Skip to content

AI Security Architecture¶

Three things define the platform:

  • Eight modules, each enforcing at one of four layers.
  • Three enforcement points, on the path from a public registry to a live request.
  • Four collection methods, one per kind of asset.

Read this before you onboard. The collection method decides what you install and where.

The Four Enforcement Layers¶

Each module reads from and enforces at the layer directly below it. Onboarding an account at the deployment layer is what makes the modules above it work.

Six modules are generally available. AI Identity Security and AI-GRC are on the roadmap.

AI Identity Security and AI-GRC are on the stack because the layer model accounts for them. Neither is in the console today, so plan coverage around the other six.

The Three Enforcement Points¶

  • Pre-deployment scan. Decides whether a model is allowed in at all.
  • ModelArmor sandbox. Limits what a model or agent can do once it runs.
  • Prompt Firewall. Inspects traffic in both directions.

The control plane schedules the first two and holds the policy for the third.

  • Only scanned models reach the deployment. The CI/CD gate enforces that on a pull request, not by convention.
  • A poisoned model that does run still cannot reach an external host. The sandbox limits what it may execute, read and open.
  • The Prompt Firewall is the only component in the request path.

AI-DR reads events, it does not sit in the path

AI-DR ingests control-plane events from CloudTrail, Azure Event Hub and GCP logging, then evaluates them against policy. It operates out-of-band and adds no latency to inference. The Prompt Firewall is the inline component.

The Four Collection Methods¶

Where the asset runs decides the method, not which module you want. A managed model in Bedrock needs an agentless cloud SDK. An inference engine installed on a VM is only found by scanning that VM.

Collection method Reaches Install Onboarding guide
Agentless cloud SDK Managed AI services in AWS, Azure and GCP Nothing on the workload, a cloud role only AWS, Azure, GCP
Agentless VM snapshot scan Models and inference engines on cloud VMs Nothing on the VM Cloud onboarding
Agent-based VM scan On-prem servers and endpoints AccuKnox agent on the host VM onboarding
Browser plugin extension SaaS AI apps used from a browser Extension on the user's browser Chrome, Edge, Firefox

An asset reached by more than one method is still one asset in the inventory. Onboarding the same account twice does not duplicate it.

Known Limits¶

  • AI-DR does not block. It detects and routes. Blocking in the request path is the Prompt Firewall's job, and blocking at runtime is ModelArmor's.
  • The browser plugin only sees browser traffic. A prompt sent from a desktop app or a terminal to the same SaaS model is outside its view. Use the SDK or a gateway for those.
  • The pre-deployment scan is a point-in-time check. A model that passes today can be re-uploaded upstream with a different artifact, so re-scan on every version bump rather than once at adoption.
  • AI Identity Security and AI-GRC are not available yet. Neither appears in the console today.