Security protects systems, data, and services from unauthorized access, alteration, disruption, or destruction. In enterprise GenAI, it is a production requirement alongside scalability, reliability, observability, and compliance. section 11.4 section 11.4.8
Apply security through layered operational controls:
- Encrypt sensitive data at rest and in transit, using TLS for transmission and cloud-provider encryption for stored data. section 11.4.8
- Restrict production data and infrastructure with role-based access control and the principle of least privilege. section 11.4.8
- Audit applications and infrastructure against applicable regulations and standards, including GDPR, HIPAA, or CCPA where relevant. section 11.4.8
- Monitor abnormal usage and unauthorized access attempts with anomaly detection so potential breaches or misuse receive rapid attention. section 11.4.8
Enterprise-controlled GenAI data
A retrieval-augmented generation system can keep proprietary data under enterprise control, retrieve current and policy-aligned information, and provide sources for generated content. Controlling the retrieval corpus supports data-privacy compliance and improves transparency, but does not remove the need for broader security controls. section 8.8 section 11.4.8
Security must be designed across the GenAI lifecycle, including model serving, infrastructure, user data, monitoring, governance, and responsible-AI safeguards. Treat illustrative controls as part of a broader production and compliance program. section 11.4 section 13.0
