Every company now has an AI acceptable-use page. Fewer have a system that can stop a model from shipping a customer's private ledger into a prompt log. The gap between those two facts is where incidents live. Across Asia's banks, telcos, and public agencies, Tech Corp Asia sees the same maturation curve: experimentation first, then a scary screenshot, then a sudden hunger for guardrails. Guardrails are not a morality lecture. They are engineering controls—identity, data classification, output filters, evaluation harnesses, and human escalation—wired into the path the model actually takes. If the control is not on that path, it is literature.
Start with the data plane, not the slogan
Classify which systems may send data to which models. Separate secrets from prompts with retrieval rules that refuse raw credentials. Prefer private endpoints and regional processing where regulation demands it. Log prompts and completions with retention limits and access control. If your observability stack can read every customer conversation forever, you did not build AI. You built a new breach surface.
Identity, tools, and the agent problem
When models call tools, treat them like service accounts with least privilege. Scope tokens per environment. Cap spend and step counts. Require structured plans before irreversible writes. Prompt injection is not a party trick. It is an input channel for unauthorized instruction. Validate tool arguments. Prefer allowlists over clever regex after the fact.
Evaluation as a security control
Red-team for jailbreaks, data exfiltration, and toxic or biased outputs using local languages and local abuse patterns. Ship eval gates in CI for high-risk apps. Track override rates when humans reject model advice. Rising overrides are a signal, not a nuisance. Security that never measures model behaviour is security theatre with better fonts.
A minimal guardrail stack
- Approved model catalogue with owners.
- Data loss prevention on ingress and egress for AI paths.
- Human approval for high-impact actions.
- Kill switch tested quarterly.
- Incident runbooks that include model rollback, not only server rollback.
- Training for staff that covers what not to paste into a chat box.
Takeaway
The best way to use AI with security guardrails is to put controls on the real data and tool path, measure failures in local language, and rehearse stopping the system. Wikis do not stop breaches. Engineered boundaries do.