Phase 14 — Security, Privacy and Governance
The baseline every LLM engineer needs: the new attack surface (prompt injection), the privacy lifecycle (retention, PII, provider data use), the secrets/tenant/isolation controls that contain damage, the deterministic guardrail layer, the audit trail that proves it all, and the compliance that turns controls into closed deals.
Why this phase matters
LLM apps open a new class of vulnerabilities that traditional AppSec doesn't cover — and most teams ship without addressing them. The root cause runs through the whole phase: an LLM mixes instructions and data in one text channel and can't reliably separate them, so untrusted text can become an instruction (01). The governing principles: the model proposes, the app executes (the trust boundary, Phase 10.05); prompting cannot fix a security problem — security lives in architecture (least privilege, isolation, fail-closed gates); assume breach and log everything PII-safely. Security, privacy, and governance are one inseparable discipline: a privacy control (PII scrubbing) is enforced by a guardrail, recorded in an audit log, and proven for compliance. This phase composes with serving (Phases 6/7), gateways (Phase 8), agents (Phase 10), eval (Phase 12), and fine-tuning (Phase 13).
Documents
| # | Document | What you'll be able to do |
|---|---|---|
| 00 | AI Security Overview | Threat-model the data flow; apply the cardinal principles; map to OWASP LLM Top 10 |
| 01 | Prompt Injection | Defend the #1 risk with architecture (trust boundary, isolation), not prompts |
| 02 | Data Retention and Privacy | Follow the data; minimize/scrub PII; provider data-use/ZDR; retention + erasure |
| 03 | Secrets and API Keys | Keep secrets out of the model's reach; vault/scope/cap/rotate; gateway custody; BYOK |
| 04 | Tenant Isolation | Stop cross-tenant leakage across DB, vector index, cache, memory, keys, fine-tunes |
| 05 | Policy and Guardrails | Wrap the model in deterministic, fail-closed input/output guardrails; tune refusal balance |
| 06 | Audit Logs | Build a PII-safe, tamper-evident trail; correlation IDs; incident response |
| 07 | Compliance Readiness | Map GDPR/SOC2/HIPAA/EU AI Act; DPA, residency, AI governance; right-size + evidence |
How to work through it
Read 00 first — it's the threat model (instructions-vs-data confusion) and the cardinal principles (model proposes/app executes; prompting can't fix security; least privilege; fail closed; assume breach) that every other doc applies. 01 is the keystone threat the phase orbits — prompt injection and its architectural containment. 02–04 are the data-protection controls: privacy/retention (where data flows and how long it lives), secrets (keep keys out of the model's reach), and tenant isolation (the #1 multi-tenant leak is a shared vector index). 05–06 are the governance machinery: deterministic guardrails (the safety layer you control) and audit logs (the evidence that proves controls ran). 07 closes the loop: turning all of the above into demonstrable compliance that gates enterprise deals. Every doc opens with a from-zero plain-English primer and ends with a buildable lab.
Phase 14 artifacts
- A data-flow threat model + OWASP LLM Top 10 mapping + control-per-risk table (00).
- A red-team report and an enforced trust boundary (model proposes / app executes) for injection containment (01).
- A privacy data-flow map, PII scrubbing, retention TTLs, and an end-to-end erasure routine (02).
- A secret-exposure audit with vaulted/scoped/capped/rotatable keys and a passing injection-extraction test (03).
- A multi-tenant slice with tenant scoping on DB + vector index + cache and a cross-tenant leak test suite (04).
- A written policy with fail-closed input/output guardrails and measured violation + over-refusal rates (05).
- A PII-safe, tamper-evident audit log with correlation IDs, incident reconstruction, and an IR runbook (06).
- A compliance-readiness assessment: frameworks, control→evidence matrix, data map, residency + AI governance (07).