AI Security Wiki
GitHub

Home / Role-Based Playbooks / AI Product Developer Playbook

AI Product Developer Playbook

Purpose: Provide role-specific guidance focused on secure AI design, RAG security, prompt injection prevention, output filtering, data access boundaries and production readiness.

Audience: AI product developers, solution architects, AI application owners

Key Responsibilities

  • Understand applicable AI risks.
  • Identify relevant controls from the AI Security Control Objectives Library.
  • Produce evidence suitable for security review and audit.
  • Escalate gaps, exceptions and residual risks to the assigned owner.
  • Keep documentation updated when AI platforms, integrations or vendor capabilities change.

Standard Workflow

  1. Identify the AI use case or vendor capability.
  2. Map the use case to applicable AI risks.
  3. Select required control objectives.
  4. Execute relevant PoC or validation tests.
  5. Capture evidence.
  6. Record gaps and residual risks.
  7. Submit for security, governance or audit review as applicable.

Required Artifacts

  • AI risk review template.
  • Control mapping.
  • Evidence checklist.
  • Test results.
  • Exception log if needed.
  • Final approval or recommendation record.