AI application security
Chatbots, agents and AI workflows inherit real identities, data, tools and authority. A safe-looking answer is not evidence of a safe outcome.
Follow the attempt. Find the owning control. Verify the effect.
Interactive case file
Sensitive data
Scope the data query to the signed-in user before the model can use it.
Connected tools
Authorize each tool action against the user and the requested object.
Business actions
Enforce approval in the application path and verify the ledger afterwards.
This case file remains readable without JavaScript; the controls simply make comparison faster.
The problem
Your AI-enabled application may be able to expose sensitive data or take actions its user is not allowed to perform.
The real boundary is formed by identity, data, permissions, and tools. A polite refusal or detector warning does not tell you what the application attempted—or what happened downstream.
What can someone persuade your AI surface to see, call, change, or disclose?
The solution
Test one authorized AI surface as an application—not just as a model.
The fixed-scope assessment follows meaningful attempts through identities, tools, services, and downstream effects. It identifies the owning control, helps the team correct the gap, and repeats the same meaningful test.
See how the assessment worksCase study
A synthetic HR chatbot used a service identity with more authority than its user. The test separated what the model said from what the application attempted, enforced, and changed downstream.
Evidence state explorer
Select each state to compare what appeared in the interface with what happened in the application.
What the model showed
A response that sounds cautious is shown to the user.
What the application did
The overpowered service identity still completes the unsafe email action.
What this proves
The application is vulnerable. The message did not enforce the boundary.
What the model showed
A detector raises a warning around the same attempt.
What the application did
The downstream action remains possible because nothing enforces the warning.
What this proves
Detection is evidence, not prevention. The consequential path is still open.
What the model showed
The interface reports that this pinned attempt was stopped.
What the application did
An application control denies the action before it reaches the email service.
What this proves
This path was blocked. It does not establish universal protection.
What the model showed
The same meaningful attempt is repeated after the correction.
What the application did
Authoritative readback shows that no unsafe email side effect exists.
What this proves
The narrow correction held for the pinned scenario and produced the intended effect.
This bounded synthetic example does not prove that every prompt injection is blocked or establish universal safety.
Read the evidence and limitationsThe wider practice
AI applications must also be affordable, buildable, and observable. VOF connects those concerns through four working flagships.
Security
AI application-security platform — test application behaviour and optionally defend live paths.
Read more →Finance
A framework for AI token economics — cost vs yield per unit of work.
Read more →Development
Specification-to-implementation alignment for LLM-assisted development.
Read more →Operations
Observability, incident response, and runbook patterns for AI applications.
Read more →How engagements run
One pillar at a time, in three shapes. Examples below; the full matrix lives on the Work page.
Healthcheck — fixed fee, 1 week
OWASP LLM Top 10 audit against your stack.
Roadmap — fixed fee, 2–3 weeks
Threat model and remediation roadmap.
Project — day rate, 4–12 weeks
Deploy guardrails, instrument apps, train the team.
Latest writing
A bounded synthetic example of why model output, application enforcement, and downstream effect must be tested separately.
Why we are putting a customer-proxy agent inside pull requests, and why passing tests is no longer enough proof.
We borrowed /handoff from Matt Pocock, added /pickup, and now we have a paired Claude Code skill that gives us a deliberate, throwaway context bridge across /clear — instead of the usual cargo-cult HANDOFF.md that nobody updates and nobody trusts.
Tell us what the surface can see or do. We’ll identify a bounded first assessment.
Discuss one AI featureNeed the wider picture?
Assessment is one part of the practice. See the full Assess, Plan, Execute matrix across Security, Finance, Development, and Operations.
Explore the work