The Production AI Security Stack: Inputs, Outputs, Data and Agents

Production AI applications fail in predictable places: untrusted text enters model context, sensitive data crosses provider boundaries, unsafe completions reach browsers, and agents execute tools with excessive scope. A production AI security stack is the layered set of controls — not a single product — that addresses each boundary with explicit policy, testing, and observability.

This guide maps the full stack from API edge to agent runtime, with pointers to deep dives on each domain. It is architectural reference material, not a vendor pitch. Implement with internal code, multiple vendors, or focused APIs where each layer fits.

---

Stack overview

┌─────────────────────────────────────────────────────────────────────────┐
│                         PRODUCTION AI SECURITY STACK                     │
├─────────────────────────────────────────────────────────────────────────┤
│  Edge          │ Auth, rate limits, tenant isolation, WAF              │
├────────────────┼────────────────────────────────────────────────────────┤
│  Input         │ Prompt injection, PII/secrets, retrieval screening     │
├────────────────┼────────────────────────────────────────────────────────┤
│  Data          │ Minimization, redaction, RAG ingest, vector isolation  │
├────────────────┼────────────────────────────────────────────────────────┤
│  Inference     │ Provider contracts, model choice, prompt structure     │
├────────────────┼────────────────────────────────────────────────────────┤
│  Output        │ Moderation, sanitization, CSP, untrusted rendering     │
├────────────────┼────────────────────────────────────────────────────────┤
│  Agents        │ Tool policy, action guard, HITL, least privilege        │
├────────────────┼────────────────────────────────────────────────────────┤
│  Integration   │ MCP hardening, tool output injection, SSRF controls    │
├────────────────┼────────────────────────────────────────────────────────┤
│  Provenance    │ C2PA / Content Credentials for generated media         │
├────────────────┼────────────────────────────────────────────────────────┤
│  Operations    │ Logging, metrics, testing, incident response           │
└────────────────┴────────────────────────────────────────────────────────┘

Each layer assumes the others can fail. Defense in depth is not redundancy for its own sake — attackers chain weaknesses across layers.

---

Layer 1: API and platform security

Before LLM-specific controls, SaaS fundamentals apply:

• Authenticate every request that triggers model spend or data access
• Enforce tenant isolation in databases, object storage, and vector indexes
• Rate-limit per user, IP, and organization
• Protect API keys in server environments — never in client bundles

Hub: API Security Checklist for SaaS, Protect API Keys

LLM features amplify traditional API risk: unauthenticated chat endpoints become cost centers and data exfiltration channels.

---

Layer 2: Input security (prompt injection)

Problem: Untrusted text manipulates model behavior — direct user messages, poisoned RAG chunks, web pages, tool outputs, and documents.

Controls:

• Server-side injection detection on assembled prompts — not only the latest message
• Retrieve-time and ingest-time scanning for RAG corpora
• Structural separation of instructions vs untrusted content where feasible
• Regression tests with adversarial corpora

Hub: What Is Prompt Injection? · Prevent Prompt Injection · Detect Prompt Injection · Prompt Injection Security Checklist · Indirect Injection in RAG · Prompt Injection Testing

API pattern:

POST /api/v1/security/prompt-injection
{"text": "<assembled prompt>", "source": "chat_input"}

Map verdict, findings, and risk to allow, review, block.

---

Layer 3: Data protection (PII and secrets)

Problem: Personal data and credentials enter prompts, logs, embeddings, and model outputs — often accidentally pasted by users or echoed from context.

Controls:

• PII and secrets scanning before provider calls
• Block on secrets; redact or block PII per policy
• Scan outputs before delivery and tool egress
• Minimize retention; avoid logging raw bodies in production

Hub: What Is PII Detection? · Secrets Detection in LLM Apps · LLM Privacy Filter · PII & Secrets Leakage Checklist · Redact PII Before LLM · LLM Data Leakage

API pattern:

POST /api/v1/security/pii-secrets
{"text": "<assembled prompt>", "redact": true}

---

Layer 4: RAG and retrieval security

Problem: Vector stores turn untrusted documents into trusted-looking context. Poisoned chunks cause indirect injection; cross-tenant leakage exposes other customers' data.

Controls:

• Ingest-time scanning and quarantine
• Retrieve-time re-screening before prompt assembly
• Tenant-scoped indexes and metadata filters
• Monitoring for anomalous retrieval patterns

Hub: RAG Security · Prevent RAG Prompt Injection · Secure Retrieved Documents · Vector Database Security · RAG Data Poisoning

RAG security spans input injection and data layers — treat it as a first-class architecture concern, not an afterthought on top of chat guardrails.

---

Layer 5: Output safety

Problem: Model completions are probabilistic and influenced by untrusted context. They may contain toxic content, phishing language, or executable markup.

Controls:

• Server-side output moderation on every user-visible completion
• Treat stored model output as untrusted input on every read path
• HTML sanitization and Content-Security-Policy for web UIs
• Streaming: buffer, screen assembled message, then deliver

Hub: What Is AI Output Moderation? · Moderate LLM Output · LLM Output as Untrusted Input · Prevent XSS from AI Content · AI Output Safety Checklist · Block vs Review

API pattern:

POST /api/v1/security/output-safety
{"text": "<assembled completion>"}

---

Layer 6: Guardrails orchestration

Problem: Individual checks are useless if placed wrong, duplicated inefficiently, or aggregated with inconsistent precedence.

