Map the AI system
Identify data sources, model providers, retrieval paths, tool calls, output consumers and decisions that can create material impact.
Protect inputs and authority
Treat user and retrieved content as untrusted. Validate tool arguments, restrict permissions and separate generated suggestions from authorised actions.
Test meaningful failure modes
Evaluate prompt injection, data leakage, cross-tenant access, unsafe tool use, model extraction, denial of service and unreliable outputs in the actual application context.
Monitor change
Record model and prompt versions, policy decisions, important tool calls and user-impacting outcomes. Re-evaluate when models, data or integrations change.
Treat the model as one componentThe application, retrieval sources, prompts, tools, identities, logs and human decisions often create more immediate risk than the model file alone.