AI security
Words made simple
A few useful meanings before you read the explanation.
- API
- A way for one piece of software to ask another for data or an action. A claims API might return the current status of a claim.
- Retrieval
- Finding and fetching information that is useful for the current question.
- Schema
- A description of the fields and value types that data should contain. It helps check that an answer has the expected shape.
More words from this lesson
- Agent
- An application that uses a model to choose its next action within defined limits. It can use tools and continue through several steps.
- Authorization
- Checking what that identity is allowed to read or do. Being logged in does not grant access to every record.
- Tenant
- A customer or organization whose data must stay separate from other customers in a shared application.
- Prompt injection
- Untrusted text tries to redirect the model or override its task. Retrieved documents and tool results can contain such instructions.
- Caching
- Keeping a result so it can be reused instead of calculated or fetched again. Cached data needs expiry and access controls appropriate to its use.
Beginner — What is prompt injection?
- It is an attempt to redirect the model through attacker-controlled instructions.
- When those instructions appear in a PDF, webpage, email, or tool result, it is indirect injection.
- I treat these sources as data and limit model authority.
Intermediate — Why avoid direct database access?
- A generated query can read too much, mutate data, or consume excessive resources.
- I expose narrow schema-defined business tools with authorization, parameterized queries, field projection, and limits instead of broad database credentials.
Senior — What are the main trust boundaries?
- Browser to API, documents to parser, model to tool executor, tool to business service, cross-tenant retrieval/memory/cache, and application to provider/telemetry.
- At each boundary I validate, minimize, authorize, and record permitted outcomes.
Scenario — An invoice tells the agent to email private records. What blocks it?
- The invoice is untrusted content.
- The agent lacks unrestricted read/send tools, the tool service checks object access and recipients, and sending requires the configured approval.
- A better prompt helps but does not serve as the primary barrier.
Can you explain it without the notes?
AI security
Use your own words. Explain an example and one limitation before checking the explanation.
Check your explanation
Beginner — What is prompt injection?
Turn this concept into a clear answer.
Practice this conceptAdapted from 13_AI.MD · “29.13 AI security”. Examples are study fragments; framework behavior can depend on your version.