What you will learn
Authentication, Authorization, Prompt injection, Data retention, Tenant isolation.
Engineering the capability
Authentication establishes identity; authorization determines what that identity may do. Derive the tenant and actor from trusted server state, then scope database queries, retrieval, caches, and tool calls. A model-produced tenant ID is untrusted input.
Prompt injection is an attempt to make untrusted content influence application behavior beyond its intended role. A retrieved document may contain instructions that look like system guidance. Labeling text helps the model, but application-enforced permissions and restricted tools remain necessary even if the model follows the malicious instruction.
Review every place data can cross users: conversation history, vector search, response caches, traces, exports, and background jobs. Deletion must cover derived data as well as source records. Redaction should reduce unnecessary sensitive logging without making incidents impossible to diagnose; request IDs and status codes often provide useful evidence.
Worked case
A response cache keyed only by question serves the answer to “What is our contract price?” across customers. The model and retrieval permissions may be correct, yet the cache leaks data. Include the appropriate authorization scope and content version in the key, or disable caching for that response class.
Put it into practice
Continue with the next lab: test an isolated knowledge service. Build the artifact, record the failure cases, and explain the tradeoff before moving on.