AI security framework
A practical framework for securing agentic AI systems.
The strongest AI security programs combine architecture, policy, and operational controls. Use this framework to evaluate where your agent stack enforces trust — and where it still relies on model behavior.
Principle 01
Enforce ownership at execution
Treat data access as a runtime authorization problem. The executor should verify requester, owner, and scope before any read or write action.
Enforcement pattern
Derive the principal and tenant from authenticated runtime context. After schema validation, load the target record and compare its authoritative owner at the executor — never trust a model-supplied owner field.
Evidence to require
A two-tenant test supplies another tenant's record identifier directly to the tool and proves denial occurs before data or side effects are returned.
Principle 02
Validate every untrusted message
Use schemas, allowlists, and deterministic checks before model-generated content reaches tools, memory, or downstream systems.
Enforcement pattern
Resolve tools through an exact allowlist, parse arguments with a versioned schema, and pass only the parsed representation onward. Apply sink-specific encoding and outbound policy at the final adapter.
Evidence to require
Malformed fields, unknown tools, poisoned retrieved content, and unexpected provider arguments fail closed with stable reasons in the decision log.
Principle 03
Separate planning from action
Keep intent generation, tool selection, and privileged execution in distinct layers with explicit handoffs and policy checks.
Enforcement pattern
The planner emits an untrusted proposal. A side-effect-free policy layer checks scope, schema, ownership, limits, budgets, and approval before an executor with separate credentials can call the tool.
Evidence to require
A deterministic corpus assumes the planner is fully compromised and still observes the exact deny or escalation reason, an audit event, and no forbidden effect.
Principle 04
Design for reversible actions
Where possible, make destructive actions recoverable, rate-limited, and observable so failures do not become incidents.
Enforcement pattern
Classify each tool by consequence and true in-band reversibility. Bind high-value approval to the principal, exact action, approver, expiry, and one-time nonce; record a compensation handle where one exists.
Evidence to require
Exercise the kill switch, replay and payload-change rejection, destructive-call budget, and record-scoped compensation path before production access is granted.
Principle 05
Recommended operating model
- Define ownership boundaries before shipping any multi-agent workflow.
- Require policy enforcement at the executor boundary rather than relying on prompts.
- Log intent, tool calls, data access, and approvals for every significant action.
- Review agent permissions regularly as the system evolves.
Turn principles into durable architecture.
Serenus One helps organizations translate this framework into enforceable controls, governance artifacts, and operating practice.