Security for AI-Powered Products: Prompt Injection, Permissions, and Approval
Secure AI products by treating model input as untrusted, constraining tools and data, validating outputs, and monitoring trajectories.
AI products combine probabilistic behavior with conventional application risk. When a model can read external content and use tools, untrusted instructions can travel through documents, websites, messages, or retrieved data and influence what it does.
Security must assume that model-visible content can be hostile and that the model can make mistakes even without an attacker.
Separate data from authority
Treat retrieved and user-supplied content as data, never as permission. Keep policy and tool authorization outside that content. Restrict sources, label provenance, minimize sensitive context, and prevent the model from selecting credentials or widening its scope.
- Use least-privilege tools and service accounts.
- Separate read, draft, and commit capabilities.
- Do not place secrets in prompts or retrievable documents.
Validate every action boundary
Tool calls should pass through deterministic schemas and business-rule validation. High-impact actions require informed approval showing the exact destination, data, change, or cost. Sanitize output before rendering or passing it to another interpreter.
- Allowlist tools, arguments, destinations, and file types.
- Require approval for communication, deletion, payment, access, and publication.
- Rate-limit actions and detect unusual sequences.
Test attacks and ordinary failure
Build evaluations for direct and indirect prompt injection, data exfiltration, tool misuse, confused identity, excessive action, and failure to stop. Monitor trajectories and retain enough evidence to understand incidents without unnecessary sensitive content.
- Red-team realistic connected workflows.
- Test model, prompt, tool, and policy changes.
- Maintain a kill switch and manual recovery path.
Final perspective
An AI feature is secure when the surrounding system limits what a mistaken or manipulated model can see, decide, and change.
Research references
This TivroTech article synthesizes the following primary and practitioner guidance with our own practical analysis:
