Reviewing an AI tool's security
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
run a security review of an AI assistant before approving it.
Planned topics
- Data handling: what leaves the company, where it is processed, whether it is used for training.
- Retention: how long prompts and outputs are kept and whether they can be deleted.
- Access: single sign-on, roles, audit logs, and admin controls such as policy enforcement and repository exclusions.
- Integration risks: permissions of IDE plugins and agents, access to repositories, and prompt injection through content the tool reads.
- Record answers with evidence (contract, documentation); verify claims before recording.
Draft outline details
Demonstration
Questionnaire table: area | question | evidence | answer | risk rating. Example: Retention | are prompts stored, for how long, deletable? | vendor terms | ... | medium.
Check your understanding
Name two admin controls to look for.
Show answer
For example single sign-on with audit logs, and the ability to exclude repositories or enforce settings.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.