Prompt injection: keep authority outside retrieved text
External documents may inform answers without granting permissions.
AI, LLM and RAG security
Trust boundaries, agents, prompt injection and information protection in AI systems.
Reading on this topic
MCP: tool changes are trust changes
An agent's tool catalog needs governance.
RAG: revocation must reach retrievable content
Removing source access may leave usable copies.
AI models: record what actually changed in a release
Behavior depends on more than the model file.
AI-generated code: acceptance remains an engineering decision
Generation speed does not replace behavioral understanding.
AI agents: define the approval contract before granting autonomy
The agent security debate calls for a concrete architecture decision: which changes may an agent execute without approval?
Thiago Lima Soneti da Silva (Thiago Silva) — Cyber Architect and technical lead at Lima e Silva Tecnologia.