Chapter 06 · The fix
Ten habits
that hold
Twenty risks, ten habits. Not because the maths is neat, but because the same handful of behaviours keeps showing up in the post-mortems - and their absence keeps showing up too.
Ten habits, twenty risks
Each habit below names the risk it retires. That mapping is the point: if you cannot say which risk a control is for, you cannot tell whether it is working, and you cannot defend the cost of keeping it.
Tick what you already do. The ring fills, the browser remembers, and you can copy the list into a ticket or an email. Nothing is uploaded and there is no account.
The uncomfortable finding
Every incident in this guide was preventable with a habit that costs nothing but attention: a second approval, a callback, a review before sending. The technology moved fast. The failure modes did not.
The ten habits
Ten habits in place
Nothing ticked yet.
Read it before it leaves your hands. Anything that will be filed, paid, published, or sent under a person's name gets a human check - and the check has to be able to say no.
Any unusual request involving money, access, or new bank details gets a callback on a number you already have. Not a reply, not a second video call - a channel the requester did not choose.
One tool per job, scoped tokens, no shared admin identity, and a review date on every permission. Least privilege applied to AI also means least agency: the fewest actions it can take alone.
Payments, deletions, permission changes, public posts. Approve the specific action, not the general plan - and split draft from send so the gate is meaningful.
Prompts, retrieved sources, tool calls, outputs, and the identity behind each one. Then read the logs on a schedule, because an unread log is a rumour with a timestamp.
No keys, credentials, internal thresholds, or personal data in a system prompt or a paste box. Assume anything you type can be repeated back under the right pressure.
Strip hidden text from uploaded files. Never treat retrieved text as instructions. Validate output against a schema before it reaches a browser, a database, or a shell.
A register of models, tools, MCP servers, and data sources, each with an owner. Plus an acceptable-use policy with a sanctioned alternative, so shadow AI has somewhere to go.
Rate limits, token caps, budget alerts that page a person, and a kill switch you have tested. An uncapped endpoint is a blank cheque in your name.
Run five red-team tests in an afternoon. Write down who declares an incident, who switches it off, and who calls the bank. One rehearsal beats a hundred pages of policy.
Ten habits, twenty risks, and the mapping is deliberately uneven - one habit often retires three. That is the honest shape of this work: the controls are few, and they are mostly about permission and attention.
If you are the person in charge
You do not need a security team to start. You need to make four things true, in this order, and each one is a sentence rather than a project.
Someone owns the list
One name against every AI system in use, including the ones bought on a card. "Everyone" is not an owner.
Someone can switch it off
Named in the register, tested twice a year, and reachable at 2am. This single control converts most catastrophes into inconveniences.
Anyone can challenge a request
Say it out loud in a meeting, repeatedly. Permission to question authority is the control that catches what technology misses.
Nothing irreversible is automatic
Payments, deletions, and public statements keep a human in the loop - specifically, an approval of that action, not a nod at a plan.
The closing argument
Nothing in this guide requires you to be afraid of AI. It requires you to be specific. Name the risk, name the control, name the owner, name the date - and then check again next quarter, because the system will have changed.
That is the whole method. It is boring, it works, and it is available to anyone reading this page.
The words people use
The eight terms that appear in every vendor deck, in the order they usually come up.
- Prompt injection
- Text that reaches the model and is treated as an instruction, even when it was meant as content.
- Jailbreak
- A prompt built to talk the model past its own safety rules. The user is the attacker.
- RAG
- Retrieval-augmented generation: the model is given your documents before it answers, and inherits the trust level of what is in them.
- MCP
- Model Context Protocol - a standard way to plug tools into an AI app. Each server is code with the agent's permissions.
- SBOM / AIBOM
- A signed inventory of the software, models, datasets, and prompts you depend on.
- Least privilege
- Only the access a task needs, for only as long as it needs it. Applied to AI, also least agency.
- Human in the loop
- A person approves a specific action before it becomes real. Broad approval is theatre.
- Red teaming
- Attacking your own system on purpose, with permission and a written scope, before someone does it without either.
Sources
- OWASP Top 10 for LLM Applications (2025) - genai.owasp.org/llm-top-10
- OWASP Top 10 for Agentic Applications (2026) - genai.owasp.org
- OWASP GenAI COMPASS Playbook (2025) and GenAI Red Teaming Guide (2025), CC BY-SA 4.0.