Respect access boundaries
Limit what AI can read and change based on user and project permissions. Test that instructions embedded in external documents cannot expand those permissions.
SECURITY & TRUST
Clear boundaries. For AI you work with.
PM on Rails is developing and testing controls for AI-specific risks with reference to CSA AICM / AI-CAIQ and the AI Guidelines for Business, Version 1.2.
Controls and self-assessment in progress
Controls we are building and testing
We set boundaries for access, decisions, and execution when AI reads information or takes action. These are priority areas for implementation and regression testing.
Keep people in important decisions
Define which changes and external actions AI may perform and which require human review. Develop safeguards against unintended execution.
Bound execution
Limit processing time and repeated actions so AI operations cannot continue indefinitely. Include stopping at those limits in testing.
Test, learn, and improve
Test malicious instructions, unauthorized access, and unexpected execution. Check that fixes prevent recurrence and revise controls based on the findings.
The frameworks we reference
We use published controls and guidelines to help identify risks specific to AI.
CSA AICM / AI-CAIQ
We use AICM controls to organize safeguards and AI-CAIQ questions for self-assessment. We are checking applicability and supporting evidence, including least privilege (IAM-05) and agent security boundaries (AIS-11).
Read the official CSA guidanceAI Guidelines for Business, Version 1.2
We reference security by design, considering confidentiality, integrity, and availability in design and ongoing operational improvements.
Read the official METI guidance (PDF)Assessment scope and shared responsibilities
- Our responsibilities
- Develop and test service-side access boundaries and execution controls, and explain the assessment scope and verified safeguards. Contact us about the checks you need before adoption.
- Your responsibilities and external services
- Manage member permissions, information you provide, and access granted to integrations. Review AI output and important actions. External AI and integration services are also subject to their providers’ terms and data handling conditions.
Make security part of the conversation.
Talk to us about your security requirements, assessment scope, or questionnaires. We will explain what we can verify and what needs further testing.