds its own identity, scoped to its narrowest action, and the callable set for a session is decided by the server from the caller role rather than requested in a prompt. Payments, deletions, merges and permission changes wait for a human who is shown the exact parameters. The test is blunt: an out-of-scope call returns a refusal.

Zone · 03

Trace capture

Prompt, retrieved chunk identifiers, every tool call with its parameters, the completion and the caller identity, all carried on one correlation ID. The proof is a timed reconstruction of a named historic session, end to end. Fourteen days off a containment window is worth around $370K at the 2026 hourly figure, which no span schema costs.

By the numbers

The figures that make it a board-level conversation.

controls across seven families, each with a named test and a place in the stack

$5.89M

average cost where prompt injection was the entry point, the second costliest AI breach type

under 50%

of organisations actively secure non-human identities, the accounts agents run as

Inside the report

What you'll take away.

Step 1 - Pin models, adapters and tokenizers by digest

Weights are executable content in most loaders and a tag is not a version. Fail the build on any tag-only reference, refuse pickle checkpoints at load, and attach a model bill of materials to the release.

Step 2 - Give every agent a directory identity and a human owner

Fewer than half of organisations secure non-human identities. Make each agent a principal that appears in the quarterly access review, issue short-lived tokens, and keep a never list covering admin roles, signing keys and payment credentials.

Step 3 - Control what writes into the retrieval corpus

Authenticated, attributed writes on every source feeding the index, a scan for instruction-like text and invisible characters, a maximum index age, and permissions re-applied at rebuild. A poisoned canary document should be caught there.

Step 4 - Put a cost breaker in front of the gateway

Per-tenant and per-feature ceilings, a concurrency cap, a maximum tool-call depth, and a breaker that fails closed. Prove it with a load test that trips the breaker and lands on the fallback path.

Questions

Frequently asked.

Where do we start if the AI feature is already live?

Run the three tests in the first section against it: a per-role retrieval assertion, a read-only token on a write path, and one injection case per output sink. Each takes an afternoon and tells you whether the control you believe you have is enforced anywhere. Fix what fails before adding families.

Is a prompt injection classifier a control or not?

It is telemetry, and useful as telemetry. A classifier scores text probabilistically, so treating it as a boundary means your boundary has a failure rate you cannot state. Put the boundary where enforcement is deterministic: the tool gateway, the retrieval entitlement check, the schema validator and the egress allowlist.

Our agent uses an API key already, so what is the problem?

A long-lived key is a shared account with no owner and no expiry. Make the agent a directory principal with a named human owner, exchange for short-lived tokens at the tool gateway, and hold a deny list in the broker. The test is whether the agent turns up in the quarterly access review.

How do these controls map onto an audit or a customer questionnaire?

Every family carries OWASP LLM, MITRE ATLAS and NIST AI 600-1 identifiers, so you can cite recognised references beside your own control IDs. The test column matters more in practice: an assessor asking for evidence gets a dated CI result rather than a description of intent.

How does this sit next to your other AI security paper?

This one covers what to build and how to prove it works. AI Security Under Regulation covers which obligation makes each control mandatory and by when, including the NIS2, DORA and GDPR notification windows. Use them together when a customer asks for both the control and its legal basis.

Who is this reference for?

AppSec engineers, platform teams and security architects who have to implement rather than approve. It is written to be opened at a family and read in five minutes, so it assumes working knowledge of retrieval, agents and CI, and it names the test rather than describing the principle behind it.