Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Defense in depth for an AI application means making sure that no single prompt, document, model response or tool can grant unauthorized access or trigger an irreversible action. Start by mapping assets and trust boundaries, then enforce identity, retrieval permissions, tool scopes, output validation, resource limits and human approvals in ordinary application services outside the model. Add input screening and model guardrails as useful but fallible layers. This approach works for chatbots, retrieval-augmented generation (RAG) systems and autonomous agents because a compromised layer is contained by the next one.
What does defense in depth mean for an AI application?
It is a layered design in which each control addresses a different failure mode and a failure in one layer does not automatically become a breach. A hostile document can influence a model, for example, but it should not be able to bypass the retrieval service’s permission check, obtain a broad service credential or send an external message without an action-specific approval.
As an Amazon Associate I earn from qualifying purchases.
The model is a probabilistic component, not a security boundary. System instructions, a safety classifier or a “do not reveal secrets” rule can reduce risk, yet none can reliably enforce authorization. Security decisions belong in deterministic services that can identify the caller, inspect the requested resource or arguments, apply policy and deny the operation.
A useful mental model is a sequence of independent gates:
Popular on Amazon
- Identity and ingress: who is calling, what can they submit and how quickly?
- Context and retrieval: which sources may enter the prompt for this user and tenant?
- Model interaction: what instructions and untrusted data are clearly separated?
- Action enforcement: which tools, credentials, network destinations and write operations are allowed?
- Output handling: where will the response go, and can that destination execute it?
- Operations: can you detect, investigate, contain and recover from a violation?
AWS’s illustrative architecture separates UI, application, model and data interactions and shows five trust boundaries; it explicitly notes that other applications may have more or fewer (AWS’s defense-in-depth guidance). Microsoft describes related capabilities such as governance, provenance, identity, runtime containment and monitoring. Treat both as design examples, not a mandatory number of layers.
Which current risks and standards should guide the design?
Use the OWASP Top 10 for LLM Applications 2026 for current category names and pair it with the OWASP Top 10 for Agentic Applications 2026 when autonomous workflows add planning, memory and multiple tools. OWASP published the LLM list on August 3, 2026. Do not copy older category numbers: in the 2025 list, Excessive Agency was LLM06; in the 2026 list it is LLM03.
Free tools Windows power users keep installed
One-click scans. No signup required.
| 2026 category | What a layered design should address |
|---|---|
| LLM01 Prompt Injection | Separate instructions from data; constrain what retrieved or tool-supplied text can influence; enforce permissions outside the model. |
| LLM02 Sensitive Information Disclosure | Minimize context, apply data permissions and inspect responses and outbound destinations. |
| LLM03 Excessive Agency | Use least-privilege tools, caller-bound credentials, argument validation and approvals. |
| LLM04 Supply Chain | Review model, dependency, connector and data provenance; pin and monitor versions. |
| LLM05 Data and Model Poisoning | Approve sources, verify integrity and monitor changes to training, fine-tuning and retrieval data. |
| LLM06 Unbounded Consumption | Set request, token, retrieval, tool-call, time and spend budgets. |
| LLM07 Misinformation | Require source-aware responses, confidence handling and human review for consequential decisions. |
| LLM08 Hidden Context Exposure | Prevent leakage of system prompts, hidden metadata, chain-of-thought-like content and internal identifiers. |
| LLM09 Vector and Embedding Weaknesses | Protect indexes, namespaces, embedding pipelines, deletion and tenant isolation. |
| LLM10 Improper Output Handling | Escape or parameterize for the actual destination; validate structured fields before execution. |
The list is a risk taxonomy, not a probability forecast for your application. OWASP’s 2026 analysis assembled 7,714 public incidents, with 6,639 having enough detail to classify. The authors gave practitioner voting three-quarters of the ranking weight and incident data one-quarter, so these figures are inputs to the analysis—not incident rates, attack-success rates or the number of breaches across AI applications.
For governance, NIST’s voluntary AI Risk Management Framework (AI RMF) 1.0, released January 26, 2023, and its Generative AI Profile, released July 26, 2024, provide a risk-management structure. NIST says AI RMF 1.0 is being revised; neither document is a certification or a substitute for application-specific controls.
How do I map assets, trust boundaries and consequences?
Begin with a data-flow diagram and an inventory. Mark every place where text, identity, authority or data classification changes. Then rank workflows by consequence before choosing controls.
