AI security

Beginner — What is prompt injection?

• It is an attempt to redirect the model through attacker-controlled instructions.
• When those instructions appear in a PDF, webpage, email, or tool result, it is indirect injection.
• I treat these sources as data and limit model authority.

Intermediate — Why avoid direct database access?

• A generated query can read too much, mutate data, or consume excessive resources.
• I expose narrow schema-defined business tools with authorization, parameterized queries, field projection, and limits instead of broad database credentials.

Senior — What are the main trust boundaries?

• Browser to API, documents to parser, model to tool executor, tool to business service, cross-tenant retrieval/memory/cache, and application to provider/telemetry.
• At each boundary I validate, minimize, authorize, and record permitted outcomes.

Scenario — An invoice tells the agent to email private records. What blocks it?

• The invoice is untrusted content.
• The agent lacks unrestricted read/send tools, the tool service checks object access and recipients, and sending requires the configured approval.
• A better prompt helps but does not serve as the primary barrier.