Secure the AI supply chain and cloud runtime

The artifact is executable risk

Models, adapters, tokenizers, datasets, notebooks, packages, containers, prompt templates, and evaluation suites all influence production behavior. Track source, license, checksum, scanner results, owner, approval, and lineage.

Serialized model formats can execute code when loaded. Prefer safer formats where supported, use trusted publishers and signed revisions, scan artifacts, isolate conversion, and never load an untrusted pickle into a privileged environment.

Harden the workspace and endpoint

Use private networking where required, managed identity instead of long-lived keys, least-privilege roles, encrypted storage, controlled egress, patched images, and isolated compute. Disable public notebooks and default administrator access.

Protect inference with authentication, authorization, quotas, schema validation, abuse monitoring, content controls, and cost alerts. Keep model management interfaces separate from ordinary inference.

• Inventory every AI resource and owner.
• Separate development, evaluation, and production projects.
• Approve models through a registry with immutable version references.
• Pin and scan dependencies and base images.
• Redact logs while preserving security-relevant metadata.
• Test backup, rollback, revocation, and model-version recovery.

Secure RAG and continuous updates

Validate source ownership before indexing, enforce document authorization at retrieval time, scan ingest pipelines, isolate connectors, preserve delete propagation, and monitor unusual content changes.

Treat fine-tuning, feedback, and memory updates as deployment changes. They need review, evaluation, canary release, rollback, and evidence.

If a model, dataset, or prompt can change production behavior, it belongs in change control.