Draw the real boundary
Locate the interface, model, documents, search index, tools, logs and backups, and identify every telemetry, update or external API path. Assign owners for the data, workflow and operation.
Document update, telemetry and identity dependencies alongside model hosting; an external call changes the claimed operating boundary.
Separate prediction from authority
Let the model propose a response or tool call, while deterministic code checks the user, permission, fields and current state. Never substitute a broad administrator credential for this control.
A deterministic policy layer should reject unauthorised tools and malformed arguments before they reach any business system.
Build inspectable layers
Use an authenticated gateway, pinned model service, permission-aware retrieval, narrow tool adapters, event records and infrastructure monitoring. Add write actions individually with confirmation and replay protection.
Version model, retrieval index, prompts and tool contracts together so an incident can be reproduced against the released configuration.
Accept a workflow, not a demo
The NIST Generative AI Profile frames evaluation around intended use, limits and possible harm. Test normal, ambiguous, forbidden and adversarial cases, unavailable dependencies and cross-user data attempts, then retain evidence sufficient to reconstruct each action.
Acceptance should cover unavailable services, hostile documents, cross-user requests and repeated operations, not only correct answers.