Most "AI security best practices" lists fail for the same reason: they are unordered. A team reading ten good recommendations has no idea which one to do first, so it does the easiest one and calls it done. This checklist is sequenced — each phase builds on the previous, and skipping forward leaves the later controls resting on nothing. For the conceptual model behind it, see the LLM security hub; for the access-control and monitoring specifics, our guide to implementing LLM access controls and monitoring goes deeper on phases 2 and 7.

Phase 1 — Know What You Are Running

  • Inventory every model endpoint — providers, self-hosted models, and every application that calls them.
  • Inventory every agent and tool — which agents exist, which tools they can call, and with whose credentials.
  • Map data flows — what data enters prompts, what the retrieval layer can reach, and where outputs go.

You cannot secure what you cannot list. Every later phase produces evidence that points back to this inventory.

Phase 2 — Put a Control Point in the Request Path

  • Route model traffic through one enforcement layer — an LLM firewall or gateway — instead of each application calling providers directly.
  • Authenticate every call — no anonymous path to a model, internal or not.
  • Authorize per user and per role — capabilities as data (for example capability bitmasks), not all-or-nothing API keys.

This is the phase most teams skip, and it is the one that makes the rest enforceable: a control that lives inside one application can be bypassed by the next application.

Phase 3 — Treat Every Input as Hostile

  • Scan prompts for injection patterns — attack-signature detection, classifiers, rate limiting on suspicious sessions (resk-llm implements this as a wrapper).
  • Scan the non-obvious inputs too — retrieved documents, file uploads, tool descriptions, tool results. Everything that reaches the model is input.
  • Accept the limits — input scanning is statistical. It reduces volume; it never justifies removing the phases below.

Phase 4 — Control the Context

  • Keep secrets out of prompts entirely — system prompts are extractable (prompt leaking); anything sensitive in them will eventually be disclosed.
  • Scope retrieval to the asking user — the RAG index must answer with documents that user is allowed to read, or it becomes a data-leak channel.
  • Minimize memory — retention windows and per-user isolation for conversation history.

Phase 5 — Enforce Outputs at Generation Time

  • Filter inside the decoding loop — banned content should be ungeneratable, not detected after the tokens were already streamed (shadow-ban filtering, implemented in resk-logits).
  • Validate outputs before they leave — PII masking, URL and markup sanitation, format checks.
  • Watch the streaming trap — post-generation moderation cannot un-send tokens; enforcement must happen upstream of the client.

Phase 6 — Authorize Actions, Not Just Content

  • Deny tool calls by default — each tool granted explicitly per role, with read and write separated (least privilege for agent tools).
  • Never let the model change its own permissions — auto-approval toggles and permission files must be outside the model's reach.
  • Treat tool output as untrusted input — a tool result re-enters the context and can carry instructions (MCP hardening guide).

Phase 7 — Log, Monitor and Alert

  • Log decisions, not just requests — policy hits, authorization denials, injection-scan verdicts, with user identity.
  • Redact on the way into logs — an unfiltered prompt log is a data-protection liability (data protection for AI).
  • Instrument agent sessions end-to-end — export to your observability stack (ReskPoints covers Datadog, Prometheus, OTel).
  • Alert on the few signals that matter — repeated policy hits by one user, failed authorizations on privileged tools, sudden change in retrieval scope.

Phase 8 — Red-Team and Iterate

  • Attack your own deployment on a schedule — injection campaigns, jailbreaks, tool-escalation chains (red teaming guide).
  • Re-test after every model or prompt change — defenses tuned to one model version do not transfer automatically.
  • Feed findings back into phases 3–6 — each successful bypass is a missing control or a missing grant.

The Compressed Checklist

  1. Inventory models, agents, tools, data flows.
  2. Centralize enforcement; authenticate and authorize per role.
  3. Scan every input, including retrieved and tool content.
  4. Keep secrets out of prompts; scope retrieval per user.
  5. Enforce token-level output filtering; validate before egress.
  6. Deny tool calls by default; keep permission changes out of the model's reach.
  7. Log decisions with identity; redact; alert on the few signals that matter.
  8. Red-team on a cadence and after every change.

Eight phases, in order. Teams that implement 2 and 6 before 3 and 5 get more security per hour of work — authorization beats detection, because detection is probabilistic and permissions are not.

Related Articles: