AI Security
Zero Trust for LLM Applications: Beyond the Prompt Firewall
Prompt injection is real, but it is not the threat model that will hurt you most. Here is what a defensible LLM application architecture actually looks like.
By Hani Braish9 min read
Every vendor wants to sell you a prompt firewall. Very few want to talk about identity, data lineage, or blast radius.
The real threat model
The biggest risk in most LLM apps is not jailbreaks — it is over-permissioned tool use. A model with read access to a customer database and write access to email is a confused deputy waiting to happen.
Four invariants worth enforcing
- Identity propagation. Every tool call carries the calling user's identity, not the service account's.
- Least-privilege tools. Tools should expose verbs scoped to a single resource, never raw SQL.
- Output validation. Treat model output as untrusted user input on the way to any downstream system.
- Audit by default. Every prompt, tool call, and tool result is logged with the originating user identity.
What to skip
You do not need a dedicated "AI firewall" SKU. You need the same controls you already owe your non-AI services, applied with intent.
AI SecurityZero TrustLLM