Skip to content

Part 4 — Summary

Part 4 treated security and governance as cross-cutting disciplines, not as a final layer. What was established:

  • Defensive operational premises come before any control: untrusted inputs, tools can cause damage, agents can amplify privileges.
  • Threat modeling in AI uses adapted STRIDE + OWASP LLM Top 10 + NIST AI RMF + MITRE ATLAS, and ends in formally accepted residual risk.
  • Prompt injection has no complete defense. The defensible architecture is the one that limits the blast radius when injection happens.
  • Tool misuse and excessive agency are architectural risks addressed by identity, allowlist, schema, policy, idempotency, rate limits and HITL.
  • Memory and vector poisoning require discipline in ingestion, provenance and lifecycle.
  • PII, DLP and tenant isolation are boundary controls; tenant filter in storage, not in the prompt.
  • Policy-as-code with Rego/Cedar turns a critical rule into a testable, versioned artifact.
  • The knowledge source catalog (Ch. 4.12) governs the inventory of sources — owner, origin, classification, freshness and lifecycle — connecting RAG, KG, data quality and supply chain.
  • Agent identity and delegated authorization position the agent as a first-class citizen in the IdP.
  • AI supply chain involves models, datasets, prompts, MCP servers, A2A peers — SBOM, SLSA, signing and capability review are no longer optional.
  • Sandboxing and egress control isolate dangerous execution; "code generated by an LLM" never executes outside a sandbox.
  • Governance and audit logs complete the cycle: inventory, risk classification, pre-production approval, incident runbook.

Part 5 enters continuous operation with the premise that security is not a final state; it is a daily practice.