AI Control Library / CF-12: Security & Abuse Resistance
Designation: Supplemental | Control types represented: Operational and Technical
Control requirement
Separate production and non-production AI environments through identities, credentials, data, infrastructure and deployment controls. Prevent test activity from acquiring production authority without explicit authorization.
Why this matters
Development tools and experiments are often less restricted than production. Shared credentials or copied data can allow a test mistake to affect live systems or expose real users.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Apply to training, staging, evaluation, demonstration and local development environments, including shared provider accounts and registries.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The platform owner establishes separation; data owners approve test data; release management controls promotion.
Implementation guidance
- Define separate identities, resources and access boundaries.
- Use synthetic or appropriately protected non-production data.
- Control artifact promotion through approved release processes.
- Test cross-environment access and detect production credentials in test systems.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Test identity accesses production | Request is denied. |
| Artifact promoted | Approval and integrity checks are retained. |
| Non-production data review | Sensitive copies are authorized and protected. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Environment design
- Identity boundaries
- Promotion records
- Isolation tests
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Revoke shared credentials, isolate affected test resources and assess production changes or data copies made through the gap.
Example in practice
Hypothetical example: A staging agent uses its own provider project and test tool endpoints. A faulty task cannot submit actions to the production customer system.
Related controls
- CF12-S16: AI Infrastructure OS Hardening
- CF12-S18: AI Infrastructure Segmentation
- CF13-001: AI Training Pipeline Security
Framework mappings
- CSA AICM (I&S-05)
- NIST AI RMF (MAP 1.1)
- ISO 42001 (Cl. 8.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Security & Abuse Resistance
Version 1.0