AI Control Library / CF-12: Security & Abuse Resistance
Designation: Core | Control types represented: Operational and Technical
Control requirement
Protect prompt, response, retrieval and inference caches with access isolation, integrity checks, appropriate expiry and reliable invalidation. Include every identity and authorization factor needed to prevent cross-context reuse.
Why this matters
Caching can replay sensitive content to the wrong user or preserve revoked information. A cache key based only on prompt text ignores differences in permissions and tenant context.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Apply to application caches, semantic caches, model-serving caches and intermediary services. Assess provider-managed cache behavior where relevant.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The service owner defines safe reuse; platform engineers implement keys and invalidation; data owners set sensitivity limits.
Implementation guidance
- Inventory cached content and approved reuse boundaries.
- Bind cache entries to tenant, authorization context and relevant version.
- Protect cache access and define expiry and revocation behavior.
- Test collision, poisoning, eviction and permission-change scenarios.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Same query from another tenant | Protected cached result is not reused. |
| Source access revoked | Affected entries are invalidated or no longer served. |
| Unauthorized cache write | Integrity controls prevent poisoning. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Cache design
- Access rules
- Invalidation tests
- Sensitive-content decisions
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Disable unsafe reuse, purge affected entries and determine whether stale or unauthorized content was served.
Example in practice
Hypothetical example: Two employees ask the same question about compensation. The cache distinguishes their access context, preventing reuse of a manager-only result for an employee.
Related controls
- CF12-004: AI Knowledge Base & RAG Access Control
- CF12-013: AI Sensitive Information Disclosure Prevention
- CF14-012: Agentic Memory & Context Security
Framework mappings
- CSA AICM (AIS-14)
- NIST AI RMF (MEASURE 2.5)
- MITRE ATLAS
- OWASP LLM Top 10
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Security & Abuse Resistance
Version 1.0