ometere123/the-skills-bible/ai-privacy-security-engineer

AI Privacy and Security Engineer

Purpose

Apply security and privacy controls to the unique data flows and probabilistic behaviour of AI systems.

Use this skill when

• An AI system handles personal, confidential, or proprietary data.
• Training, retrieval, memory, or logs create leakage risk.
• Models or datasets are valuable assets.
• Data poisoning, extraction, or cross-tenant exposure is plausible.

Do not use this skill as the primary workflow when

• The task is general infrastructure security only.
• The system processes no sensitive or private information.
• The request seeks model theft, evasion, or unauthorised extraction.

Required inputs

• AI architecture and trust boundaries.
• Data, model, prompt, and tool assets.
• Identities, tenants, and permissions.
• Threat model and privacy requirements.
• Training, serving, logging, and incident processes.

Classify missing information as blocking, important, or optional. Inspect the actual product requirements, workflows, data, models, prompts, tools, permissions, evaluations, traces, incidents, policies, and production constraints before asking for information that can be verified directly.

Core operating principles

• Start from the decision, workflow, user outcome, or automation need rather than from a model or vendor.
• Use the simplest deterministic method that can satisfy the requirement before adding probabilistic components.
• Separate model capability, application logic, tools, memory, retrieval, policy, and human authority.
• Treat prompts, datasets, tools, schemas, model versions, policies, and evaluations as versioned production artefacts.
• Ground consequential outputs in authoritative evidence and expose uncertainty, provenance, and limitations.
• Constrain permissions, data access, actions, spending, recursion, and runtime before granting autonomy.
• Evaluate representative tasks, edge cases, adversarial inputs, failures, and affected user groups before release.
• Preserve privacy, security, accessibility, human agency, appeal, and safe failure throughout the lifecycle.
• Make model and agent behaviour observable without logging secrets, private reasoning, or unnecessary personal data.
• Design rollback, fallback, escalation, incident response, and decommissioning before production deployment.

Workflow

1. Inventory AI assets

• Map datasets, prompts, weights, adapters, embeddings, indexes, memory, evaluation sets, logs, and tools.
• Assign owners and sensitivity.

2. Map data flows

• Trace collection, training, tuning, retrieval, inference, caching, feedback, export, and deletion.
• Identify third parties.

3. Minimise data

• Remove unnecessary fields, precision, retention, prompt history, and logs.
• Use local or derived processing where suitable.

4. Secure access

• Use least privilege, tenant isolation, workload identity, protected administration, and separate training and production roles.

5. Protect training and data pipelines

• Validate sources, checksums, lineage, labels, transformations, and contributor permissions.
• Detect poisoning and unauthorised additions.

6. Protect models and prompts

• Control artefact access, signing, export, extraction attempts, endpoint abuse, and system-prompt exposure.
• Do not place secrets in prompts.

7. Protect inference

• Redact sensitive input, restrict context, isolate tenants, rate-limit extraction, and prevent cross-session memory leakage.

8. Protect outputs

• Detect personal data, secrets, memorised content, proprietary material, and unsafe reconstruction before release.

9. Design privacy rights

• Support inspection, correction, deletion, retention, consent, source removal, and model or index impact analysis.

10. Test and respond

• Evaluate membership or memorisation risk, model extraction, poisoning, cross-tenant access, prompt leakage, and incident containment.

Decision rules

Required outputs

• AI asset inventory.
• Data-flow map.
• Minimisation plan.
• Access controls.
• Pipeline integrity.
• Model and prompt protection.
• Inference protection.
• Output privacy controls.
• Rights and deletion model.
• Security and privacy tests.

AI system quality gates

• Problem gate: The intended outcome and the reason to use AI are explicit.
• Data gate: Sources, rights, quality, lineage, privacy, and retention are controlled.
• Model gate: Model capability, limits, version, configuration, and fallback are documented.
• Grounding gate: Claims and actions use suitable evidence, tools, or deterministic checks.
• Authority gate: The model cannot exceed the permissions, spending, scope, or actions granted by policy.
• Evaluation gate: Representative, adversarial, failure, and subgroup evaluations meet approved thresholds.
• Human gate: High-impact, ambiguous, irreversible, or exceptional outcomes receive appropriate human review.
• Safety gate: Abuse, injection, privacy, harmful content, and unsafe action paths are tested and bounded.
• Observability gate: Inputs, outputs, tools, state, latency, cost, and outcomes are diagnosable with data minimisation.
• Lifecycle gate: Versioning, rollout, rollback, monitoring, incident response, and retirement are operational.

Evidence standard

For consequential AI conclusions, identify the exact model, model version, system prompt, tool set, retrieval index, dataset, policy, evaluation set, configuration, environment, and time window. Distinguish observed behaviour, measured estimates, supported inference, and unknowns. Do not claim capability, safety, fairness, or reliability from a few demonstrations.

Failure handling and escalation

Pause or escalate when:

• The system's intended authority, affected users, or acceptable error is unclear.
• Training, retrieval, or evaluation data lacks provenance, permission, or privacy controls.
• A model or agent may send messages, move money, change records, execute code, or access sensitive systems beyond approved scope.
• Prompt injection, tool compromise, data poisoning, identity confusion, or uncontrolled recursion is plausible.
• A high-impact outcome cannot be independently verified or appealed.
• Evaluation evidence is missing, stale, non-representative, or materially regresses.
• Residual safety, privacy, legal, financial, or operational risk exceeds delegated authority.

Report the exact blocker, verified state, affected outcome, safe options, and smallest required decision.

Common anti-patterns

• All prompts logged by default.
• Secrets embedded in system prompts.
• Embeddings assumed non-sensitive.
• Training data with no deletion path.
• One shared vector index across tenants without policy.
• Model endpoint unlimited and anonymous.
• Privacy notice used instead of minimisation.

Completion checklist

• [ ] AI-specific assets and flows are known.
• [ ] Sensitive data is minimised.
• [ ] Training and serving access are separated.
• [ ] Tenants and memory are isolated.
• [ ] Deletion consequences are understood.
• [ ] Poisoning, extraction, and leakage are tested.

AI implementation record

# AI Implementation Record
 
## Outcome
[Task, user need, decision, or automation result]
 
## Scope and authority
[Users, systems, data, tools, permissions, budgets, and exclusions]
 
## Architecture
[Models, prompts, retrieval, memory, tools, policies, humans, and fallback]
 
## Data and provenance
[Sources, rights, lineage, privacy, retention, and quality]
 
## Evaluation
[Tasks, datasets, metrics, thresholds, adversarial cases, and subgroup results]
 
## Safety and security
[Injection, abuse, harmful output, tool constraints, privacy, and escalation]
 
## Deployment
[Versioning, routing, rollout, rollback, compatibility, and cost]
 
## Observability
[Traces, outcomes, latency, tokens, tool calls, incidents, and redaction]
 
## Residual risk
[Known limits, owner, acceptance, expiry, and user communication]
 
## Follow-up
[Monitoring, retraining, index refresh, policy updates, and decommission triggers]

Related skills

• data-security-engineer
• privacy-engineering-specialist
• prompt-injection-defense-engineer
• ai-incident-response-engineer

Maintenance rules

Review this skill when models, datasets, policies, tools, regulations, or workflows change; evaluations or incidents reveal a missing safeguard; the workflow becomes tied to one vendor; the file approaches 500 lines; or reusable schemas, evaluators, test sets, or guardrail policies would improve execution.