Customer Security and Platform Reviews for AI Projects
Prepare for a customer security and platform review of an AI project: find their process in week one, bring an evidence pack and answer questions honestly.
What you'll learn: how to work with a customer's IT security lead and platform team: ask for their review process in week one, show how identity reaches the order system, decide what the model receives and what is logged, and answer with evidence or an honest "not yet".
At a glance
Figure 1. A typical approval path (confirm the real one with the customer)
flowchart LR
accTitle: A typical approval path for a new AI system
accDescr: The engineer asks for the customer's review process, submits an evidence pack, security and platform teams ask questions and record findings, the engineer fixes or negotiates them, and approval is given for a limited pilot, with a further review before production and after significant changes.
A["Ask for their process"] --> B["Submit evidence pack"]
B --> C["Questions and findings"]
C --> D{"Fix, accept or defer"}
D --> E["Pilot approval"]
E --> F["Re-review before production"]
F --> G["Re-review after big changes"]
C -- more evidence --> B
How to read this: the loop between questions and evidence repeats.
Ask for the customer's review process in week one.
Show identity flowing from sign-in to the OMS; send the model only the fields it needs.
Answer every question with evidence, a source or "not yet known, owner, date".
Never claim a standard, certification or provider promise you cannot show.
Your artifact: the security and platform checklist.
Scenario
Composite scenario, not a real company. Lumen Industrial Supply, a fictional distributor, plans a read-only Order and Policy Assistant for 24 customer-service agents. It reads orders from the order management system (OMS). The IT security lead wants least privilege and logs without personal data. The platform team owns the API gateway and the single sign-on (SSO) identity provider and wants no new public endpoint. The assistant sends text to a hosted model through a model gateway. All numbers are illustrative.
What you will be able to do
List the week-one questions for security and platform teams.
Show how identity propagates and what data goes where.
Answer a questionnaire item with evidence, a source or an owned unknown.
WEEK-ONE QUESTIONS FOR SECURITY AND PLATFORM
1. What is the review process for a new system that uses company data?
Who runs it, which stages, how long does each take?
2. What must we submit, and in what format?
3. Which data classes may leave the network, and to which providers?
4. How do users authenticate, and what identity data can we receive?
5. Where may the service run, and what may it call over the network?
6. Who approves a pilot, and who approves production?
7. What changes after approval require a new review?
No answer yet? "Unknown, owner is the security lead, asked on date X" is a valid status.
Identity and least privilege
Figure 2. Who the order system thinks is asking
sequenceDiagram
accTitle: Identity propagation through the gateway
accDescr: The agent signs in with single sign-on and the client app sends a request with the token. The API gateway validates the token and passes the identity to the orchestrator. The orchestrator asks the gateway for the order, and the OMS answers using the agent's permissions. The orchestrator sends only the needed fields to the model gateway, writes a log entry without personal data and returns a cited answer through the gateway.
participant C as Client app
participant G as API gateway
participant O as Orchestrator
participant S as OMS
participant M as Model gateway
participant T as Trace store
C->>G: Question with SSO token
G->>G: Validate token
G->>O: Request plus agent identity
O->>G: Order lookup as that agent
G->>S: Read order with agent permissions
S->>G: Order fields
G->>O: Order fields
O->>M: Question, needed fields, policy passages
M->>O: Draft answer
O->>T: Log ids and versions, no personal data
O->>G: Cited answer
G->>C: Cited answer
How to read this: identity travels with every call, so the OMS applies the agent's rights, and the model gets only the fields in the table below.
Least privilege here means the assistant can read orders and nothing else: no OMS write scope exists in the MVP, so a prompt trick cannot create one.
What reviewers ask
Area
A question you may be asked
Evidence to bring
Data flow
What leaves our network, to whom, why?
Data-flow diagram naming each hop and data class
Access
Can an agent see an order they should not?
Access tests, and the code location of the check
Logging
What do logs contain?
Redacted log sample and field list
Tool permissions
What can the model make the system do?
Tool list: read-only, no write scope (AC-6, zero write calls in the gateway log)
Injection
What if a document contains instructions?
Injection test cases and results
Residency
Where is the data processed?
Open question: owner IT security lead and platform team
The OWASP Top 10 for LLM (large language model) Applications 2025 lists ten risks, including prompt injection (LLM01) and excessive agency (LLM06). The AI Risk Management Framework 1.0 from NIST (the US National Institute of Standards and Technology) was released on 26 January 2023 and is intended for voluntary use. Ask whether the customer uses either, and never claim compliance with a framework you have not been assessed against.
Spot the flaw. Find the defects in this draft answer to a questionnaire.
Q: How is customer data protected?
A: All data is encrypted and the system is fully compliant with all
industry standards. The model provider never keeps any data.
Agents can only see what they should.
Answer
"Fully compliant with all industry standards" names no standard. "The provider never keeps any data" cites no terms. "All data is encrypted" has no scope. "Agents can only see what they should" has no test behind it. A better answer says what is encrypted where, links the terms with the date read, cites the access tests and lists unknowns.
Explain it back. Tell the security lead in three sentences why the application, not the model, must decide whether an action is allowed. A good explanation says model output is untrusted input, names the check in code before any call, and points to a test showing a forbidden call refused.
Worked example
Assumptions: illustrative proposal, for the security lead to decide. The OMS returns order id, customer id, status, lines, total, promised date, hold reason and shipment (carrier, tracking).
