> workflow / security
Security
Validate threat model, dependencies, secrets, and AI-specific attack surfaces before performance tuning or release plumbing.
What should I do next?
Complete the steps and evidence below, clear the human gates, then continue to Performance.
When to use
- RC includes new tools, MCPs, retrieval, or auth boundaries
- Dependency or secret posture changed
- Risk tier requires security sign-off before prod
- Prompt-injection / tool-abuse tests are not yet evidenced
Step-by-step
- Revisit the architecture threat model against the actual RC diff.
- Run security-review.prompt on agent, MCP, and data-flow changes.
- Verify secret scanning, dependency scanning, and allowlist enforcement.
- Test prompt injection and tool-abuse cases on AI entry points.
- Confirm logging/redaction so prompts and tools cannot leak PII.
- File remediations with severity; block ship on unresolved highs.
- Record security sign-off or time-boxed waivers with owners.
Decisions to make
- Block vs waive (expiry + compensating control)
- Whether new MCPs stay disabled in prod
- Data classes allowed in prompts and traces
- Need for pen-test or red-team before GA
Evidence to collect
- Security review notes linked to RC
- Remediation tasks with severity and status
- Scanner results (secrets, deps, allowlist)
- Sign-off or waiver record
Role-specific next actions
- PM: Accept schedule impact of blocking findings; do not pressure silent waivers.
- Architect: Fix boundary flaws at design level when reviews find systemic issues.
- Engineer: Remediate findings in code; add regression tests for abuse cases.
- Security: Own sign-off criteria and residual risk language.
Inputs
- Threat model and ADR trust boundaries
- Dependency graph and MCP allowlist
- Data-flow / prompt-path inventory
Outputs
- Security review notes
- Remediation backlog
- Sign-off or waiver with expiry
Required prompts
- Security review
Primary structured security review for AI and classic surfaces.
Required skills
- Security
Primary security engineering skill for this stage.
Required MCP servers
- GitHub MCP
Pull advisory/PR context during review workflows.
Tooling & handbook
- Security smoke / standards
Normative controls and assurance entry — not an MCP.
- Evidence & conformance
How to record exceptions and evidence.
- Enterprise pattern
Governed AI controls at org scale.
- Quality checklists
Security-oriented review checklists.
- pre-tool-call hook
Runtime allowlist enforcement for tools.
Recommended agents & patterns
- Security agent
Assists review; humans sign.
- Enterprise pattern
Pattern for governed multi-tenant / regulated AI.
Human approval gates
- Security approval for external data, new tools, and elevated risk tiers
- No prod enablement of MCPs outside the signed allowlist
Automation opportunities
- Secret and dependency scanning in CI
- MCP allowlist checks in pre-tool-call hooks
- Automated high-severity finding tickets
Enterprise best practices
- Map findings to SoA controls where applicable
- Link incident playbooks for AI abuse scenarios
- Retain review evidence and waiver history
Common mistakes
- Ignoring prompt injection because "the model is internal"
- Over-trusting retrieved context without provenance checks
- Putting SoA README under MCPs instead of tooling/controls