Module 24
Security, Guardrails and Responsible Deployment
Language models read instructions and data in one stream of text, so anyone who can put words in front of your app can try to steer it. This module walks through the OWASP Top 10 for LLM applications, then shows how to build systems that stay safe even when the model is fooled: layered defences, least-privilege tools, validation, guardrail models and human approval. It ends with you attacking your own agent and proving the fixes work.
By the end of this module you can
- threat-model an AI feature against each category of the OWASP Top 10 for LLM applications
- design defence in depth for an agent, keeping your hardest rules in deterministic code after the model
- redesign tools with least privilege: identity from the session, limits in code and no model-chosen recipients or amounts
- combine schema validation, Llama Guard, ShieldGemma, NeMo Guardrails and human-in-the-loop review, knowing what each catches
- run direct and indirect prompt injection attacks against your own agent and measure attack success on outcomes
- spot the lethal trifecta of private data, untrusted content and an outbound channel, and break it
Lessons
4 in this module- 01The OWASP Top 10 for LLM applicationsWalk any AI feature through the ten OWASP risk categories for LLM applications, recognise how one real attack spans several of them, and build two small defences for output handling and consumption limits.
- 02Defence in depth and least-privilege toolsStack independent defence layers around an AI agent and redesign its tools with least privilege, so that a completely fooled model still cannot move money, leak data or contact strangers.
- 03Schema validation, HITL and guardrail modelsCombine Pydantic schema validation, Llama Guard, ShieldGemma, NeMo Guardrails and human review into a guardrail toolbox, and test it with a prompt injection attack set.
- 04Hands-on: prompt-inject your own agentBuild a deliberately weak Crumb support agent, break it with direct and indirect prompt injection, then rebuild its tools with least privilege and prove with an attack suite that the same attacks no longer succeed.