Security

One-Line Framework to Remember

Identity & Access → Data Protection → RAG/Vector Security → Agent Logic → MCP/Tool Sandboxing → Network & Infra → LLM Vulnerabilities → MLOps/Supply Chain → Monitoring & Logging → Governance & Compliance

Easy Interview Summary

“For securing modern AI and cloud workloads, I adopt a defense-in-depth approach across the entire stack. I start with a foundation of least-privilege identity (IAM/ZTA) and strict data protection, including encryption and confidential computing. For the AI components, I apply granular access controls to RAG document retrieval, isolate agent tools using ephemeral sandboxes, and protect against LLM-specific vulnerabilities like prompt injection and financial DoS. Finally, I wrap the entire ecosystem in secure MLOps supply chains, zero-trust network infrastructure, and continuous end-to-end tracing to ensure compliance and rapid threat detection.”

1. Identity, Authentication & Authorization

• Least privilege: Give users, agents, services, and tools only the permissions they require.
• Identity: Use AWS IAM / Microsoft Entra ID / Google Cloud IAM with roles, workload identities, and short-lived credentials.
• Machine Identity: Use frameworks like SPIFFE/SPIRE to issue cryptographic identities to dynamic, short-lived agents and containers.
• Just-in-Time (JIT) access: Grant elevated access to human operators or high-privilege agents only when strictly necessary and for a limited time.
• Agent authentication: Authenticate every agent and agent-to-agent interaction.
• Tool authorization: Authorize access per tool and per operation, not only at the MCP/server level.
• Delegation control: Prevent agents from gaining privileges by delegating actions to another agent or tool.
• API authorization: Secure APIs using OAuth 2.0 / OIDC and integrate enterprise IdPs such as Okta/Auth0 where required.
• Human approval: Require explicit approval for high-impact actions such as production changes, deletion, deployment, or remediation.

2. Data Protection & Privacy

• Encryption at rest: Encrypt databases, object storage, vector databases, logs, backups, and model artifacts.
• Key management: Use AWS KMS / Azure Key Vault / Google Cloud KMS with customer-managed keys where required.
• Encryption in transit: Enforce HTTPS/TLS for APIs, agent communication, databases, and data pipelines.
• Confidential Computing: Use hardware-based Trusted Execution Environments (TEEs) like AWS Nitro Enclaves, Azure Confidential VMs, or GCP Confidential Compute to protect highly sensitive AI prompts, proprietary models, and PII while in use (in memory).
• Data Loss Prevention (DLP): Implement automated DLP at the API edge to intercept and scrub outbound PII/PHI before it reaches external LLM providers.
• PII protection: Detect, mask, tokenize, or redact sensitive information in data, prompts, outputs, and logs.
• Secrets management: Use AWS Secrets Manager / Azure Key Vault / Google Secret Manager; never hard-code credentials.
• Data residency: Control where data is stored and processed to meet regulatory requirements.
• Tenant isolation: Prevent cross-user and cross-tenant access to data, context, memory, documents, and vector indexes.

3. RAG & Vector Database Security

• Document authorization: Apply document-level RBAC/ABAC before retrieval.
• Chunk-level authorization: Extend access controls down to the specific vector chunks to prevent granular data leakage.
• Metadata filtering: Use tenant ID, ACL, classification, ownership, and source metadata during retrieval.
• Source validation: Allow only trusted/approved document sources.
• Data poisoning protection: Validate documents and detect unauthorized or malicious changes before indexing.
• Prompt injection: Treat retrieved documents as untrusted content and prevent instructions within documents from controlling the agent.
• Vector DB security: Secure OpenSearch / Azure AI Search / Vertex AI Vector Search / PostgreSQL pgvector with authentication, encryption, network controls, and fine-grained access.
• Embedding security: Protect embedding models, pipelines, indexes, and generated embeddings.
• Context minimization: Retrieve only the information required for the task.
• Provenance: Track document source, version, retrieval, and citations.
• Deletion/retention: Ensure revoked or deleted documents are removed from indexes and caches.

4. Agent & Multi-Agent Security

• Prompt security: Protect against prompt injection, jailbreaks, malicious instructions, and indirect injection.
• Input validation: Treat user input, agent messages, and retrieved content as untrusted.
• Semantic Routing for Security: Use specialized intent-classification models to route potentially harmful requests away from highly privileged agents to secure fallback workflows.
• Agent boundaries: Define which agents can communicate with or invoke other agents.
• Context isolation: Share only the minimum required context between agents.
• Message validation: Validate agent-to-agent messages and outputs.
• Workflow controls: Enforce approved execution paths and prevent unauthorized workflow branching.
• Loop protection: Detect circular calls, recursive delegation, and runaway workflows.
• Resource limits: Apply rate, token, cost, concurrency, and execution-time limits.
• Shared state security: Protect agent memory, workflow state, and intermediate results from unauthorized modification.
• Failure isolation: Ensure a compromised agent cannot compromise the entire agent ecosystem.
• Output validation: Validate model/agent outputs before using them for sensitive operations.

