Secure AI applications beyond the prompt
An application-level security review covering authority, data flow, integrations, and output handling using current OWASP guidance.
Review the whole application
OWASP guidance highlights risks including prompt injection, sensitive information disclosure, supply-chain weaknesses, improper output handling, excessive agency, and unbounded consumption. These risks span the application, integrations, identity, data, and operations.
A strong review traces how untrusted input can influence retrieval, tool selection, generated output, and downstream actions.
Constrain authority and data flow
A model should not inherit broad application permissions. Put deterministic checks between generated intent and consequential action, scope credentials narrowly, and require confirmation or human review where errors carry material cost.
- Separate read and write capabilities.
- Validate tool arguments outside the model.
- Sanitise generated output before downstream use.
- Limit request size, duration, and repeated actions.
Test attacks as workflows
A single hostile prompt is not enough. Test indirect instructions in retrieved documents, cross-user data boundaries, encoded content, tool misuse, and failure recovery. Record the accepted limits and rerun those tests as the system changes.