AI Control Library / CF-08: Testing & Robustness
Designation: Core | Control types represented: Operational and Technical
Control requirement
Implement and test layered AI guardrails for defined input, output and action boundaries, with explicit failure behavior, monitoring and ownership. Enforce consequential authorization outside model-generated instructions.
Why this matters
Content filters can miss indirect or novel attacks and can block legitimate work. Guardrails need measurable objectives and independent enforcement where the consequence cannot depend on the model choosing to comply.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
AI inputs, generated responses, retrieval and tool workflows requiring behavioral or security constraints.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The system owner defines boundaries; engineering implements controls with security and domain evaluation.
Implementation guidance
- Specify prohibited outcomes and required handling, distinguishing content filtering from data and action authorization.
- Place controls at relevant boundaries, including tool execution, user access and resource use rather than only the chat interface.
- Define response to uncertain detection, unavailable checks and denied actions, with appropriate human escalation.
- Test bypass variations, false positives and component failures, monitoring operation after release.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Attempt a prohibited action | Independent enforcement blocks it at the relevant boundary. |
| Disable a required guardrail in a controlled test | Approved fail-safe or restricted behavior occurs. |
| Test legitimate edge cases | False positives and handling costs remain within accepted conditions. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Guardrail objectives and placement
- Configuration and failure rules
- Bypass and regression tests
- Monitoring and tuning decisions
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate bypass or unavailable required checks to security and the system owner. Restrict the affected path rather than allowing silent unprotected operation.
Example in practice
Hypothetical example: A response filter misses an encoded instruction, but the payment API still requires a separately validated authorization. The action boundary prevents the consequence while the filter is improved.
Related controls
- CF11-002: AI Input Validation & Filtering
- CF11-003: AI Output Validation & Filtering
- CF12-008: AI Tool & Plugin Sandboxing
Framework mappings
- CSA AICM (TVM-11)
- NIST AI RMF (MEASURE 2.5)
- EU AI Act (Art. 9(4))
- ISO 42001 (Cl. 8.2)
- OWASP LLM Top 10
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Version 1.0