Controls:

• Middleware at input, output, and action boundaries (LLM security middleware)
• Unified orchestration or parallel separate calls — measured in your environment
• Policy router: block > review > allow
• Fail-open vs fail-closed documented per surface

Hub: What Are AI Guardrails? · Add Guardrails to an LLM Application · Combine AI Security Guardrails · Input vs Output Guardrails · LLM Guardrails Checklist · AI Guardrails API · AI Security Gateway Architecture

Orchestration pattern:

POST /api/v1/guard
{
  "text": "...",
  "checks": ["prompt_injection", "pii_secrets", "output_safety"]
}

Parse decision, per-check findings, request_id, and usage_units — response design guide.

IdenticAPI is an API guard service your middleware calls — not a requirement to route all model traffic through a transparent proxy. You keep your model client and place hooks where your architecture needs them.

---

Layer 7: AI agents and tool security

Problem: Tool-using agents combine injection risk with excessive agency — sending email, modifying records, browsing the web, or executing destructive operations.

Controls:

• Tool allowlists (default deny)
• Structured action validation before execution
• Least-privilege credentials per agent class
• Human-in-the-loop for irreversible actions
• Scan outbound tool payloads for secrets

Hub: What Is AI Agent Security? · AI Agent Security Checklist · Excessive Agency · Least Privilege for Agents · Validate Tool Calls · Agent Policy Decisions · Runtime Security

API pattern:

POST /api/v1/security/agent-action
{
  "tool_name": "database",
  "action": "delete_rows",
  "arguments": { "table": "users", "filter": "..." }
}

---

Layer 8: MCP and external integrations

Problem: Model Context Protocol servers and third-party tools expand the attack surface — new credentials, network paths, and prompt injection via tool descriptions and results.

Controls:

• Authenticate MCP servers; network segmentation
• Tool permission models and scoped capabilities
• Screen tool outputs before re-prompting (tool output injection)
• Source/sink analysis for data flows

Hub: What Is MCP Security? · Secure MCP Servers · MCP Tool Permissions · MCP Prompt Injection · MCP Security Checklist

---

Layer 9: Provenance and media trust

Problem: Users cannot distinguish AI-generated from captured media; unsigned uploads carry no trustworthy origin signal.

Controls:

• Sign C2PA manifests on generated or edited exports
• Verify manifests server-side before trusting labels
• Do not treat missing credentials as proof of fakes

Hub: What Is C2PA? · Content Credentials · How C2PA Verification Works · Verify Content Credentials API · AI Image Provenance

Provenance complements safety guardrails — it addresses transparency and authenticity, not injection or XSS.

---

Layer 10: Operations — test, measure, respond

Problem: Models, prompts, corpora, and detectors change. Launch-day security decays without continuous measurement.

Controls:

• Pre-launch security testing checklist
• Production SaaS security checklist (quarterly)
• Labeled corpora; per-category precision/recall — no fabricated benchmarks
• request_id correlation across logs and support
• Incident runbooks and feature kill switches

Hub: LLM Security Testing Before Launch · AI Security Checklist for Production SaaS · Measure Guardrail Quality · Evaluate AI Guardrails · False Positives vs False Negatives · OWASP LLM Top 10 Developer Guide · Build vs Buy Guardrails

---

How layers interact (example: support chatbot)

A gap in any row is a plausible incident path.

---

Common anti-patterns

---

Choosing your implementation path

Teams differ in capacity and constraints:

See Build vs Buy AI Guardrails. Regardless of path, you own middleware placement, policy matrices, and incident response.

---

Minimum viable stack (by product type)

Read-only FAQ bot (low agency)

1. API auth + rate limits
2. Input injection scan
3. Output safety + safe rendering
4. Logging with request_id

RAG document assistant

Add: ingest/retrieve scanning, tenant-isolated vectors, PII on assembled prompt.

Customer support agent (tools)

Add: action guard, HITL, outbound secret scan, strict block on unsafe.

Media generation product

Add: provenance signing/verification, output safety on metadata and user-facing copy.

Expand using AI Security Checklist for Production SaaS — not this summary alone.

---

Response contract across the stack

Consistent fields simplify orchestration:

Details: AI Security API Response Design.

---

Summary

The production AI security stack is ten cooperating layers:

1. API security — auth, tenants, rate limits
2. Input security — prompt injection
3. Data protection — PII and secrets
4. RAG security — ingest, retrieve, isolate
5. Output safety — moderation and rendering
6. Guardrails orchestration — middleware and policy
7. Agent security — tools, actions, least privilege
8. MCP / integrations — extended attack surface
9. Provenance — media authenticity signals
10. Operations — test, measure, respond

No single layer is sufficient. No single vendor checkbox replaces architecture. Use the hub articles above for implementation depth in each domain — and treat this stack as the map that ties them together for production SaaS teams.