Template 06 — Security & Compliance Checklist

Copy and fill pre-launch and for enterprise review. Full method: Phase 14, cheatsheet 17.

Security & Compliance Checklist: <system>

Owner: <name> · Date: <date> · Review status: <draft/approved>

Prompt injection (Phase 14.01)

  • Trust boundary enforced: model proposes, app executes (permission-checked).
  • Tools whitelisted; args validated; least-privilege.
  • Untrusted text (RAG docs, tool results, web) isolated; not mixed with secrets/instructions.
  • Output exfil scan (suspicious URLs/markdown); no auto-fetch of untrusted URLs.
  • Human approval gate on irreversible/high-impact actions.
  • Red-team done: direct + indirect + exfil. Report: <link>

Secrets & keys (Phase 14.03)

  • No secrets in prompts/context/tool args/weights/training data.
  • No provider key in client code; backend/gateway proxy.
  • Keys in a vault; scoped; spend-capped + alerting; rotatable (config not code).
  • CI secret scanning (gitleaks); .gitignore for env.
  • (BYOK) customer keys encrypted per-tenant, never logged.

Data & privacy (Phase 14.02)

  • Provider: DPA signed; no-train tier; retention known / ZDR; region/residency.
  • PII scrubbed before logging + before provider (where not needed).
  • Retention TTLs set; automated deletion.
  • Right-to-erasure works end-to-end (DB + logs + vector store + provider + weights plan).
  • No PII in fine-tuning data (or deletion plan documented).

Tenant isolation (Phase 14.04)

  • tenant_id from trusted auth, threaded through DB, vector index, cache, memory, keys, logs.
  • Data-layer enforcement (RLS / per-tenant namespace); default-deny.
  • Cache key includes tenant; no co-mingled fine-tunes (per-tenant adapters).
  • Cross-tenant leak test suite (CI gate).
  • Per-tenant quotas/budgets (noisy-neighbor).

Guardrails (Phase 14.05)

  • Input guardrails: moderation + PII + scope + authz.
  • Output guardrails: moderation + PII/secret + schema + grounding + exfil.
  • Fail closed on high-risk paths (dependency outage → deny + alert).
  • Violation + over-refusal rates measured + tuned to risk.

Audit & observability (Phase 14.06)

  • Audit log: consequential actions, append-only, tamper-evident, access-controlled, PII-safe.
  • Correlation IDs; traces; p95/p99 + cost dashboards.
  • Alerting on anomalies/spend/error spikes; IR plan (template 04).

Compliance (enterprise) (Phase 14.07)

  • Frameworks scoped (SOC 2 / GDPR / HIPAA / EU AI Act) by customers/data.
  • SOC 2 Type II started early; DPA + sub-processor list.
  • SSO/RBAC; deployment model (SaaS/VPC/on-prem) per buyer.
  • Data map (RoPA); DPIA for high-risk; security-questionnaire answer bank.
  • Control→evidence matrix maintained; Trust Center.

Prompting can't fix security — it's architectural. Least privilege, isolation, fail closed, assume breach.