Product security

Paved roads, guardrails and assurance for GenAI

The paved road, the guardrail, the evidence and the escape hatch — drawn out for each of the three AI surfaces. Cloud neutral.

The three surfaces #

LLM — The model call itself #

LLMPaved roadGuardrailAssurance
PAVED ROAD — REFERENCE ARCHITECTURE Client app API gateway Orchestrator Model gateway Model Ships as a module: managed identity, secrets vault, private network, logging on by default GUARDRAILS — ENFORCED OUTSIDE THE MODEL Request POLICY ENGINE Prompt and content filtering, in and out Sensitive-data detection and redaction Per-tenant rate and token caps Allow Block Exception Named owner and an expiry date ASSURANCE — EVIDENCE PIPELINE Invocation logs Platform metrics Control-plane activity Audit store immutable Query and test scheduled Prompt and response review Red-team and jailbreak evals Data-leakage regression tests findings improve the paved road ESCAPE HATCH — WHEN THE ROAD DOES NOT FIT Road doesn't fit Exception raised Compensating controls Named owner Expiry and revisit Worked example: a model not on the allowlist — isolated project, no customer data, 90-day expiry
LLM: paved road, guardrails, assurance and escape hatch.

The simplest surface, and the one teams get wrong first — not because the architecture is hard, but because the guardrail is usually a system-prompt instruction rather than an enforced control. Notice where the policy engine sits: beside the model, not inside it.

RAG — Retrieval and grounding #

RAGPaved roadGuardrailAssurance
PAVED ROAD — REFERENCE ARCHITECTURE Client app API gateway Orchestrator Retrieval index Model Ships as a module: tenant-scoped index, ingestion with provenance, object store encrypted at rest GUARDRAILS — ENFORCED OUTSIDE THE MODEL Request POLICY ENGINE Tenant ACL enforced at query time Source allowlist by data classification Chunk caps and PII stripped pre-prompt Allow Block Exception Named owner and an expiry date ASSURANCE — EVIDENCE PIPELINE Retrieval logs Ingestion provenance Index change history Audit store immutable Query and test scheduled Citation and grounding checks Index freshness and drift tests Sensitive-data scan of the index findings improve the paved road ESCAPE HATCH — WHEN THE ROAD DOES NOT FIT Road doesn't fit Exception raised Compensating controls Named owner Expiry and revisit Worked example: a shared index across tenants — row-level filter plus quarterly access review
RAG: paved road, guardrails, assurance and escape hatch.

Retrieval is where tenancy breaks. Every platform provisions the vector store; none enforces that one tenant’s embeddings are unreachable from another’s query. The diagram puts that control at query time deliberately — enforcing at ingestion is the common mistake.

Agentic AI — Tool use and action #

Agentic AIPaved roadGuardrailAssurance
PAVED ROAD — REFERENCE ARCHITECTURE User app API gateway Orchestrator Scoped tools Action Ships as a module: agent runtime, scoped identity per agent, durable state, tool schema registry GUARDRAILS — ENFORCED OUTSIDE THE MODEL Request POLICY ENGINE Tool allowlist and schema validation Approval before irreversible actions Spend caps and egress allowlist Allow Block Exception Named owner and an expiry date ASSURANCE — EVIDENCE PIPELINE Execution traces Tool-call arguments Approval decisions Audit store immutable Query and test scheduled Full action replay after the fact Agent behaviour eval harness Audit of human approvals findings improve the paved road ESCAPE HATCH — WHEN THE ROAD DOES NOT FIT Road doesn't fit Exception raised Compensating controls Named owner Expiry and revisit Worked example: an autonomous write to production — dry-run mode, hard spend cap, 30-day expiry
Agentic AI: paved road, guardrails, assurance and escape hatch.

An agent acts, so approval sits before the action rather than after it. The exception path matters most here: an autonomous write to production is a legitimate ask, and the answer is a bounded yes, not a no.

Reading the guardrail diagram #

Three things in that middle diagram are doing the real work.

  • The policy engine sits outside the model boundary. A guardrail inside the reasoning loop is a suggestion. System-prompt instructions, refusal training and “the agent knows not to do that” all fail under a determined prompt.
  • There are three exits, not two. Allow and block alone produce shadow AI. The third exit is what keeps teams inside the system.
  • The exception exit terminates in a person and a date. Not a team, not a committee, and never open-ended — an exception without an expiry is a silent policy change.

Reading the assurance diagram #

The dashed return path is the part most programmes skip. Evidence that only ever lands in an audit folder is compliance theatre; evidence that feeds the paved road is how the road gets better. Three teams hitting the same finding is not three findings — it is a missing module, and the pipeline is telling you which one to build.

What the platform templates give you, and what they don’t #

Both major clouds now ship real infrastructure as code rather than guidance documents. They cover networking, identity, key management and private endpoints well. Three things they do not give you:

  • Query-time tenancy in RAG. The vector store is provisioned. The isolation is not.
  • Blast-radius policy for agents. Policy engines give you the mechanism; the thresholds, the irreversibility classification and the spend caps are yours.
  • Eval and red-team harnesses. Nothing ships a jailbreak regression suite for your prompts.
The test

Point at any control in your GenAI stack and ask one question: can the model talk its way past this? If the answer is yes, it belongs in the paved road as a default, not in the guardrail column as a control. The guardrail column is only for things the platform enforces whether or not the model cooperates.