AI security & guardrails for the product leader
Jailbreak, injection, extraction, and poisoning are four different attacks, not one. A defense you have not attacked is a guess. And governance only counts once it becomes compliance evidence a regulator or an enterprise buyer can check.
AI security is four attacks, not one. A guardrail covers one shape, an untested defence is a guess, and governance counts only as evidence.
An LLM mixes trusted instructions and untrusted data in one channel. It often serves many customers from shared infrastructure. That combination creates attacks that ordinary software does not face. Defending against them takes more than a filter. It takes an architecture, a way to test it, and a paper trail that proves it works.
A note on scope. This topic is already covered in depth elsewhere in the curriculum. Safety engineering and Multi-tenant isolation develop prompt injection, the lethal trifecta, data leakage and cross-tenant isolation. Safety, security & governance for agents develops least privilege, sandboxing, human approval, audit trails and governance. This module does not repeat them. It answers three questions those lessons do not lead with.
- Which four attacks must guardrails cover? Jailbreak, injection, extraction and poisoning are four different attacks, not one.
- How do you test the defenses, and measure the result?
- How does the work become compliance evidence that a regulator or an enterprise buyer can check?
Where the depth lives
Each lesson here summarizes an idea and points to the lesson that covers it in full.
| If you want the full depth on | Read |
|---|---|
| Prompt injection, the lethal trifecta, permission boundaries | Safety engineering |
| Keeping one tenant's data away from another's | Multi-tenant isolation |
| Least privilege, sandboxing, human approval, agent governance | Safety, security & governance for agents |
| Limits, approval gates and the kill switch for a running agent | Running an agent in production |
| Who may do what: roles, attributes, tokens and policy engines | Access control |
| The general eval practice that red-team suites build on | Evaluation and observability |
| The general privacy discipline | Security & privacy sense |
The knowledge graph
Lesson 1 · The threat model — four distinct attack shapes
Jailbreak
Social-engineer the model out of its own refusals
Injection
Hide commands in data the model reads
Extraction
Pull training data, prompts, weights back out
Poisoning
Corrupt what the model learns in the first place
Guardrails · layered, fail-closed Defense
Each attack has its own countermeasure. When any layer is uncertain, block by default.
Red-teaming Lesson 2
Attack your own system, measure the attack success rate, keep every finding.
Governance & compliance Lesson 3
SOC 2 · GDPR · EU AI Act · model cards: evidence someone outside can check.
The outcome Payoff
Enterprise procurement clears. Regulatory exposure is bounded.
Read it as one argument in three parts. The threat model: "guardrails" is a layered defense against four attacks. Each has its own countermeasure and fails in its own way. Red-teaming: a guardrail you have not attacked is a guess, so measure it and keep every finding. Governance and compliance: internal control pays off at the moments that matter, such as a security review or a regulator's request, only if it produces evidence that an outsider can check.
The lessons
- The threat model, and guardrails as architecture — jailbreak, injection, extraction and poisoning, how they map to OWASP and NIST, and why guardrails must fail closed.
- Red-teaming: testing your defenses — who attacks, what to measure, and how to turn findings into a release gate.
- Governance, audit & compliance — SOC 2, GDPR's automated-decision rules, the EU AI Act timeline after the 2026 Digital Omnibus, and the evidence register.
Each lesson has a 🎯 For the product leader briefing, a labeled worked example, an "Under the hood" section for engineers, and a Sources list. Rules and dates in this area change fast, so every lesson carries a review date.
📌 Close out the module: Recap & real-world examples, which ends with a self-test.