LLM security controls for enterprise deployments

• Documented legal basis and processor terms for every inference provider.
• PII minimisation or redaction before the request leaves your boundary.
• No training on your data unless explicitly contracted.
• Prompt and response retention bounded and documented.
• Data residency confirmed for the actual inference region, not just the provider's default marketing region.

• Inference calls proxied through a gateway you control; provider keys never in the client.
• Retrieval scoped per tenant and per user clearance at query time.
• Tool authority delegated from the user; write actions confirmed.
• Model output treated as untrusted input everywhere downstream.
• Runtime prompt and response screening (provider-native or third-party guardrail service) sits in front of the model, not instead of the controls above — it catches known patterns, it does not replace least-authority design.

• Rate limits and per-tenant token budgets with alerting on anomalies.
• Audit log of prompts, retrieved source IDs, tool calls and outcomes.
• Fallback behaviour defined for provider outage or refusal.
• Model or version changes go through change control with regression tests.
• Red-teaming coverage tracked against a recognised adversarial technique catalogue (MITRE ATLAS) rather than an internal, ad hoc list of things someone thought to try.

Once the system plans, chains tools or coordinates multiple agents

• Each agent's objective is fixed and re-validated before every consequential action; a plan that drifts from the stated goal is a signal, not background noise.
• Agent-to-agent messages are authenticated and schema-validated — an agent should not accept instructions from a peer it cannot verify.
• A single agent failure or timeout cannot cascade: circuit breakers and step budgets stop a chain rather than letting it retry indefinitely or fan out into more agents.
• Any agent capable of code execution or file writes runs in an isolated, disposable environment with no path to production credentials.
• There is a kill switch that revokes an agent's tokens and tool access without needing to redeploy anything.