Safety · Guide
AI Safety, Security, and Governance
Ship AI safely — prompt injection defense, guardrails, OWASP LLM Top 10, bias, privacy, the EU AI Act.
Shipping AI safely means defending against attacks and meeting governance standards. This guide covers prompt injection and how to defend against it, guardrails and validators, hallucinations and grounding, the OWASP LLM Top 10, bias and fairness, privacy and data governance, and frameworks like the EU AI Act and the NIST AI Risk Management Framework.
Generate your own lesson →What you'll learn
- What Is Prompt Injection?
- An AI Safety Release Checklist
- Bias and Fairness in AI
- Defending Against Prompt Injection
- EU AI Act Basics
- Guardrails and Validators for LLM Apps
- Hallucinations and Grounding
- Privacy and Data Governance for AI
- Prompt Injection: Attacks & Defenses
- Securing Tool-Using Agents
- The NIST AI Risk Management Framework for Generative AI
- The OWASP Top 10 for LLM Applications
Lessons in this guide (12)
What Is Prompt Injection?
Prompt injection is a security vulnerability in which an attacker hides malicious instructions inside text an AI system reads — a web page, email, or document — tricking the underlying large language model into ignoring its original instruc
An AI Safety Release Checklist
A safety release checklist is a gate an AI feature passes before shipping, turning scattered good intentions into a repeatable set of checks. It covers evaluation against a golden set, adversarial red-teaming, guardrails on inputs and outpu
Bias and Fairness in AI
Bias in AI is systematic unfairness in a model's behavior, usually inherited from skewed training data or historical patterns and expressed as worse outcomes for some groups. Fairness is the goal of not disadvantaging people based on protec
Defending Against Prompt Injection
Defending against prompt injection means containing an attack you cannot fully prevent, since a language model can't reliably separate instructions from the data it reads. The strongest defenses are structural: least privilege on tools and
EU AI Act Basics
The EU AI Act is the European Union's comprehensive law regulating artificial intelligence, the first of its kind. It takes a risk-based approach: it bans a few unacceptable-risk uses, imposes strict obligations on high-risk systems, requir
Guardrails and Validators for LLM Apps
Guardrails are programmatic checks placed around a large language model to keep its inputs and outputs within safe, valid bounds. Input guardrails screen what reaches the model — off-topic requests, injection attempts, personal data; output
Hallucinations and Grounding
A hallucination is when a large language model produces confident, fluent text that is factually wrong or unsupported — inventing a citation, a statistic, or an API that does not exist. It happens because the model predicts likely-sounding
Privacy and Data Governance for AI
Privacy and data governance for AI is the practice of controlling how personal and sensitive data flows through an AI system — what is collected, sent to models, logged, retained, and trained on. It matters because LLM apps constantly move
Prompt Injection: Attacks & Defenses
Prompt injection is an attack in which adversarial instructions hidden in the text a large language model processes override the developer's intended instructions. Attacks range from direct jailbreaks a user types to indirect payloads plant
Securing Tool-Using Agents
A tool-using agent can read data, call APIs, and take actions, which makes its security failures consequential: a hijacked agent doesn't just say the wrong thing, it does the wrong thing. Securing one rests on least privilege — minimal tool
The NIST AI Risk Management Framework for Generative AI
The NIST AI Risk Management Framework (AI RMF) is a voluntary, widely adopted framework from the US National Institute of Standards and Technology for managing AI risks across a system's life. It organizes work into four functions — Govern,
The OWASP Top 10 for LLM Applications
The OWASP Top 10 for LLM Applications is a community-maintained list of the most critical security risks specific to apps built on large language models. It names threats that traditional security misses — prompt injection, sensitive inform
Frequently asked questions
What is prompt injection?
Prompt injection is an attack where malicious text — in the user input or in content the agent reads — overrides the app's instructions, making the model ignore its rules, leak data, or misuse tools. It's the top LLM security risk.
How do you add guardrails to an LLM?
Guardrails validate inputs and outputs against rules: block or sanitize unsafe input, check output for PII, policy, or format violations, constrain which tools can run, and require confirmation for high-impact actions.
What is the OWASP LLM Top 10?
The OWASP LLM Top 10 is a widely-used list of the most critical security risks for LLM apps — led by prompt injection, insecure output handling, and sensitive-information disclosure.