Security and Governance
Prompt injection, the lethal trifecta and agent security, guardrails, abuse prevention, PII and privacy, compliance, and red-teaming your own system.
- Chapters
- 7
- Hours
- 1
- Difficulty
- Advanced
- 9.0intermediate
Prompt injection
Why prompt injection has no general fix, the difference between direct and indirect attacks, and the defense-in-depth posture you ship with.
- 9.1intermediate
Agent security and the lethal trifecta
The three-leg threat model for agentic exfiltration, why all three together is game-over, and how to cut at least one leg before you ship.
- 9.2intermediate
Guardrails
Input filters, output validators, content moderation models, and the streaming-versus-validation problem nobody warns you about.
- 9.3intermediate
Abuse prevention
Rate limits, spend caps, per-tenant budgets, and the behavioral signals that catch automated abuse before it shows up on the bill.
- 9.4advanced
PII and privacy
Detect and redact before the model call, navigate the controller-processor-subprocessor chain, and pick the right retention and residency knobs.
- 9.5advanced
Compliance and audit
What engineers actually build for SOC 2 and the EU AI Act: structured audit trails, tamper-evident retention, and the model documentation regulators look for.
- 9.6advanced
Red-teaming
Automated probe suites, manual protocols, and continuous red-teaming in CI: how to attack your own AI system before someone else does.