Trail 05 · 12 lessons
Securing AI systems
For whoever answers for what the agent does with money, data, and customers: prompt injection, least privilege, human approval, and an audit trail.
- 01FundamentalPrompt injection in practiceWhy any text the model reads can become a command, and what to do about it.
- 02SmellInstructions from Untrusted DataText from pages, emails, or documents enters the prompt with the same weight as instructions.
- 03RefactoringQuarantine Untrusted ContentRead outside content with a tool-less model and pass along only structured data.
- 04PatternDual LLMA quarantined model reads untrusted content; another, with tools, only sees the structured result.
- 05PatternInput GuardrailsCheck input before the main model: topic, abuse, injection, and sensitive data.
- 06SmellOverprivileged ToolA read tool has write access, or a run_sql tool accepts any statement.
- 07RefactoringNarrow Tool PermissionsGive each tool only the access it needs for its use case.
- 08SmellUngated Side EffectThe agent sends email, pays, or deletes data with no confirmation at all.
- 09RefactoringAdd Approval Before Side EffectPause the run and show the action to a human before paying, sending, or deleting.
- 10PatternHuman-in-the-LoopPause at defined points for a human to approve, edit, or reject.
- 11PatternAudit LogRecord who asked, what the model saw, what it decided, and what it ran.
- 12Real-world scenarioPersonal finance assistant with approvalRead statements, suggest payments, and schedule Pix transfers only with explicit confirmation.
- Final projectLangGraph LabFinance assistant with approvalAn assistant in the bank app that finds bills, proposes payments and schedules Pix without taking control of the money away from the customer.