LLM deployment security checklist
Run this before an AI feature touches production data or external users.
Updated
Authority
- Tool calls execute with the requesting user's permissions, not a broader service credential.
- Irreversible actions require explicit human confirmation.
- Agent step count and budget are bounded.
- Provider credentials live server-side only.
- Each agent has its own identity with short-lived, scoped credentials rather than a shared service principal.
Data
- Retrieval is filtered per tenant and clearance at query time.
- PII is minimised or redacted before inference.
- Retention of prompts and completions is bounded and documented.
- Provider contract prohibits training on your data.
- Vector store and embedding access controls reviewed for cross-tenant leakage (OWASP LLM08: Vector and Embedding Weaknesses).
Output and input
- Model output is encoded for each rendering context.
- Model-authored URLs and images are blocked or proxied.
- Input is length-limited and normalised, including multimodal inputs (images, audio, uploaded files) where the feature accepts them.
- Retrieved content and tool responses are labelled as data, not instructions, before being fed back to the model.
- System prompt is treated as sensitive and tested for extraction (OWASP LLM07: System Prompt Leakage).
Operations
- Rate limits and per-tenant quotas are enforced against unbounded-consumption abuse.
- Audit log records prompt, sources and tool calls.
- Provider outage behaviour is defined.
- A rollback path exists for prompt and model changes.
- Inter-agent messages, if any, are authenticated and logged rather than trusted implicitly.
Related
LLM security controls
A control checklist for enterprise GenAI: data handling, retrieval isolation, agent authority, cascading-failure containment, monitoring, cost limits and vendor terms.
AI security assessment
Security assessment of GenAI and LLM systems: prompt injection, tool and agent abuse, data leakage, model supply chain and monitoring gaps.
Prompt injection defence
Why prompt injection cannot be filtered away, why it has no full fix yet, and how to design AI systems — architecturally, not just with better prompts — so a successful injection has no useful consequence.
AI security
How to secure GenAI, LLM and agentic AI systems: current OWASP threat classes, layered controls, agent authority, retrieval isolation and monitoring.
STRIDE for AI systems
Applying STRIDE to LLM and agentic applications: what each category means when untrusted text can act as instructions, where STRIDE stops covering multi-agent failure modes, and the controls per element.
Three layers, three risk profiles
A security review that skips naming its layer — model, service, or agent — ends up testing the wrong attack surface.