AI platform security
Securing an enterprise AI platform
Security architecture and threat model for an organisation-wide AI platform where cloud-hosted agents act on on-premises enterprise data.
AI Platform Security Engineer · ISS STOXX · details generalised; specifics stay internal
The problem
AI agents are a new kind of principal. They act on behalf of users, call tools, read enterprise data, and take instructions from content they retrieve. The usual boundaries — who is calling, what they can reach, what leaves the network — have to be redrawn for something that can be talked into things.
The approach
- 01Authored the platform’s AI security architecture and threat model, treating every agent as an untrusted workload with its own identity.
- 02Established trust boundaries between users, agents, APIs, and enterprise data through identity, API, network, data, and execution controls.
- 03Federated identity end to end, so agents and people authenticate as themselves instead of sharing long-lived keys.
- 04Placed API gateway and edge controls on the paths between agents and enterprise data, with semantic guardrails on model inputs and outputs.
- 05Designed sandboxing and egress control so a successful prompt injection has little to reach and nowhere to send it.
Users
people, federated identity
Boundary: IdentityAI agents
cloud-hosted, sandboxed
Boundary: Guardrails · tool governanceAPIs
governed tools
Boundary: Gateway · edge · egressEnterprise data
on-premises
Threat model covered
- Agent identity
- Least privilege
- Tool governance
- Prompt injection
- RAG isolation
- Data exfiltration
- Sandboxing
- Egress control
- Semantic guardrails
The outcome
A production platform used across the organisation, with explicit, enforceable boundaries between users, agents, APIs, and enterprise data — across cloud and on-premises environments.
Stack
GCP Agent Platform · Model Armor · Model Garden · Workload Identity Federation · Workforce Identity Federation · Apigee · Cloud Armor