Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Build defense in depth for an AI application by making every trust boundary enforceable outside the model. Start with an inventory of users, data, prompts, retrieval stores, tools, credentials and destinations; then layer authentication, permission-aware retrieval, least-privilege tools, argument validation, output encoding, resource limits, human approvals, monitoring and incident response. Treat user text, documents, web pages, tool responses and model output as untrusted. A system prompt, classifier or grounding technique can reduce risk, but none is an authorization boundary. The goal is that a malicious document, mistaken response or compromised tool cannot by itself obtain unauthorized data or trigger an irreversible action.
What does defense in depth mean for an AI application?
Defense in depth is a design in which several independent controls contain the same failure. If a retrieved document contains an indirect prompt injection, the document should still be unable to cross the user’s data permissions. If the model proposes a dangerous tool call, the tool service should reject it unless the caller, arguments and approval satisfy policy. If output reaches a browser, database or messaging system, that destination must treat it as hostile input.
The model remains useful for interpretation and generation, but it is not a trusted policy engine. Steve Wilson, project lead, and Rock Lambros, co-lead, make the principle explicit in the opening letter to the OWASP Top 10 for LLM Applications 2026: “Stop trying to build a model that cannot be fooled.” Model-level screening still has value; it simply belongs inside a larger system of enforceable controls.
AWS illustrates this approach with separate user-interface, application, model and data interactions in a chatbot architecture. Its five example trust boundaries are illustrative, not a required count: another application can have more or fewer boundaries. Microsoft’s guidance similarly groups protections into capability families such as governance, provenance, identity and runtime containment.
Popular on Amazon
Which assets and trust boundaries should you map first?
Draw the system before selecting guardrails. Mark every place where data, authority or execution capability crosses from one component to another, and write down the consequence if the model follows hostile text.
Inventory identities, data and execution paths
- Identities: end users, administrators, service accounts, model providers and third-party connectors.
- Model inputs: system instructions, user prompts, uploaded files, fine-tuning data, tool responses, web or email content and persistent memory.
- Data stores: source repositories, vector indexes, caches, conversation history, secrets and deletion or backup paths.
- Capabilities: every tool, credential, API, browser session, code runner, messaging channel and network egress destination.
- Versions and provenance: model versions, prompts, retrieval pipelines, dependencies, connectors and training or fine-tuning artifacts.
A printed threat-modeling reference such as Adam Shostack’s Threat Modeling: Designing for Security (Wiley softcover, ISBN 9781118809990, published April 2014) can help structure this exercise. It teaches general security-design methods; pair it with current AI-specific guidance rather than treating the book as an AI control set.
Classify workflows by consequence
Label each workflow as read-only, sensitive, destructive or externally visible. A read-only answer over public data needs less containment than deleting records, changing access rights, sending a customer message or moving money. Record the initiating identity, the data classification and the maximum possible impact at each boundary.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Boundary to draw | Typical hostile input or failure | Control that must remain outside the model |
|---|---|---|
| User or channel to application | Oversized request, impersonation, direct injection | Authentication, authorization, rate and size limits |
| Application to retrieval and memory | Cross-tenant disclosure, poisoned or stale content | Permission checks, provenance, tenant and classification isolation |
| Model to tool service | Wrong tool, excessive arguments or privilege | Caller-bound identity, scope checks and argument validation |
| Application to browser, database or message sink | XSS, injection, data exfiltration or irreversible write | Destination-specific encoding, parameterization and approval |
| Operations and supply chain | Compromised dependency, model or connector | Provenance review, change control, monitoring and rollback |
How do you secure ingress and model context?
Authenticate the caller before accepting a request, limit input size and rate, and inspect files and text arriving from web, email or tools. Keep trusted instructions in a separate channel or data structure from supplied content so that a document cannot masquerade as policy.
- Authenticate and authorize the request. Resolve the user and tenant before retrieval or tool planning. Do not let a model-generated user identifier decide whose data is available.
- Constrain resources. Apply request, token, file-size and concurrency limits before invoking the model. Reject or quarantine malformed uploads and unsupported content types.
- Mark untrusted content. Preserve provenance and source identity for every external item. Treat instructions found in a document, web page, email or tool response as data, not as application policy.
- Threat-model both injection routes. Test direct prompt injection from the caller, indirect injection through retrieval or tool output, and persistent poisoning written into memory or indexes.
- Use classifiers as signals only. A prompt label, filter or screening model can raise an alert or reduce exposure, but it cannot grant permission, enforce a tenant boundary or authorize an action.
Fail closed when a required identity, integrity or policy decision cannot be made. Returning no retrieved content or no tool result is safer than silently continuing with an unknown authorization state.
How do you secure a RAG chatbot before asking it to answer?
Secure retrieval as an access-control system, not merely as a relevance search. The OWASP RAG Security Cheat Sheet separates foundational, next-stage and advanced controls so teams can prioritize according to sensitivity and risk.
Approve and preserve source integrity
Allow only approved repositories and connectors. Record who supplied each document, when it was ingested, its classification and its version. Validate parsing and ingestion, protect integrity baselines and monitor changes. A digest can show that content matches an approved baseline; it does not prove that the approved content is safe or free of malicious instructions.
