The Fix · Ten Simple Habits
HOW TO FIX IT
Here's the reassuring part: every problem in this guide already has a fix. These are the 10 habits that keep AI safe - simple, proven, and ready to use today.
Drawn from the GenAI Security Project. No sacred texts - just engineering. And it works.
Least Privilege & Least Agency
Grant the model - and the agent - the minimum functionality, permissions, and autonomy its task requires. A tool that only needs to read should not be able to write, send, or delete. Avoid autonomy where it adds no value; every unnecessary capability is attack surface.
Human-in-the-Loop for High-Impact Actions
Require a human to approve anything irreversible: deleting data, transferring money, publishing, escalating privilege. Autonomy stops at the threshold of real-world consequence. The human is not a burden - they are the firewall.
Treat the Model as an Untrusted User
Its output can be steered by prompts, so its words are indirect user input. Validate, sanitize, and context-encode everything before it touches a database, a shell, a browser, or another system. Zero trust, always.
Guardrails Live Outside the Model
Never delegate security to a system prompt. Privilege checks, authorization, and content policy must run in deterministic, auditable code - independent systems that inspect, allow, or block regardless of what the model was convinced to say.
Secure the Supply Chain
Sign and attest models, tools, prompts, and plugins. Maintain an SBOM/AIBOM, pin versions by hash, scan for typosquats, and keep a kill switch to revoke any compromised component instantly. Trust nothing you did not verify.
Isolate & Sandbox
Run models and agents in contained environments with strict network and syscall limits, never as root. Segment agents and vector stores so a single failure - or a single compromise - cannot propagate.
Data Hygiene & Privacy
Sanitize and scrub before training, tokenize and redact at inference, and prefer federated learning and differential privacy. Separate memory and context per tenant. What the model never sees, it cannot leak.
Observe Everything
Immutable, tamper-evident logs of every prompt, tool call, and decision. Establish behavioral baselines and alert on drift, unusual tool-chaining, and cascading fan-out. You cannot defend what you cannot see.
Red-Team Relentlessly
Attack your own system before someone else does. Treat the model as hostile, simulate goal hijack, memory poisoning, and cascading failures, and verify that rollback actually works. Assumed safety is the enemy.
Govern Consumption
Rate-limit, quota, and budget every API and agent. Set timeouts, throttle resource-heavy work, and design graceful degradation. An unbound model is not power - it is a denial-of-service on your own treasury.
Stay in Control
AI is a mirror. It reflects the care - or the carelessness - of the people who built it.
Every risk in these guides shares one cause: we moved fast and trusted by default. The fix isn't fear, and it isn't giving up - it's paying attention.
Secure the model. Limit the agent. Keep a human in the loop. Do that, and the scary story never comes true.