← All posts

Platform & Architecture

227 posts on platform & architecture.

AI Egress Control Implementation: Allowlisting the Destination Does Not Govern the Payload

Teams implement AI egress control with DNS filtering, SNI inspection, forward proxies, Kubernetes NetworkPolicy, and Cilium FQDN rules. Each governs the destination of AI traffic without reading the prompt, and Kubernetes NetworkPolicy cannot express FQDNs at all. This article gives working Cilium and Envoy egress config, explains why each layer stops at the destination, and shows why reading the payload requires sitting on the decrypted HTTP path.

ai-securityarchitecturezero-trustkubernetesinline-enforcementllm-security
Read post →

Prompt Injection Testing: Building a Repeatable Program Instead of a One-Off Red Team

A one-time red team tells you whether an app was vulnerable last month. A testing program tells you whether every deploy still is. This guide walks how to build repeatable prompt injection testing: assemble a corpus across direct and indirect vectors, wire a runner into CI, measure attack success rate against a defined objective, and account for the adaptive-attack ceiling that static corpora miss. It marks why testing measures exposure and enforcement closes it.

ai-securityprompt-injectionllm-securitydevsecopsarchitecture
Read post →

LlamaIndex Security Patterns: Trust Boundaries in a RAG Pipeline

A LlamaIndex application ingests documents, retrieves chunks, and synthesizes an answer, and each stage is a trust boundary. This article walks the security patterns that matter: enforce per-user document access at retrieval, treat ingested content as untrusted, scope query-engine tools, and govern the model call and its response. It marks which controls live in your ingestion code and which need an enforcement layer on the HTTP path to the model.

ai-securityllm-securityarchitectureidentity-and-authorizationzero-trust
Read post →

LLM Output Validation Patterns: Four Layers Before You Trust a Model Response

Model output gets treated as trusted input to the next step, which is how a hallucinated field, an injected instruction, or a leaked value becomes an action. This article lays out four layers of LLM output validation: structural schema checks, content and safety filtering, grounding and semantic checks, and action gating on tool calls. It shows where each layer catches what, and why the action-gating layer belongs on an enforcement point outside the application.

ai-securityllm-securityarchitecturepolicy-enforcementinline-enforcement
Read post →

LLM Security Testing: The Four Categories and What Each One Measures

LLM security testing spans four categories that measure different failures: prompt injection resistance, jailbreak resistance, data exfiltration exposure, and output safety. This article defines each category, the objective it tests, and the metric it reports, then wires them into a repeatable program with a CI gate. It marks the point every testing effort has to state: testing quantifies exposure, and an enforcement layer is what closes it at runtime.

ai-securityllm-securityprompt-injectiondevsecopsarchitecture
Read post →

MCP Security Checklist: A Deployment Audit Instrument With Pass Criteria

A checklist you can run against a Model Context Protocol deployment, grouped into transport, authentication, authorization, egress, audit, and supply chain, with an explicit pass criterion for each item. It is written as an audit instrument rather than an essay, and it marks which items a network control can verify on the HTTP transport and which belong to host hardening for stdio servers.

ai-securityagentic-aillm-securityidentity-and-authorizationarchitecture
Read post →

Azure OpenAI Gateway Patterns: Where the Governed Proxy Sits and What It Reads

Teams front Azure OpenAI with a gateway for four different jobs: token-based rate limiting, cost attribution, load balancing across regional deployments, and content policy on prompts. This article walks the three deployment patterns engineers actually run on Azure API Management, shows working GenAI policy config, and marks the line between what Azure APIM enforces at the request envelope and what governing the prompt payload requires.

ai-securityarchitecturezero-trustllm-securityinline-enforcementidentity-and-authorization
Read post →

EPSS and KEV Patch Prioritization for the AI Stack: A Working Guide

CVSS severity alone tells you a vulnerability is bad, not whether it is being exploited. This guide shows how to combine the FIRST EPSS exploitation probability score with the CISA Known Exploited Vulnerabilities catalog to rank patch work across your AI inference stack, with a scoring rule, a worked example on real 2026 AI-tool CVEs, and an honest line on what patch prioritization does and does not cover.

ai-securitycybersecurityllm-securityarchitecturedevsecops
Read post →

MCP Gateway Setup: Putting a Governed Proxy in Front of Model Context Protocol Traffic

An MCP gateway sits between agents and the MCP servers they call, centralizing authentication, per-tool-call authorization, egress control, and audit. This guide walks the setup on the streamable HTTP transport: terminate the connection, validate the OAuth token audience, authorize each tools/call against role and arguments, propagate identity to downstream servers, and log every decision. It marks where a local stdio server leaves the reach of a network gateway.

ai-securityagentic-aillm-securityidentity-and-authorizationarchitecture
Read post →

LangChain Security Patterns: Governing Tools, Egress, and Output in a Chain

LangChain hands the model tools, memory, and retrieved context, and each one is a trust boundary the framework does not police for you. This article walks the security patterns that matter in a LangChain app: constrain what tools can do, propagate caller identity through the chain, validate output before it drives an action, and constrain egress. It marks which patterns live in your code and which need an enforcement layer on the HTTP path.

ai-securityagentic-aillm-securityarchitectureidentity-and-authorization
Read post →

MCP Security vs API Security: What Changes When Tools Are Discovered at Runtime

MCP looks like an API, so teams reach for their API security playbook and inherit its blind spots. This article walks four places where MCP security departs from classic API security: tools are discovered at runtime rather than fixed at design time, tool descriptions are an input the model trusts, the caller is often a non-human identity, and authorization is per tool call rather than per endpoint. It shows which API controls carry over and which do not.

ai-securityagentic-aillm-securityidentity-and-authorizationarchitecture
Read post →

RAG Security Architecture: The Four Trust Boundaries in a Retrieval Pipeline

A RAG request crosses four trust boundaries before the answer comes back: what gets indexed, who can retrieve which chunks, what the assembled prompt carries into the model, and what the response returns. This article lays out the reference architecture for each boundary, marks which two are data-plane controls and which two sit on the HTTP path to the model, and shows where identity-bound policy and a per-decision audit record belong.

ai-securityarchitectureragllm-securityinline-enforcementidentity-and-authorization
Read post →