Also popular on Amazon
Carry permissions through chunking
Attach access-control metadata to each chunk and preserve it through embedding, indexing and updates. At query time, check the end user’s current permissions for every candidate chunk before placing it in context. Do not rely on a collection-level permission check if documents have different owners, classifications or sharing rules.
Separate tenants, classifications and caches
Keep tenant and sensitivity boundaries explicit in indexes, filters and storage. Protect embedding stores, conversation caches and deletion paths; stale cache entries can disclose data after a user’s access changes. Restrict context size and source selection so an attacker cannot flood the model with irrelevant or adversarial material.
Choose an intentional failure mode
If permission metadata is missing, integrity validation fails or the authorization service is unavailable, fail closed and record the event. A grounded answer is not safe merely because it cites a source: the source still needs to be authorized for this user and request.
Microsoft describes permission-aware indexes, document-level security trimming and managed identities as implementation options. The exact configuration depends on the identity system, model platform and data classification; the invariant is that retrieval authorization is evaluated independently of model text.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How do you stop an agent from calling the wrong tool?
Give each agent the smallest useful capability set, bind calls to the initiating identity and validate the actual proposed operation immediately before execution. A prompt that tells an agent to “ask for permission” is not an approval gate; the tool service must enforce the decision.
Use least privilege and caller-bound credentials
Expose only the tools required for the workflow. Prefer short-lived credentials or a caller-bound identity over a broad shared key. Separate read, write and administrative operations, and restrict network egress to destinations the workflow genuinely needs. Isolate browsing, code execution and file conversion from the application’s primary environment.
Validate names, arguments and targets
Check the selected tool, schema, object identifiers, recipients, quantities and destination against policy. Re-authorize immediately before execution because permissions, records and risk can change while the model is planning. Never execute arbitrary code, shell text or database syntax solely because it appears in a model response.
Also popular on Amazon
Add action-specific approval
Require a human or a separately enforced policy gate for consequential writes, outbound messages, permission changes, purchases and destructive actions. Show the exact operation and arguments to the approver, bind the approval to that operation, and expire it if the arguments change.
Recommended Free Tools
Google’s Secure AI Framework states the principle directly: “Ensure user approval for any actions performed by agents/plugins that alter user data or act on the user’s behalf.” Read-only actions can often proceed without an interactive approval, but the authorization and scope checks still apply.
Contain loops and spending
Set limits on tool calls, tokens, wall-clock time, retries, concurrency and external spend. Stop an agent when it exceeds a budget or repeatedly fails validation, and return a reviewable error instead of allowing an unbounded loop.
How should AI output be handled at its destination?
Assume generated output is hostile to whatever consumes it next. Validate structure and policy decisions in application code, then apply the destination’s normal safety mechanism.
- Web pages: use context-appropriate escaping and safe HTML rendering; do not insert model text into executable script or markup contexts without sanitization.
- Databases: use parameterized queries and allowlisted fields rather than concatenating generated SQL.
- APIs and tools: validate schema, ranges, identifiers and authorization before dispatch.
- Outbound communication: inspect recipients, attachments and content for sensitive disclosure and require the workflow’s approval level.
- Structured decisions: treat a model’s “allow,” “deny” or risk score as an input to a separately implemented policy, not as the policy itself.
A content filter can identify suspicious text, but it cannot replace correct escaping, authorization or executable-tool restrictions. Keep the parser and policy evaluator deterministic where the destination requires it.
Which conventional security controls still matter?
AI features inherit ordinary application, identity and supply-chain risks. Apply strong authentication, encryption in transit and at rest, secret management, dependency review and model or connector provenance checks. Protect administrative interfaces and isolate production credentials from development and evaluation environments.
Make usage observable with request, token, tool-call and external-spend budgets. Monitor unusual retrieval volume, repeated policy denials, new egress destinations, permission changes and model or prompt-version changes. Alerts should have an owner and a documented response path.
Also popular on Amazon
Log enough to reconstruct a decision
Record the initiating identity, request and conversation identifiers, model and policy versions, retrieval sources, authorization result, tool name and arguments, approval identifier and execution result. Exclude credentials and unnecessary prompt or response content; redact or hash sensitive fields where full text is not needed. The objective is an auditable chain of decisions without creating a second repository of confidential data.
Assign control ownership
Name owners for architecture, implementation, detection and governance. A security team may own policy, a platform team the tool gateway, data owners the source permissions and operations the incident process. Without ownership, a logged violation can remain unresolved even when the technical signal is present.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsHow should you test defense in depth before release and after changes?
Test each boundary through the channels the application actually exposes, using dummy data and instrumented tools for dangerous operations. Record both whether legitimate tasks succeed and whether attempted violations are contained.
- Direct injection in user prompts, including requests to reveal hidden instructions or bypass policy.
- Indirect injection in retrieved documents, web pages, email and tool responses.
- Unauthorized cross-tenant or cross-classification retrieval, including stale cache and deletion cases.
- Poisoned documents, altered embeddings and misleading provenance.