5. MCP & Tool Security

• MCP authentication: Authenticate MCP clients, agents, and tool servers.
• Tool-level authorization: Expose only approved tools and operations to each agent.
• Parameter validation: Validate all agent-generated tool parameters.
• Tool output validation: Treat tool responses as untrusted before passing them to agents.
• Ephemeral Sandboxing: Isolate MCP servers and execute untrusted agent-generated code inside highly restricted, ephemeral environments like Firecracker microVMs or restricted Docker containers that are destroyed immediately after use.
• Command restrictions: Avoid unrestricted shell/system commands.
• SSRF & Egress protection: Restrict outbound destinations, apply strict egress filtering, and prevent access to internal/cloud metadata endpoints (e.g., 169.254.169.254).
• Tool discovery: Validate and approve newly discovered tools before allowing agents to use them.
• High-risk tools: Require additional authorization/human approval for destructive or production-impacting tools.
• Emergency controls: Provide the ability to disable individual tools or MCP servers quickly.

6. Network & Infrastructure Security

• Network isolation: Use private networking, segmentation, firewalls, and network policies.
• Zero Trust Architecture (ZTA): Assume the network is hostile; continuously verify identity and device posture for every access request, regardless of network location.
• Private connectivity: Use VPC Endpoints / Azure Private Endpoints / Google Private Service Connect when traffic should avoid the public internet.
• Hybrid connectivity: Use VPN / Azure VPN / Cloud VPN for encrypted connectivity over the internet.
• Dedicated connectivity: Use Direct Connect / ExpressRoute / Cloud Interconnect for private connectivity.
• Firewall controls: Use Security Groups / NSGs / Cloud Firewall Rules / NACLs as appropriate.
• Workload isolation: Separate development, testing, and production environments.
• Container security: Use minimal images (e.g., distroless), non-root containers, image scanning/signing, runtime protection, and resource limits.

7. LLM & Model Security

• OWASP Top 10 for LLMs: Continuously align model deployment security with the OWASP Top 10 framework for Large Language Models (addressing injection, insecure plugins, model denial of service, etc.).
• Approved models: Maintain an approved model list and restrict unauthorized model usage.
• Model weight security: Use secure serialization formats like safetensors instead of inherently insecure formats like Python pickle files, which can execute arbitrary malicious code upon loading.
• Model versioning: Pin and audit model versions.
• Adversarial Red Teaming: Regularly subject models and agentic workflows to automated and manual red-teaming to uncover vulnerabilities.
• Model evaluation: Test for hallucination, data leakage, prompt injection, jailbreaks, harmful outputs, and security weaknesses.
• Output controls: Validate and sanitize model-generated content before execution or downstream use.
• Guardrails: Use Bedrock Guardrails / Azure AI Content Safety / Google Cloud safety controls or open-source equivalents like NeMo Guardrails.
• Automated reasoning: Where supported, use policy/rule-based reasoning checks to validate generated actions.
• Model access: Restrict which users, agents, and applications can invoke specific models.

8. MLOps / GenAIOps & Supply-Chain Security

• Secure CI/CD: Protect pipelines deploying models, prompts, agents, RAG indexes, and applications.
• Artifact security: Sign and verify models, containers, packages, and deployment artifacts.
• Dependency security: Scan dependencies and maintain SBOMs (Software Bill of Materials) where appropriate.
• IaC security: Secure CDK / CloudFormation / Terraform with code review, IaC scanning, policy-as-code, and approval gates.
• Version everything: Track versions of models, prompts, datasets, embeddings, chunking strategies, workflows, and vector indexes.
• Environment separation: Maintain isolated dev/test/prod environments.
• PoC security: Use sanitized data and restricted credentials during PoCs; don't directly expose production resources.
• Rollback: Maintain previous versions of models, prompts, workflows, and vector indexes for safe rollback.

9. Monitoring, Logging & Audit

• End-to-end tracing: Monitor the complete chain: User → Application → Agent → LLM → RAG → Vector DB → MCP/Tool → AIOps Platform → Action
• Financial DoS (fDoS) Monitoring: Set strict billing alerts, token limits, and anomalous cost-spike detection to prevent attackers from intentionally exhausting your LLM API budget.
• Data Security Posture Management (DSPM): Use DSPM tools to continuously discover, classify, and monitor unstructured sensitive data flowing into and out of GenAI systems.
• Audit logs: Record user/agent identity, authorization decisions, tool calls, retrieved documents, model versions, and actions.
• Centralized logging: Use CloudWatch/CloudTrail / Azure Monitor/Activity Logs / Google Cloud Logging/Audit Logs.
• Application monitoring: Monitor latency, errors, availability, token usage, cost, and throughput.
• Security monitoring: Detect abnormal retrieval, excessive tool usage, privilege escalation, data exfiltration, and unusual agent behavior.
• Distributed tracing: Use AWS X-Ray / Azure Application Insights / Google Cloud Trace or equivalent.
• SIEM integration: Send security-relevant events to the organization's centralized SIEM.

10. Security Testing, Governance & Compliance

• Regulatory Alignment: Map architecture controls against emerging AI frameworks like the NIST AI Risk Management Framework (RMF) or the EU AI Act.
• Threat modeling: Perform threat modeling for RAG, agents, MCP, APIs, data pipelines, and AIOps actions.
• Security testing: Test for prompt injection, data leakage, privilege escalation, insecure tools, SSRF, and unauthorized access.
• Continuous evaluation: Run security and quality regression tests after model/prompt/workflow changes.
• Drift monitoring: Monitor data drift, retrieval quality, embedding drift, and model behavior changes.
• Compliance: Map regulatory requirements to controls for data residency, retention, encryption, access, audit, and PII.
• Configuration compliance: Use AWS Config / Azure Policy / Google Cloud policy and asset-management capabilities.
• Auditability: Maintain evidence of model, prompt, data, access, and deployment changes.
• Customer handover: Provide threat models, security architecture, IAM design, compliance evidence, and operational runbooks.