The AI Reckoning / Chapter 18

AI Security Red Flags Card

Review code, access boundaries, and model-connected tools before release.

Download printable PDFOne page · Updated October 20, 2026

Check the code and its access

Check identity and authorization separately. Test that a signed-in user cannot read or change another user’s records.
Enforce permissions server-side on every protected operation. Use least privilege and deny access that has not been explicitly allowed.
Use parameterized queries and validate inputs at boundaries. Check uploads, file paths, URLs, and command execution.
Use maintained authentication components and appropriate password storage. Do not invent password hashing or session handling.
Remove embedded credentials. Rotate any exposed secret; deleting it from the latest file does not revoke it.
Keep secrets and unnecessary personal data out of logs. Define access, redaction, and retention for diagnostic records.

Treat retrieved pages, documents, and tool responses as untrusted data. Prompt instructions alone are not access controls.
Validate tool arguments and outputs. Enforce permissions outside the model and require approval for consequential actions as appropriate to the workflow.
Exercise prompt-injection and misuse scenarios in a safe environment. Combine human review, automated checks, and focused security testing.

Finding / impact / evidence / owner / next action: ….

Use the printable worksheet to keep your notes and evidence with your team.