Design AI identity, access, and data-flow controls and collect evidence that they work. Practice least privilege, retention, denied-access checks, and review of
Last reviewed: 2026-10-03
Enterprise AI security maps identities, resources, data flows, and trust boundaries across model services and business systems. NIST's zero trust architecture describes authorization centered on users, assets, and resources rather than implicit trust from network location. Apply those principles to service identities and agent tool access.
Secure AI architectures need evidence that controls behave as intended. For data-security work, document classification, permitted recipients, retention, secrets handling, and denied-access behavior. The phrase data security compliance does not identify a particular law or contract; determine those requirements separately with the responsible reviewers.
Inventory model services, service identities, tools, and data flows. Use that evidence to identify trust boundaries, control owners, and gaps in the intended access policy.
Define approved services and permitted data uses, make those rules understandable, and verify that access controls and monitoring support them. Review exceptions through the organization's established process.