Make AI systems safer by controlling how they behave, not only what they say.
AI security isn't a new discipline bolted onto old ideas — it's applying deterministic, verifiable controls to a system that's inherently probabilistic. The same assurance mindset that secures cryptographic key material and payment infrastructure applies directly to LLM and agentic systems; the attack surface is different, the discipline isn't.
Five categories that actually matter in practice.
Mapped to the OWASP Top 10 for LLM Applications — the current, authoritative list is linked in Resources; this is the subset that shows up most often in real reviews.
Prompt injection
Crafted input — direct, or indirect via retrieved content — that overrides system instructions. Mitigate with instruction hierarchy and by treating any external content as untrusted data, never as instructions.
Insecure output handling
Treating model output as trusted, structured data when it's neither. Validate and sanitise every output before it reaches a downstream system, exactly as you would user input.
Excessive agency
Giving a model or agent more permission, autonomy, or tool access than the task requires. Bound what actions are possible before you bound what actions are likely.
Sensitive information disclosure
Models trained or fine-tuned on sensitive data — or given broad retrieval access — can surface it in ways the original access controls never anticipated. Data minimisation and output filtering, not just input controls.
Supply chain and provenance
A model, dataset, or plugin from an unverified source carries the same risk as unverified code, because increasingly, it is code. Track provenance the way you'd track a software bill of materials.
A reference control flow, not a diagram of good intentions.
Five stages, in order. The deterministic gateway and the human checkpoint are the two most commonly skipped — and the two that actually stop an incident.
- Untrusted input User prompts and any retrieved or tool-sourced content — treated identically, regardless of source.
- Validation and isolation Instruction hierarchy enforced; untrusted content structurally separated from system instructions before it reaches the model.
- Model The probabilistic component — scoped to the narrowest capability and permission set the task actually needs.
- Output validation gateway A deterministic layer that schema-checks, sanitises, and — for privileged actions — blocks model output before it reaches anything downstream.
- Human-in-the-loop checkpoint For irreversible or high-consequence actions specifically, not every action indiscriminately — approval gates that sit structurally in the pipeline, not as a policy document describing intent.
What a reviewer expects to see.
Evidence, checkpoints, and review expectations — not general advice about being careful with AI.
- Control descriptions for prompt, context, and output handling.
- Human-in-the-loop checkpoints for privileged actions, with the trigger conditions documented.
- Logging and traceability sufficient for post-incident review, not just uptime monitoring.
- Adversarial test notes and response procedures for the high-risk scenarios specific to the system.
See how this becomes an engagement.
AI Security Architecture & Threat Modelling is scoped against exactly this control flow.