AI Engineering
Learn LLMs, RAG, agents, secure tools, and production AI through practical insurance examples.
Prompt injection, indirect injection, and jailbreaking
Prompt injection is an attempt to make a model follow an attacker's instructions instead of the intended task. Indirect injection places those instructions in external content, such as a PDF, webpage, email, or tool result. Jailbreaking generally attempts to…
Tool poisoning and excessive agency
Tool poisoning uses malicious tool definitions or descriptions to influence model behavior. Excessive agency gives the AI more permissions or autonomy than its task needs. A harmless-looking tool name can conceal a sensitive operation or destination.
Data leakage, PII, sensitive data, and secrets
Data leakage is unauthorized disclosure. PII means personally identifiable information, such as identity-linked names, contact details, and account identifiers. Sensitive business or health information and credentials need protection even when they do not fit…
Authentication, authorization, least privilege, and tenant isolation
Authentication verifies identity. Authorization decides allowed objects and actions. Least privilege grants only required capabilities; tenant isolation keeps one organization's data and operations separated from others.
Validation, rate limiting, and secure database access
Input validation checks permitted shapes and values; output validation checks generated data before use. Rate limiting constrains requests or resources by user, tenant, and operation. Secure tool services mediate database/API access through known business…
What is prompt injection?
It is an attempt to redirect the model through attacker-controlled instructions. When those instructions appear in a PDF, webpage, email, or tool result, it is indirect injection. I treat these sources as data and limit model authority.
Why avoid direct database access?
A generated query can read too much, mutate data, or consume excessive resources. I expose narrow schema-defined business tools with authorization, parameterized queries, field projection, and limits instead of broad database credentials.
What are the main trust boundaries?
Browser to API, documents to parser, model to tool executor, tool to business service, cross-tenant retrieval/memory/cache, and application to provider/telemetry. At each boundary I validate, minimize, authorize, and record permitted outcomes.
An invoice tells the agent to email private records. What blocks it?
The invoice is untrusted content. The agent lacks unrestricted read/send tools, the tool service checks object access and recipients, and sending requires the configured approval. A better prompt helps but does not serve as the primary barrier.
Difficulty is an editorial estimate. Completion means you chose to mark a question as understood.