AI Control Library / CF-12: Security & Abuse Resistance
Designation: Core | Control types represented: Operational and Technical
Control requirement
Run tools and plugins within constrained execution environments that limit filesystem, network, identity and resource access. Treat tool code, parameters and returned content as potentially untrusted.
Why this matters
A tool may execute validly while accessing secrets or transmitting data outside the intended workflow. Isolation needs to address its actual capabilities and shared host dependencies.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Apply to code execution, document conversion, browser automation, local plugins and remote tools where the organization controls execution boundaries.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The platform owner operates isolation; integration owners approve tools; security assesses escape and exfiltration paths.
Implementation guidance
- Define each tool’s required files, destinations and runtime resources.
- Use restricted identities, isolated storage and network allow rules.
- Avoid unnecessary host mounts, credentials and privileged execution.
- Test escape attempts, forbidden egress and cleanup between tasks.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Host file access attempt | Protected host data remains inaccessible. |
| Unapproved network destination | Egress is denied. |
| Next task starts | Prior task secrets and files are unavailable. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Sandbox profiles
- Tool permissions
- Isolation tests
- Cleanup records
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Disable the tool, isolate its runtime and assess host compromise or data transfer before rebuilding trusted environments.
Example in practice
Hypothetical example: A document conversion tool runs with a temporary directory and no outbound network access. Embedded content cannot read application credentials or contact an external host.
Related controls
- CF12-006: AI Agent Access Restriction
- CF12-S18: AI Infrastructure Segmentation
- CF14-005: MCP & Tool Protocol Security
Framework mappings
- CSA AICM (AIS-13)
- NIST AI RMF (MEASURE 2.5)
- MITRE ATLAS
- OWASP LLM Top 10
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Security & Abuse Resistance
Version 1.0