What are the main trust boundaries?
Practice this question- Browser to API, documents to parser, model to tool executor, tool to business service, cross-tenant retrieval/memory/cache, and application to provider/telemetry.
- At each boundary I validate, minimize, authorize, and record permitted outcomes.
Adapted from 13_AI.MD · “29.13 AI security”. Code examples are study fragments. Difficulty and core labels are editorial estimates; version-specific behavior should be checked against your project.