AI applications depend on models, inference endpoints, retrieval systems, agents, and external tools. Document which teams own these components and how each one is deployed, accessed, and changed.
Trace the identity and tool boundary
Review which identity invokes the model and which permissions the surrounding application or agent receives. Tools that can read storage, call internal services, or change business systems deserve deliberate access controls and review.
Follow the data
Map the sources of prompts, retrieved content, outputs, and logs. Identify where sensitive information could enter or persist, then review access, retention, and handling against your organization’s requirements.
Treat inputs as untrusted
External documents and tool responses can contain misleading or adversarial instructions. Keep authorization boundaries outside model-generated decisions, validate actions at the application layer, and test likely misuse cases.
Revisit controls as the system changes
A new tool, data source, or deployment environment changes the risk picture. Maintain a review process tied to engineering changes and confirm that permissions remain aligned with the intended use.
← All field notes