Secure AI Architecture

Reference architectures for on-prem LLM, RAG and agent systems, tested on local hardware.

Each pattern is a control you put around a model, with the failure it prevents measured on a local machine. The numbers come from a test harness in the repository and are regenerated, not typed in. How patterns are tested.

Patterns

• Structured output: validate before it enters the system Tested

  Force model output into a schema, reject what does not fit, and give the model one chance to fix it. Everything else goes to a human.

• Permission-filtered retrieval: the access check belongs in the search Tested

  In a RAG system the retriever decides what the model sees. Put the user's access check inside the search query, not after it and not in the prompt.

• Tool boundary: what an agent can do is decided by its tools Tested

  An agent with a delete tool can be talked into deleting. Remove destructive actions from the tool set, validate parameters in code, and route irreversible changes to a person.

• Tenant boundary: the session decides which tenant a query can reach Tested

  When one agent serves many customers, fix the tenant when the process starts, keep the session id away from the model, and let the database limit every query to that tenant.

• Workflow or agent: who decides the steps decides what can happen Tested

  When a task has a fixed procedure, run the procedure in code and call the model only where it has to read or write language. Give a model the choice of steps only where the steps cannot be written in advance, and then bound it.