Security controls for private AI

Zero trust, least privilege and injection defences

Published: 8 November 2026
Last reviewed: 8 November 2026
Re-checked every: 90 days
Reviewed by: Ales Analytics engineering
Used in: Supervised agents, Private AI infrastructure

In one paragraph

Security for an AI system is mostly ordinary security applied carefully to new components, plus a few controls specific to models: treating retrieved text and model output as untrusted, limiting what tools can do, and protecting the model gateway as the high-value component it is. The controls are designed to support a client's own security programme and audits, not to certify the system.

How it works

Zero-trust access. Every request is authenticated and authorised on its own merits (NIST SP 800-207), whether from a person, a service or an agent.
Least privilege for tools. Each tool and service account has the narrowest access that works. Tool servers use their own scoped credentials and never pass through a caller's token.
Prompt injection defences. Steps that read untrusted content get no write tools; tools are allow-listed per step; outputs are validated against a schema before any action; egress is allow-listed; people approve outbound actions.
Secrets and keys. Kept in a vault, injected at runtime, rotated on a schedule; gateway keys scoped per application.
Supply chain. Dependencies pinned with hashes, mirrored internally, scanned, and updated deliberately; model weights verified by checksum.
Logging. Request metadata always; content only where policy allows; logs protected as sensitive data themselves.

Figure 1. Layered defences against prompt injection.

Design choices and trade-offs

Choice	Trade-off
Content logging off by default	Better privacy; harder debugging, so sampled capture with approval is a common middle ground
Automatic dependency updates	Faster security fixes; exposure to compromised releases, as with the March 2026 compromise of two LiteLLM releases
Injection classifiers	Catch some attacks; never all, so structural controls come first

When not to use it

There is no case for skipping these controls, but their depth should match the data. A system over public documents needs less than one over patient records.

How we evaluate it

Threat modelling against the OWASP Top 10 for LLM Applications and the OWASP agentic list, red-team tests with injected instructions in documents and tool outputs, permission-leakage tests with restricted test users, and egress tests. Controls are mapped to the client's SOC 2, ISO 27001 or HIPAA programme as evidence, with no claim of certification.

Sources

Should you have any questions regarding this page, please contact us at solutions@alesanalytics.com.