AI API security, privacy, and data governance

Beginner: protect keys and data first

Keep the site API key in server-side environment or secret management, never in frontend code, repositories, logs, screenshots, or shared URLs. Give each application a separate token with the smallest model, group, quota, and lifetime. A leak should revoke one token rather than every workload.

Copyallow request only if:
authenticated tenant AND allowed model AND allowed endpoint
AND request size within limit AND remaining budget sufficient

Classify and minimize input

Label public, internal, confidential, PII, credentials, and regulated data before sending. Remove unused fields and redact or irreversibly replace identifiers and access tokens. RAG must filter documents by the current user's authorization before retrieval; retrieving everything and asking the model to keep secrets is not access control.

Files, URLs, and content attacks

URL fetching needs SSRF, redirect, and response-size defenses. Uploads need format, size, decompression-ratio, parsing-time, and malware controls. Prompts, web pages, and files are all untrusted content that can attempt to override system instructions, extract secrets, or induce a tool action.

Tools and output

A model may propose a tool call, but the server must validate tool name, schema, tenant ownership, and operation permission again. Payment, deletion, and outbound messaging need confirmation, approval, or two-phase commit. Structured output constrains shape, not trust; URLs, SQL, paths, HTML, and shell arguments need domain-specific validators and safe APIs.

Logs, retention, and supply chain

Log Request-ID, model, channel, policy outcome, and redacted errors. Never log full keys, Base64 media, signed URLs, raw PII, or sensitive prompts. Verify the actual routed upstream, region, training use, abuse monitoring, retention, and deletion process. When a platform hosts a third-party model, platform and originator boundaries must remain distinct.

Expert threat model and verification

For each workload, maintain assets, trust boundaries, attackers, abuse paths, controls, and evidence. Test cross-tenant access, prompt injection, tool escalation, SSRF, DNS rebinding, MIME spoofing, log leakage, replay, and spend exhaustion. Monitor unusual tokens, body sizes, destination hosts, tool failures, and refusal rates, and rehearse key rotation and provider failover.