AI Control Library / CF-12: Security & Abuse Resistance
Designation: Supplemental | Control types represented: Operational and Technical
Control requirement
Manage AI-related secrets through controlled storage, issuance, use, rotation and revocation. Keep credentials out of source code, prompts, retrieval content and ordinary logs.
Why this matters
Anything supplied to model context can be reproduced or sent to tools. A secret vault helps only when execution paths avoid copying secrets into exposed material.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Apply to provider keys, signing keys, service tokens, database credentials and integration secrets across development and production.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The secrets-management owner operates protected services; application owners integrate them; security handles exposure.
Implementation guidance
- Inventory secrets, owners, consumers and replacement dependencies.
- Use managed identity or retrieve secrets only at authorized execution points.
- Restrict access, prevent logging and scan code and artifacts for exposure.
- Test rotation, revocation and recovery without reusing compromised material.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Secret appears in repository | Detection triggers revocation and cleanup. |
| Model context inspection | Credentials are absent. |
| Key rotated | Authorized services continue and old key fails. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Secret inventory
- Vault permissions
- Exposure findings
- Rotation tests
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Revoke exposed secrets immediately according to impact, investigate use and remove copies from affected systems and artifacts.
Example in practice
Hypothetical example: An agent requests a payment operation using a reference. The payment service retrieves its credential internally, so the model never sees the secret.
Related controls
- CF12-S01: AI System Password & Credential Policy
- CF12-013: AI Sensitive Information Disclosure Prevention
- CF12-S05: AI System Access Revocation
Framework mappings
- CSA AICM (IAM-15)
- NIST AI RMF (MAP 1.1)
- ISO 42001 (Cl. 8.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Security & Abuse Resistance
Version 1.0