Guides/AI security basics
Security basics for AI PMs
You won't replace AppSec — you translate abuse scenarios into acceptance criteria: what inputs cross trust boundaries, which tools mutate state, where customer data may leak into prompts or logs. Clarity here prevents “prompt firewall” theater without owners.
Threat sketch
Bring this diagram to joint reviews — annotate with your actual connectors (CRM, ticketing, vector DB regions).
Controls & alignment (starter set)
Rows are lenses, not exhaustive CWE lists — expand with your security partner during design review.
| Risk lens | Product-facing controls | Who aligns |
|---|---|---|
| Prompt injection steers tools | Tool allowlists, argument schemas, human gates on writes | Product + AppSec define tiers |
| Sensitive data in prompts / logs | Redaction, retention TTLs, regional residency, customer-managed keys | Legal + Infra + PM acceptance criteria |
| Cross-tenant leakage via retrieval | Row-level security in vector DB; partition keys in retrieval filters | Backend ownership — PM validates tenant stories |
| Untrusted content rendered to users | Output encoding, markdown sanitization, download policies | Frontend + security review on rich render paths |
PM habits
- Document data classification per surface — what may enter prompts vs must stay server-side only.
- Pair every tool with blast-radius tiering — reuse your agent governance lanes where possible.
- Require replay bundles for escalations — redacted prompts + trace IDs + policy outcome.