AI Security protects the information, identities, applications, and tools involved in an AI workflow. It addresses risks such as unauthorized access, disclosure, misleading inputs, and unintended actions. Prompt injection occurs when untrusted content attempts to redirect an AI system's behavior.
Map the trust boundaries.
Identify where information enters the application, which identity retrieves it, and where actions are executed. The user interface, model, retrieval system, and tools may operate under different permissions. A boundary is meaningful only when the component handling the operation enforces it.
This makes AI Security a system-design problem. Restricting the final answer is too late if an unauthorized document was already retrieved or an excessive permission allowed a tool to change a record. Enforcement needs to occur before the sensitive operation.
Treat external content as data.
Documents, web pages, and tool responses can contain instructions that conflict with the application's purpose. Indirect prompt injection exploits that confusion by presenting untrusted text in a context the model is asked to interpret. An apparently relevant source should not gain the authority of an approved instruction.
Use appropriate separation of instructions and retrieved content, scoped tools, input validation, and downstream authorization. Filtering can contribute to protection, but no single filter or prompt guarantees that every misleading input will be recognized.
Example: a connected support agent.
An agent may retrieve an authorized case, summarize its history, and propose a response. A malicious attachment might ask it to reveal other customers' records or send information externally. The retrieval layer should restrict records, and the action layer should reject operations beyond the permitted scope.
A refund or account change introduces additional consequences. Require approval at the execution boundary where the approved action, target record, and relevant inputs can be checked. A broad approval for an entire conversation may not provide sufficient control.
Observe and contain unsafe behavior.
Agent 365 can support inventory and oversight for supported integrations, while identity, data protection, and threat-monitoring products provide relevant controls. Confirm actual coverage rather than treating visibility as enforcement. Log necessary decisions and actions, protect sensitive evidence, and provide a tested route to disable a risky connection without depending on the agent to cooperate.
Further reading
For Agent 365 oversight, scoped access, protected sources, and response planning, read AI Security: secure the agent's reach.