Security at AI speed: identity, isolation and recoverability

Define trust around the resource

Zero trust treats access as a resource-specific decision rather than automatic trust in a network location. For an AI platform, separate administration, training data, inference endpoints and model deployment permissions. Give workloads short-lived, narrowly scoped access and maintain an auditable path from change approval to deployment. A private subnet is useful segmentation, but it does not prove that every user, dependency or retrieved document is trustworthy.

Keep authority outside retrieved text

Treat retrieved text and tool output as untrusted data. A model may encounter hostile instructions embedded in documents; authorization must be enforced outside the model. Bound tool parameters, validate outputs and require explicit permissions for consequential actions. Protect dataset and model provenance, signed updates and rollback. Test whether an assistant can expose data across tenants or cause an unauthorized change; a persuasive refusal message alone is not an access-control mechanism.

Practise the incident response

DDoS resilience needs upstream capacity and filtering as well as local controls. A local firewall cannot restore a circuit already saturated before traffic reaches it. Distinguish network floods from expensive application requests; use rate limits, queues, caching and service-specific admission budgets.

Exercise incident escalation, isolated backups and restoration with realistic objectives. Track detection time, containment and recovered service rather than counting blocked packets as a complete security score. These are defensive design principles, not a claim that every threat can be eliminated.