Home / AI Security Documentation Defensive Architectures
This section provides practical defensive controls organised by threat vector, with mappings to NIST AI RMF, NIST AI 600-1, EU AI Act, ISO 42001, OWASP LLM Top 10, and MITRE ATLAS.
In This Section
Defence
Threat Coverage
Primary Standards
Input Guardrails Prompt injection, jailbreaks, adversarial prompts
LLM01, LLM04, §2.8, §2.9
Output Filtering PII leakage, insecure output, hallucination
LLM02, LLM06, §2.2, §2.4
RAG Security Retrieval injection, vector store poisoning, access control
LLM01, LLM05, §2.12
Runtime Monitoring Drift, anomaly, adversarial detection, model DoS
LLM04, §2.5, §2.9
Secure Deployment TEEs, confidential computing, model signing, supply chain
LLM05, LLM10, §2.10, §2.12
Defence in Depth Layered control strategy aligning NIST RMF functions to technical controls
All
Control Selection Guidance
Map threats — Use Threat Taxonomy to identify relevant attack vectors for your architectureSelect controls — Each defence page lists controls by layer (Input, Architecture, Runtime, Monitoring, Governance)Trace to standards — Control tables include mappings to NIST, EU AI Act, ISO 42001, OWASP, MITREImplement incrementally — Start with Input and Runtime layers; they address the highest-likelihood threatsMeasure effectiveness — Define metrics per control (e.g., injection detection rate, false positive rate, latency overhead)
Cross-Cutting Principles
Principle
Description
Least privilege Every model, agent, and tool runs with minimum necessary capabilities
Defence in depth No single control is sufficient; layer input, architecture, runtime, and monitoring
Fail secure Default-deny on tool calls, output rendering, and delegation
Observability by design Log every model invocation, tool call, and delegation with correlation IDK/error with correlation IDs
Provenance Sign models, datasets, adapters; verify at load time and admission time
Human-in-the-loop Require confirmation for irreversible actions (delete, pay, email, admin)