Skip to main content

LLM application security

For product features that themselves use LLMs (not the tools that build them). Mapped one-to-one to the OWASP LLM Top 10 so coverage is checkable at the gate.

The controls​

  • Prompt-injection defences — untrusted input can't hijack the model's instructions; system/user separation enforced.
  • Output validation — LLM output is validated before it's executed, displayed, or used in a decision — never trusted raw.
  • Tool-permission scoping — an LLM feature's tools are least-privilege; it can't reach beyond its task (guardrails).
  • Retrieval-poisoning checks — RAG sources are trusted and integrity-checked.
  • Jailbreak cases in the test pack — adversarial prompts are part of the automated test suite, not a one-off.

Why separate from the build guardrails​

The agent guardrail standard governs the agents that build our software. This standard governs LLMs inside shipped products — e.g. a claims assistant. Different threat surface, same rigour: mapped to the OWASP LLM Top 10 so the security gates can verify each control.

Standards referenced: OWASP LLM Top 10.