- Wrong-tool selection, overbroad arguments, forged caller identity and excessive privilege.
- Exfiltration to an unapproved URL, recipient, attachment or connector.
- HTML, script, command and query injection through generated output.
- Token, tool-call, retry and concurrency exhaustion, including loops that never reach approval.
- Timeouts or failures in identity, retrieval, policy and approval services, verifying that the system fails closed.
The illustrative prompts in OWASP guidance are a smoke test, not a representative security benchmark. Repeat the exercises after model, prompt, connector, index, dependency or policy changes, and preserve the results with the relevant version identifiers.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do OWASP and NIST guidance fit this architecture?
Use frameworks to organize risk and ownership, not as proof that an application is secure. The current OWASP LLM Top 10 2026 was published August 3, 2026. Its order is:
- LLM01 Prompt Injection
- LLM02 Sensitive Information Disclosure
- LLM03 Excessive Agency
- LLM04 Supply Chain
- LLM05 Data and Model Poisoning
- LLM06 Unbounded Consumption
- LLM07 Misinformation
- LLM08 Hidden Context Exposure
- LLM09 Vector and Embedding Weaknesses
- LLM10 Improper Output Handling
Do not copy category numbers from older pages without checking the edition: in 2025, Excessive Agency was LLM06; in 2026 it is LLM03. If autonomous workflows extend beyond the model-as-component scope, pair the list with OWASP’s Top 10 for Agentic Applications 2026.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe OWASP 2026 analysis assembled 7,714 public incidents, with 6,639 containing enough detail to classify. Those are inputs to the report’s risk-list analysis, not incident rates, attack-success percentages or a count of breaches at AI applications generally. Practitioner voting supplied three-quarters of the ranking weight and incident data one-quarter.
Also popular on Amazon
NIST’s AI Risk Management Framework 1.0, released January 26, 2023, is voluntary; its Generative AI Profile followed July 26, 2024. NIST says the framework is being revised. Use it to structure governance and risk management, not to claim that adopting a checklist certifies an application.
How do you choose controls proportionately?
Match controls to the sensitivity of the data and the impact of the action. For every proposed safeguard, ask:
- Does it enforce a rule outside the model, or merely influence the model’s answer?
- Is retrieval permission checked for this user and this chunk, including after a permission change?
- Are credentials, tools and network destinations narrower than the workflow requires?
- Is approval tied to the exact action and arguments that will execute?
- Does testing include indirect sources, benign requests and failure of the approval path?
- Can an operator investigate a violation without collecting unnecessary sensitive content?
- What latency, operational burden and cost does the control add, and is that proportionate to the consequence?
A low-risk, read-only assistant may begin with authenticated access, permission-aware retrieval, output encoding, strict budgets and detailed logging. A system that changes records or communicates externally needs isolated tools, caller-bound credentials, action-specific approval and instrumented destructive-action tests before release. The architecture should make it possible to add stronger layers without redesigning the trust model.
What is a practical implementation sequence?
Build in the order that reduces the largest uncontained consequence first:
- Map the system and rank consequences. Inventory assets, identities, data flows, tools, credentials and egress; mark every trust boundary and workflow impact.
- Secure ingress and context. Authenticate callers, constrain requests, separate instructions from data and classify all external content as untrusted.
- Make retrieval permission-aware. Approve sources, preserve provenance and integrity, carry ACL metadata through chunks, isolate tenants and fail closed on uncertainty.
- Contain agents and actions. Apply least privilege, caller-bound credentials, argument validation, network isolation, budgets and action-specific approvals.
- Validate destinations. Encode HTML, parameterize queries, validate structured fields and inspect outbound content for disclosure.
- Operate and respond. Keep conventional security controls, version and provenance records, useful audit logs, monitoring and an incident process.
- Test continuously. Exercise direct and indirect attacks, retrieval abuse, tool misuse, exfiltration, output injection, exhaustion and failed gates before release and after meaningful change.
This sequence does not assume a particular cloud, model vendor or deployment topology. Those choices change implementation details; they should not change the rule that authorization, execution and irreversible effects are enforced by systems outside the model.
Frequently Asked Questions
Can a system prompt stop prompt injection by itself?
No. A system prompt can establish useful behavior, but text from a user, document or tool may still influence the model. Keep authorization, tool scope, retrieval permissions and approvals in independently enforced services, and treat the prompt as one fallible layer.
Should every tenant have a physically separate vector database?
Not necessarily. Permission metadata and document-level security trimming can enforce separation in a shared service when they are applied to every chunk and query. Higher-impact or highly regulated workloads may justify separate indexes or accounts to reduce the consequences of an isolation bug.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →What should an AI application do when its policy service times out?
Fail closed: return no protected retrieval results and execute no consequential tool call. Record the timeout with the request and policy version, alert the owner when appropriate, and let the user retry rather than silently continuing with an unknown decision.
How should persistent agent memory be treated?
Treat memory as an untrusted, changeable data store. Partition it by user and tenant, retain provenance and expiry information, require authorization before writing or replaying entries, and include poisoning and stale-access cases in deletion and recovery tests.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