- Inventory identities: list end users, administrators, service accounts, background jobs and delegated identities. Record which tenant, role and data classification each can access.
- Inventory model inputs and state: include user prompts, system and developer instructions, model and embedding versions, fine-tuning data, retrieved chunks, conversation memory, caches and feedback queues.
- Inventory channels and connectors: include web and mobile UI, email, messaging, browser automation, web pages, file uploads, APIs, vector stores and external services.
- Inventory every action: document each tool, credential, database operation, network destination, write path and export route. Note whether it can alter data, spend money, contact a person or affect production.
- Draw boundaries: show UI-to-API, API-to-model, model-to-retrieval, retrieval-to-data, agent-to-tool and tool-to-external-network crossings. Label who can cross each boundary and what policy is evaluated there.
- Classify workflows: mark them read-only, sensitive, destructive or externally visible. A read-only FAQ can have a different approval policy from a workflow that deletes records or sends messages.
Write the worst credible outcome beside each boundary: cross-tenant disclosure, credential misuse, destructive change, malicious code execution, fraudulent communication, denial of service or regulatory exposure. A printed reference such as Adam Shostack’s Threat Modeling: Designing for Security (Wiley, ISBN 9781118809990, 2014) can help structure the exercise, but pair its general methods with current OWASP 2026 AI guidance.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsAlso popular on Amazon
How should I secure ingress and untrusted context?
Authenticate the caller before accepting a request, enforce tenant and role context server-side, cap input size and rate, and inspect uploaded files and external text. Treat everything arriving from a user, web page, email, document, tool response or memory store as untrusted—even if it appears to contain instructions from an administrator.
- Use a gateway for authentication, authorization, request quotas, content-size limits and abuse detection.
- Parse files in isolated services; reject active content where it is not needed and scan archives for decompression bombs and oversized expansion.
- Carry a source identifier, tenant, classification, timestamp and integrity status with every piece of context.
- Keep trusted instructions in a separate, protected channel or data structure. Delimit untrusted text for readability, but do not treat labels such as
UNTRUSTEDas an enforcement mechanism. - Threat-model direct injection in the user’s prompt, indirect injection in retrieved pages or tool responses and persistent poisoning in memory.
Classifiers and prompt-separation techniques are risk reducers, not authorization. OWASP’s guidance warns that a model cannot be expected to maintain a security boundary merely because a prompt says so. If a screening service fails, the safe behavior for a high-impact operation is to stop or route to review, not silently proceed with broader permissions.
How do I secure a RAG chatbot before it retrieves documents?
Make retrieval a permissioned data service, not a similarity-search shortcut. Every query should be evaluated for the requesting identity, tenant and data classification before chunks enter the model context.
- Approve sources: maintain an allowlist of repositories and owners. Record provenance, licensing or handling requirements and the date of approval.
- Validate ingestion: parse and normalize documents in a restricted pipeline; detect hidden text and suspicious instructions; maintain an integrity baseline and review changes.
- Preserve authorization metadata: carry document owner, tenant, group, classification, retention and deletion state through chunking and embedding. Do not discard metadata because it is inconvenient for search.
- Enforce permission-aware retrieval: apply the end user’s current authorization to every candidate document and chunk. A filter applied only after generation is too late.
- Isolate tenants and classes: use separate namespaces or indexes where appropriate, and test that a query cannot cross them through shared caches or approximate-neighbor behavior.
- Constrain context: cap the number and size of chunks, prefer approved sources and reject stale or integrity-failed records. Fail closed if an authorization or integrity check cannot run.
- Protect lifecycle paths: secure index administration, cache keys, backups and deletion. A deleted source must not remain indefinitely retrievable from an embedding index or response cache.
OWASP’s RAG Security Cheat Sheet groups foundational, next-stage and advanced controls; you can phase them according to risk rather than deploying every sophisticated embedding defense on day one. Microsoft describes permission-aware indexes, document-level security trimming and managed identities as implementation options. A cryptographic digest can show that content matches an approved baseline; it cannot prove that the approved content is benign.
How do I stop an AI agent from calling the wrong tool?