Field
Sent to the model?
In the log?
Status, promised date, hold reason
Yes (needed to explain)
Yes
Order id
Not as a field (the agent's question may contain it)
Yes
Agent's question text
Yes (it may contain what the agent typed)
No
Carrier, tracking
Only if the question asks
No
Lines, total
Only if the question asks
No
Customer id
No
Not by default; ask the security lead
Each log entry holds request id, agent role, policy ids and versions, and the answer.
Residency stays open: "Unknown, owner is the IT security lead, asked 2026-11-03."
Suppose a first review returns 12 findings: 2 high (2 days each), 5 medium (1 day), 5 low (0.5 day). Fixing all costs 4 + 5 + 2.5 = 11.5 person-days, 17 percent of a 68-day plan with no free days. Fix the highs before the pilot (4 days, swapped against another item); defer the rest to a risk register the security lead signs.
At the customer: a reviewer asks, "Do you store prompts?" Say: "The log stores request id, role, policy ids and versions, and the answer; prompt text is not stored. Here is the field list and the sampling test."
Practice task
Build the security and platform checklist for the assistant.
List each hop from the client app to the model gateway and back, with the data class on each.
Map each reviewer question in the table to the test or document that answers it. Mark rows with no evidence yet.
Write three "unknown, owner, date" entries.
Add the checklist to your design pack.
Decide first, then reveal.
What do you tell the reviewer? (interactive when JavaScript is on)
A reviewer asks, "What can the model make the system do?"
Show the read-only tool list: no OMS write scope, zero write calls in the gateway log (AC-6)
Say the system prompt forbids writes
Show the access tests for what agents may see
Answer
Show the read-only tool list: no OMS write scope, zero write calls in the gateway log (AC-6). With no write scope in the MVP, a prompt trick cannot create one. A prompt instruction asks the model, it does not control it.
A developer wants the customer id in every log entry to ease debugging.
Add it: logs are internal
Not by default: ask the IT security lead
Log the agent's question text instead
Answer
Not by default: ask the IT security lead. Customer id is not logged by default, and the security lead decides. Question text stays out of the log too.
A first review returns high, medium and low findings. The plan has no free days.
Fix every finding before the pilot
Defer everything to a risk register
Fix the highs first, swapped against another item; defer the rest to a register the security lead signs
Answer
Fix the highs first, swapped against another item; defer the rest to a register the security lead signs. Highs block the pilot, and a signed register makes the deferral visible. Fixing all takes days the plan lacks.
Exercise
Answer these five questionnaire items for the assistant: "Where is data stored?", "Who can access logs?", "What happens if the model provider is unavailable?", "Can the system act on behalf of users?", "How are prompt changes controlled?"
Acceptance criteria:
Each answer states what exists, where the evidence is and what is not yet known.
No answer uses "fully", "never", "all" or "guaranteed" without a test behind it.
At least one answer is "not yet known" with an owner and a date.
Done when a reviewer could verify each answer without calling you.
Hint 1: start from the evidence
Open your tests and configuration and write what they show. If you cannot point to a file or setting, list the sentence as unknown.
Hint 2: use one structure
What we do, where it is configured or tested, what we do not yet know, who owns the unknown.
Common mistakes
Meeting security at the end. A review found in week seven is a delay you cannot absorb.
Overclaiming. "Fully compliant" with no named standard damages trust faster than "not yet".
Citing a provider's promise from memory. Link the terms and the date you read them.
Ignoring the platform team. Hosting and identity limit what you can build.
Knowledge check
1. Why ask for the customer's review process in week one?
Each customer defines its own stages and approvers. Learned late, review time lands inside the pilot.
2. What do you do when you do not know the answer to a reviewer's question?
Say so, name the owner and give a date. A visible unknown can be accepted or escalated; a guess presented as fact costs far more trust.
3. Why pass the agent's identity to the OMS and not use one shared service account?
With the agent's identity the OMS applies that agent's permissions and audit trail, so least privilege is enforced where the data lives. A shared account loses who asked.
4. Why is "the provider never keeps any data" a weak answer?
It is a claim about another organisation's service with no source, and terms change. Link the terms with the date you read them and state your own retention setting.
5. Why must the application, not the model, decide whether an action is allowed?
Model output is untrusted input and can be steered by documents or a user. Authorisation in code can be tested and logged, whatever the model produces.
You can now
Add the security and platform checklist to your design pack.
List the week-one questions for security and platform teams.
Draw how identity reaches the OMS and what the model receives.
Spot overclaims in a draft answer and rewrite them.
Lesson 5 of 8 · AI Solution Architect: Discovery, Scope and Security
Prepare for a customer security and platform review of an AI project: find their process in week one, bring an evidence pack and answer questions honestly.
In the rest of this lesson
Worked example
Practice task
Exercise
Common mistakes
Knowledge check
You can now
Enrolling is free. It unlocks every lesson in AI Solution Architect: Discovery, Scope and Security, tracks your progress across devices and keeps your quiz scores. The newsletter is optional.
Real architecture decisions, LLMOps patterns that survive production, and engineering leadership advice — from 12+ years of building at enterprise scale. Free. No spam. Unsubscribe anytime.
Get new articles by email
Free. We email a confirmation link first, and you can unsubscribe from any email.