Back to the AI Control Library
34 controls | 13 core | 21 supplemental
Why this family matters
AI applications need protection at the points where identities, information, tools and infrastructure meet. This family addresses unauthorized access and abuse across the application and its operating environment. It includes familiar security disciplines alongside safeguards for AI-specific interaction paths.
What this family covers
The controls cover least privilege, authentication, RAG access, agent restrictions, APIs, sandboxing, prompt injection, output handling, malware and disclosure prevention. Supplemental controls extend into credential and identity management, privileged access, secrets, network protection, hardening and environment separation.
How the four control types apply
Technical controls restrict identities, data paths, tools and infrastructure. Operational controls govern provisioning, access review, credential management and security response. Governance controls establish applicable external security obligations. Contextual conditions, such as the workflow and trust placed in retrieved material, shape the exposure those safeguards must address.
Where to begin
Map the application's identities and access paths, minimize privileges, and enforce boundaries around data retrieval and tool execution.
Controls in this family
This family contains 34 controls: 13 core and 21 supplemental. Each page provides requirements, implementation steps, verification criteria, evidence, escalation and a worked example. Applicability depends on the system, information and risks involved.
Core controls
- CF12-001: AI Identity & Access Management Policy
- CF12-002: AI System Least Privilege Access Control
- CF12-003: AI System Strong Authentication
- CF12-004: AI Knowledge Base & RAG Access Control
- CF12-005: AI Output Modification Authorization
- CF12-006: AI Agent Access Restriction
- CF12-007: AI API Security
- CF12-008: AI Tool & Plugin Sandboxing
- CF12-009: AI System Cache Security
- CF12-010: Prompt Injection Defense
- CF12-011: AI Output Handling Security
- CF12-012: AI System Malware & Abuse Protection
- CF12-013: AI Sensitive Information Disclosure Prevention
Supplemental controls
- CF12-S01: AI System Password & Credential Policy
- CF12-S02: AI System Identity Inventory
- CF12-S03: AI System Separation of Duties
- CF12-S04: AI System Access Provisioning
- CF12-S05: AI System Access Revocation
- CF12-S06: AI Privileged Access Role Segregation
- CF12-S07: AI Privileged Access Time Limiting
- CF12-S08: Customer Authorization for AI Privileged Access
- CF12-S09: AI Audit Log Infrastructure Protection
- CF12-S10: AI System Unique User Identification
- CF12-S11: AI System Secrets Management
- CF12-S12: AI System Authorization Mechanisms
- CF12-S13: AI Infrastructure Security Policy
- CF12-S14: AI Infrastructure Capacity Planning
- CF12-S15: AI Infrastructure Network Security
- CF12-S16: AI Infrastructure OS Hardening
- CF12-S17: AI Production & Non-Production Environment Separation
- CF12-S18: AI Infrastructure Segmentation
- CF12-S19: AI Infrastructure Migration Security
- CF12-S20: AI Infrastructure Network Documentation
- CF12-S21: AI Infrastructure Network Defense
Applying this family
Begin with accountable identities and enforce least privilege at data and action boundaries. Combine authentication, retrieval authorization, tool isolation and safe output handling with maintained infrastructure controls. Test indirect attack paths, credential revocation and failure behavior across the complete workflow.
Version 1.0