loading…
The minimum control layer every GenAI system needs before Chapter 4 develops the full security and reliability model.
Adding a model does not suspend ordinary application security. Every request still needs a user, service, tenant, or workload identity that can be propagated to retrieval and tools.
The model should not invent identity or select its own privilege level. The host binds the authenticated principal to the request and downstream credentials.
| Concept | Question |
|---|---|
| Authentication | Who is making the request? |
| Authorization | What are they allowed to read or do? |
| Delegation | What limited authority may the AI exercise on their behalf? |
Delegated credentials should be scoped to the task, resource, action, and time window whenever possible.
An AI runtime should not inherit broad credentials merely because it runs inside a trusted service. Give each tool the narrowest capability required. Separate read from write, production from staging, and one tenant from another.
The model may decide which eligible capability to request. It should not decide which capabilities it is eligible to have.
Keep API keys, database credentials, and private tokens out of prompts and model-visible logs. Use secret managers and short-lived credentials. Redact sensitive fields before sending data to a model when the task does not require them.
Define the boundary for:
Guardrails are deterministic or model-assisted checks around input, output, retrieval, and actions. Basic controls include schema validation, content classification, tool allowlists, spend limits, rate limits, and human approval for high-impact writes.
A guardrail is not a single universal safety filter. Chapter 4 will combine threat modeling, evaluation, runtime controls, observability, and governance into defense in depth.
Record who requested an action, which model and prompt version produced the proposal, what evidence was used, which policy approved it, and what tool actually executed it. When identity or authorization is ambiguous, deny or escalate rather than asking the model to guess.
Chapter 2 has assembled the reusable parts: models, instructions, context, retrieval, schemas, tools, runtimes, MCP, state, and control primitives. Chapter 3 will combine these blocks into direct LLM applications, RAG systems, deterministic workflows, agents, and multi-agent systems.