knowyourailive
Guide

A chatbot or support assistant

Draft, not yet reviewed

What you are building

You are adding a model-backed conversation to your product so users can ask questions or get support. The first boundary is the path from a user's message through your server to the reply you render.

Where untrusted text gets in

  • User messages, including instructions to change the assistant's job or repeat its prompt.
  • Earlier conversation turns that remain in context during a later request.
  • Model output that your interface treats as HTML, markdown, images or links.
  • Prompts and tool arguments copied into local logs or a tracing service.

What it can do if it goes wrong

  • Spend provider budget through an unprotected endpoint or a request with unbounded work.
  • Expose a key bundled into the client or a credential placed in the system prompt.
  • Drift away from the assistant's declared job over several turns.
  • Trigger a request to an unapproved host through rendered output, or copy personal data into traces.

Know the limit

These minimum controls cover the basic conversation path. If the assistant retrieves customer documents, calls tools or writes memory, follow those build pages as well. A model that answers ordinary support questions correctly has not established those additional boundaries.

Minimum controls

  1. Keep model API keys off the client

    10 min

    Model API keys live only on the server, use separate environments and never appear in the built client or repository.

  2. Cap spend and rate-limit every AI endpoint

    15 min

    AI endpoints require authentication, limit each user and IP, and cap input, output, agent iterations and tool calls.

  3. Assume your system prompt will leak

    10 min

    System prompts contain no keys, internal URLs or credentials, and security rules are enforced in code.

  4. Render model output as untrusted

    30 min

    Model output cannot inject active HTML or load images and links from unapproved hosts, and model-written URLs are never fetched automatically.

  5. Keep the assistant on its job

    30 min

    The assistant's job and prohibited actions are explicit, tested across turns and backed by code-level checks for high-impact tools.

  6. Log enough to investigate, without leaking

    30 min

    Traces record request IDs, user IDs, tool calls and decisions, redact secrets and personal data before writing, and have restricted access and retention.