# Security controls for private AI

> Access control, tool privileges, prompt-injection defences, secrets and supply-chain controls for private AI systems, mapped to OWASP.

- Web page: https://www.alesanalytics.com/docs/security-controls-for-private-ai
- Markdown: https://www.alesanalytics.com/docs/security-controls-for-private-ai.md
- Last updated: 2026-11-08
- Publisher: Ales Analytics

Technical page. Zero trust, least privilege and injection defences. Published 2026-11-08. Last reviewed 2026-11-08. Reviewed by Ales Analytics engineering.

## In one paragraph

Security for an AI system is mostly ordinary security applied carefully to new components, plus a few controls specific to models: treating retrieved text and model output as untrusted, limiting what tools can do, and protecting the model gateway as the high-value component it is. The controls are designed to support a client's own security programme and audits, not to certify the system.

## How it works

- **Zero-trust access.** Every request is authenticated and authorised on its own merits (NIST SP 800-207), whether from a person, a service or an agent.
- **Least privilege for tools.** Each tool and service account has the narrowest access that works. Tool servers use their own scoped credentials and never pass through a caller's token.
- **Prompt injection defences.** Steps that read untrusted content get no write tools; tools are allow-listed per step; outputs are validated against a schema before any action; egress is allow-listed; people approve outbound actions.
- **Secrets and keys.** Kept in a vault, injected at runtime, rotated on a schedule; gateway keys scoped per application.
- **Supply chain.** Dependencies pinned with hashes, mirrored internally, scanned, and updated deliberately; model weights verified by checksum.
- **Logging.** Request metadata always; content only where policy allows; logs protected as sensitive data themselves.

![Figure 1. Layered defences against prompt injection.](https://www.alesanalytics.com/diagrams/sa-injection.svg)

## Design choices and trade-offs

| Choice                         | Trade-off                                                                                                          |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------ |
| Content logging off by default | Better privacy; harder debugging, so sampled capture with approval is a common middle ground                       |
| Automatic dependency updates   | Faster security fixes; exposure to compromised releases, as with the March 2026 compromise of two LiteLLM releases |
| Injection classifiers          | Catch some attacks; never all, so structural controls come first                                                   |

## When not to use it

There is no case for skipping these controls, but their depth should match the data. A system over public documents needs less than one over patient records.

## How we evaluate it

Threat modelling against the OWASP Top 10 for LLM Applications and the OWASP agentic list, red-team tests with injected instructions in documents and tool outputs, permission-leakage tests with restricted test users, and egress tests. Controls are mapped to the client's SOC 2, ISO 27001 or HIPAA programme as evidence, with no claim of certification.

## Sources

- [NIST SP 800-207, Zero Trust Architecture](https://csrc.nist.gov/pubs/sp/800/207/final)
- [OWASP Top 10 for LLM Applications](https://genai.owasp.org/llm-top-10/), [OWASP agentic list (TechRepublic)](https://www.techrepublic.com/article/news-owasp-ai-agent-risk-list/)
- [MCP security best practices](https://modelcontextprotocol.io/specification/2026-07-28/basic/security_best_practices)
- [NetSPI: the LiteLLM supply chain compromise](https://www.netspi.com/blog/executive-blog/ai-ml-pentesting/litellm-supply-chain-compromise/)
- Explainer: [Access and identities for AI](https://www.alesanalytics.com/explainers/machine-identities)

## Contact

solutions@alesanalytics.com, or https://www.alesanalytics.com/contact.

- Every page as Markdown: https://www.alesanalytics.com/llms.txt