Secure-by-design architecture for enterprise AI: threat models mapped to enforceable mitigations, deny-by-default gateway policies, and reusable control baselines across LLM, RAG, and agentic deployment patterns.
AIUC-1 Consortium whitepaper: Engineering a Culture of AI Security (co-author)
Security and architecture review boards signed off on the production pattern — the threat model, gateway policy, retrieval controls, and runtime guardrails all held up under scrutiny.
It shipped to 2,000+ internal users with permissioned retrieval, deny-by-default gateway mediation, and end-to-end traceability built into the serving path from day one.
The baseline outlived the first deployment. Later RAG and agent-enabled projects built on it directly instead of re-litigating the same security decisions from scratch.
Reusable security architecture for enterprise AI in a federated delivery landscape, threat models, deny-by-default policies, control baselines, and runtime guardrails across LLM, RAG, and agentic patterns.
A regulated European energy group was standing up its first group-wide GenAI platform patterns — internal knowledge search first, agent-enabled workflows close behind. Enabling usage was the easy part. Enforcing real security boundaries around it was the actual job: sensitive documentation had to stay permission-scoped, tool access had to stay governed, and every control decision had to leave evidence an auditor or an incident responder could use later. Delivery sat across multiple teams and platforms, so this couldn't be a one-off review — I built it as a control baseline other teams could adopt, with sane defaults, explicit exception paths, and evidence capture that scaled as adoption grew rather than breaking under it.
Threat model covers injection, leakage, retrieval abuse, tool misuse, and privilege escalation, mapped to mitigations with ownership.
Security baselines defined and testable per deployment pattern (LLM, RAG, agentic, pipeline).
Gateway enforces deny-by-default for all model and tool traffic with versioned policy lifecycle.
Retrieval eligibility enforced before ranking and generation; ineligible content never reaches the model.
Agentic tool access governed by scoped identity, permission boundaries, and side-effect classification.
Guardrails block restricted intents, grounding failures, and unauthorized tool use; enforcement decisions captured as evidence.
Joinable traces produced for every request, retrieval decision, guardrail enforcement, and tool action.
