Checklist · · 29 checks
Security review checklist for an AI feature
What to check before an assistant, RAG app or agent goes in front of real users. Grouped by area, ticked off locally; progress stays in your browser.
Topic
Prompt injection
3 entries.
In the glossary: Prompt injection, what each means and how to say it in a review
Part of Security: all Security entries · the Security lens on the map
Entries
Explainer · · 2 min read
Untrusted text does not get to give orders
Injection defence is layered validation and clear authority, not a better-worded system prompt.
Explainer · · 2 min read
Why retrieved content must stay untrusted
Why retrieved content must stay data, not become authority over the system.