Put a policy-enforcing tool broker between the model and every capability. The broker should identify the initiating user, verify the specific operation and arguments, issue the narrowest usable credential and restrict network egress. Never allow a model-generated request to become authority merely because it is syntactically valid.
| Control | Implementation question |
|---|---|
| Least privilege | Can this tool read only the records and fields required for this task? Can it run without delete, admin or export rights? |
| Caller binding | Is the credential tied to the user and tenant, rather than a powerful shared agent account? |
| Argument validation | Are IDs, amounts, recipients, paths, queries and URLs checked against an allowlist and business rules immediately before execution? |
| Egress control | Can browsing, code or HTTP tools reach only approved domains, ports and services? |
| Isolation | Does untrusted browsing or code run in a sandbox with no ambient secrets and a short lifetime? |
| Approval | Does a human or separate policy service approve this exact action, arguments and destination? |
Require action-specific approval for consequential writes, outbound messages, purchases, permission changes and destructive operations. Google’s Secure AI Framework states the principle directly: “Ensure user approval for any actions performed by agents/plugins that alter user data or act on the user’s behalf” (Agent User Control). A prompt that tells an agent to ask for permission is not an approval gate; the gate must be enforced by code that can deny execution.
Also popular on Amazon
How should output be validated before it reaches another system?
Assume the response is hostile to its next destination. Validate its structure and policy outside the model, then apply the destination’s safe-handling rules.
- Web UI: render plain text by default; use context-appropriate HTML escaping and a strict content-security policy if rich text is required.
- Databases: use parameterized queries and fixed operation templates. Never concatenate model text into SQL, shell commands or filesystem paths.
- APIs and tools: validate types, ranges, enumerations, ownership, destination and business invariants. Reject unknown fields and ambiguous defaults.
- Email and messaging: check recipients, attachments, links, sensitive fields and whether the message is allowed for the initiating user.
- Exports: run a separate disclosure check against classification and recipient policy; redact or block rather than relying on a refusal in the generated text.
Content filters can catch some unsafe material, but they do not replace escaping, authorization or executable-tool restrictions. If structured output fails schema validation, stop and request a new response or send the case to review instead of attempting to “repair” arbitrary text into an executable command.
What conventional security controls still matter?
AI-specific safeguards sit on top of ordinary application security. Use strong authentication and session controls, encryption in transit and at rest, managed secret storage, dependency review, patching, network segmentation and secure software-delivery practices. Review the provenance and licensing of models, embeddings, plugins, datasets and containers; pin versions where practical and monitor changes.
Set budgets at several levels: requests per identity, input and output tokens, retrieved bytes, tool calls, wall-clock time, concurrency and monetary spend. Make limits tenant-aware and fail closed when they are exceeded. Unbounded loops, recursive planning and expensive retrieval can become denial-of-service or financial incidents even when no data is disclosed.
Log enough to reconstruct a decision without creating a second sensitive-data store. Useful fields include initiating identity and tenant, request and conversation identifiers, model and policy versions, source and retrieval identifiers, policy results, tool name and validated arguments, approval identity and outcome, latency, budget consumption and final disposition. Exclude credentials and minimize raw prompts and responses; hash or tokenize sensitive values when full content is unnecessary.
Assign owners for design, implementation, detection and governance. Define who can disable a connector, revoke a credential, quarantine an index, roll back a model or notify affected users. A response runbook should cover suspected prompt injection, cross-tenant retrieval, poisoned content, tool misuse, data disclosure and runaway consumption.
Also popular on Amazon
How do I test defense in depth before release?
Test every real entry channel and boundary, not just a prompt box. Use dummy data and instrumented tools for dangerous cases, and record both legitimate-task success and attempted policy violations.
- Send direct injections through the UI, API and file-upload paths.
- Plant indirect instructions in retrieved documents, web pages, email, calendar entries and tool responses.
- Attempt unauthorized cross-tenant and cross-classification retrieval, including through caches and conversation memory.
- Modify or replace documents, embeddings, model packages and connector responses to test poisoning and provenance checks.
- Ask the agent to exceed its scopes, alter arguments after approval, reuse another user’s credential or reach an unapproved network destination.
- Exercise XSS, template injection, SQL, shell and path attacks through generated output sent to each destination.
- Exhaust request, token, retrieval, tool-call and time budgets; verify predictable throttling and recovery.
- Break approval services, policy engines, identity providers and integrity checks; confirm high-impact actions fail closed.
- Replay logs and alerts to ensure operators can identify the initiating identity, context, version, decision and action without collecting unnecessary content.
