# AI feature security review checklist

Questions to answer before launching a feature where a model reads untrusted text or uses tools.
By Morteza Bazrafshan, bazrafshan.ir.

## Map the exposure
- [ ] What untrusted text can reach the model (user input, emails, web pages, files, tickets)?
- [ ] What private data can the model see?
- [ ] What can it do or send outward (tools, web requests, messages, rendered links/images)?
- [ ] If all three are "yes" for the same agent, redesign before launch.

## Limit the blast radius
- [ ] Tools are least-privilege and read-only by default.
- [ ] Allow-lists for domains, commands and file paths.
- [ ] Irreversible or customer-facing actions need human approval showing the exact action.
- [ ] Untrusted content is processed without powerful tools; only constrained results move on.
- [ ] Per-task caps on steps, tokens and spend.

## Output handling
- [ ] Model output is validated against a schema before use.
- [ ] Model-produced links and images are not auto-rendered or fetched.
- [ ] Output is escaped before display (no raw HTML from the model).

## Data and secrets
- [ ] No secrets in prompts or the agent's environment.
- [ ] Only the minimum personal data is sent to the provider.
- [ ] Provider retention and training terms checked for the plan used.

## Operations
- [ ] Tool calls and decisions are logged and reviewable.
- [ ] There is a kill switch.
- [ ] Abuse reports have a clear path.
- [ ] Test with deliberately hostile inputs (hidden instructions in documents and web pages) and record results.