Custom AI Application Runtime Security Standard
Purpose: Define security controls for internal AI applications, RAG systems, AI APIs and AI-enabled business applications.
Audience: AI product developers, AppSec, DevSecOps, cloud architects, AI platform engineers, red teamers.
Scope
This standard applies to internal AI assistants, enterprise knowledge chatbots, RAG implementations, Azure OpenAI or similar AI APIs, customer-facing AI services, AI-enabled portals and AI applications connected to enterprise repositories or business systems.
Required Security Gates
| Gate | Control ID | Requirement | Evidence |
|---|---|---|---|
| Input Security | AI-CTRL-005, AI-CTRL-021, AI-CTRL-034 | Prompt injection and malicious input testing completed. | Red team results, test cases |
| Retrieval Security | AI-CTRL-018, AI-CTRL-019 | Source permissions and retrieval boundaries validated. | Permission test evidence, retrieval logs |
| Output Security | AI-CTRL-020, AI-CTRL-039 | Sensitive output filtering and response governance enabled. | Output inspection logs |
| API Security | AI-CTRL-015, AI-CTRL-016, AI-CTRL-036 | Authentication, authorization, rate limits and API logging enforced. | API gateway policy evidence |
| Data Protection | AI-CTRL-017, AI-CTRL-013 | Data minimization and classification-aware controls implemented. | Data flow and classification evidence |
| Logging | AI-CTRL-008 | Prompts, responses, retrieved sources, user context and model/API calls logged based on policy. | Audit export, log samples |
| SOC Integration | AI-CTRL-009, AI-CTRL-035 | Alerts integrated with monitoring and response workflows. | SIEM event IDs |
| Production Approval | AI-CTRL-033, AI-CTRL-011 | Security review completed before production. | Approval record |
Runtime Threat Scenarios
- Direct prompt injection.
- Indirect prompt injection through retrieved documents.
- Unauthorized retrieval from internal knowledge sources.
- Sensitive output leakage.
- AI API abuse.
- Weak authorization between AI application and backend data source.
- Untrusted plugin, library or model dependency.
Production Readiness Checklist
- [ ] AI application owner assigned.
- [ ] Data classification completed.
- [ ] RAG source repositories approved.
- [ ] Authentication and authorization reviewed.
- [ ] Prompt injection testing completed.
- [ ] Output leakage testing completed.
- [ ] Logging and retention defined.
- [ ] SOC alerting enabled.
- [ ] Vendor or model processing terms reviewed.
- [ ] Residual risk accepted by owner.