OWASP’s small illustrative prompt sets are smoke tests, not representative security benchmarks. Repeat tests after meaningful changes to models, prompts, retrieval indexes, connectors, permissions or tool schemas. Track false positives and legitimate-task completion as well as blocked attacks: an unusable system encourages operators to bypass controls.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should I choose controls and manage their trade-offs?
Compare controls by the rule they enforce and the failure they contain, not by the number of products involved. Ask these questions for each proposed layer:
- Does it enforce a rule outside the model, or merely influence the model’s answer?
- Is retrieval permission checked for every user and chunk, including cached results?
- Are credentials, tools and egress narrow enough that one compromised call has limited impact?
- Is approval bound to the exact action, arguments, recipient and current policy?
- Does testing include indirect sources and benign requests, not only adversarial prompts?
- Can investigators diagnose a violation without retaining unnecessary sensitive text?
- What latency, operational work, availability risk and cost does the control add?
Apply stronger isolation, shorter credentials, mandatory approval and tighter budgets to sensitive or destructive workflows. A low-risk, read-only assistant may use automated screening and sampling, while a system that changes customer records should require caller-bound authorization, schema validation and explicit approval. Document accepted residual risk and revisit it when data, users, models or tools change.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What does a practical rollout sequence look like?
Ship the controls in an order that prevents obvious authority escalation while you improve detection and sophistication.
- Foundation: diagram flows, classify data and actions, authenticate users, isolate tenants, protect secrets, establish logging and set basic budgets.
- Permissioned context: approve sources, preserve provenance and authorization metadata, enforce retrieval checks and secure caches and deletion.
- Contained actions: introduce a tool broker, least-privilege credentials, argument schemas, egress allowlists and sandboxing; make consequential operations approval-gated.
- Safe destinations: implement output schemas, escaping, parameterized queries, disclosure checks and destination-specific policies.
- Assurance: run boundary-focused abuse tests, monitor policy decisions and drift, rehearse incident response and review model, dependency and connector provenance.
At every stage, retain a safe read-only mode. If a policy service, identity check or integrity verification is unavailable, downgrade the workflow rather than silently granting broader access. This is the practical meaning of defense in depth: useful service continues where possible, while high-consequence authority remains unavailable until its controls recover.
Also popular on Amazon
What defense in depth cannot guarantee
No prompt template, RAG grounding method, guardrail model or scanner makes injection impossible. Layering reduces blast radius and improves detection; it does not turn probabilistic generation into a proof of safety. Likewise, an OWASP category ranking is not a measured likelihood for your deployment, and a digest proves consistency with an approved baseline—not that the content is safe.
Exact settings depend on your model, cloud, data classifications, identity system and tools. Re-evaluate boundaries whenever you add memory, browsing, code execution, a new connector, a new tenant or a model with different capabilities.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteFrequently Asked Questions
Is a system prompt enough to stop prompt injection?
No. A system prompt can express priorities, but retrieved text, tool output and user input can still influence a model. Enforce authorization, retrieval filtering, tool scopes and output handling in services outside the model, and treat prompt rules as one supplementary layer.
Should every AI action require a human approval?
Not necessarily. Use risk-based gates: routine read-only operations can be automated with least privilege, while data changes, external messages, purchases, permission changes and destructive actions should require approval tied to the exact arguments and recipient.
How do I prevent a RAG cache from leaking another tenant’s data?
Include tenant, user authorization context, classification and policy version in cache keys, or avoid shared caching for sensitive results. Recheck current permissions before serving a cached chunk or answer, and invalidate entries when source access or deletion status changes.
What should I log when privacy limits raw prompts and responses?
Log identity, tenant, request and context IDs, model and policy versions, retrieval and tool identifiers, validated arguments, approval results, budget use and disposition. Store only the minimum prompt or response content needed for investigation, and exclude credentials and unnecessary personal data.
When should an AI workflow fail closed?
Fail closed when identity, authorization, integrity, tenant isolation or action approval cannot be verified, especially before a write, disclosure or external side effect. For low-impact informational requests, you may return a constrained read-only response while clearly recording the degraded state.
The Bottom Line
Build AI security as a set of independently enforced boundaries: permission-aware data access, least-privilege and approval-gated tools, destination-safe output handling, budgets, monitoring and tested response procedures. Model guardrails help, but they should never be the only barrier between untrusted text and consequential authority.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
