47 Checks
Your AI Architecture Either Passes or It Doesn't
Your AI product needs a security review before it ships. This checklist covers 47 specific things auditors, pen testers, and enterprise buyers look for, organized into 8 categories, with every item rated Critical, High, Medium, or Low and a release gate that says what must pass before launch.
Version 3.0, updated 19 October 2026. Instant download by email after payment. Licensed to one organization, every employee included. Licence terms. 14-day refund, any reason. How refunds work. Download a sample (PDF), the opening pages of one document.
Why AI Architecture Reviews Get Skipped
Traditional security reviews are designed for traditional software. They check whether encryption is in place, whether authentication is properly implemented, whether logging covers the right events. Those checks still matter for AI systems - but they cover maybe half the attack surface. The other half is specific to how AI systems are built: how models are integrated, how prompts are constructed, how outputs are validated, and how tenants are isolated when they share model endpoints.
Most teams shipping AI products have never done an AI-specific security review. Pen tests catch infrastructure vulnerabilities. Dependency scans catch known CVEs. Neither catches a tenant isolation failure in a shared embedding database, a system prompt that leaks via jailbreak, or an agent that executes arbitrary code because output wasn't validated before being passed to a code interpreter.
The 47 checks in this kit cover what auditors, enterprise buyers, and penetration testers will evaluate when they look at your AI architecture: prompt injection, tenant data isolation, output validation, tool permissions, model version pinning and rollback, fallback for model outages, and secrets handling. They are organized into 8 categories with a severity rating on every item, so you know which gaps to close first.
Run it before a pen test to fix the obvious issues first. Run it before an enterprise security review to know your gaps before they tell you. Run it quarterly as your architecture evolves.
8 Categories. 47 Specific Checks.
Each check states what to look for, how to test it, the evidence to keep, why it carries its severity, and the entries of the OWASP Top 10 for LLM Applications (2025) and for Agentic Applications (2026) that it addresses.
Data Flow & Privacy: 7 Checks
Is there a diagram of every path customer data takes? Do you send the model only the fields it needs? Is PII classified before it enters the pipeline? Is customer data kept out of model training, by contract and in code?
Tenant Isolation: 6 Checks
Is prompt context assembled per tenant? Are RAG queries, conversation memory, caches, and embedding namespaces scoped to the tenant? Has cross-tenant leakage been tested, not assumed?
Input Security: 7 Checks
Are input length limits and rate limits enforced? Are system prompts injected server-side and delimited from user input? Are uploaded files and external content treated as untrusted (indirect prompt injection)?
Output Security: 6 Checks
Are content safety filters and PII detection applied to outputs? Are structured outputs validated against a schema? Is generated code screened? Do output size limits prevent token and cost abuse?
Tool/Function Calling: 5 Checks
Does each tool have least-privilege permissions? Do high-risk actions need human approval? Are tool outputs validated, tool calls logged with tenant context, and errors kept from leaking system details?
Model Management: 5 Checks
Are model versions pinned rather than "latest"? Do model changes follow change management? Has rollback been tested? Is fallback behavior defined for model outages? Are cost alerts set for runaway API usage?
Monitoring & Logging: 6 Checks
Is every model interaction logged with tenant, timestamp, model, and tokens? Are prompt logs access-controlled as customer data? Is there anomaly detection, alerting on safety filter triggers, a user flagging mechanism, and cost monitoring?
Authentication & Authorization: 5 Checks
Are AI API keys in a secrets manager and rotated on schedule? Are AI admin interfaces behind MFA? Is system prompt access limited to authorized roles? Is the user authenticated before any AI processing?
Built for Teams Shipping AI Products
If someone told you "make it SOC 2 ready" or "prepare for a security review," start here.
Engineering Leads
You built the AI feature. Now someone wants a security review. This checklist tells you exactly what they'll ask and what "good" looks like for each item.
Security Teams
Your company shipped an AI product and you need to audit it. The checklist covers AI-specific attack vectors that traditional security reviews miss.
CTOs Preparing for Reviews
An enterprise prospect wants a security assessment of your AI product. Check yourself first so you know where you stand before they do.
47 checks. 8 categories. Know exactly where you stand.
- 47-item checklist across 8 security categories
- What to look for, how to test it, and the evidence to keep, on every check
- Severity rating on every item (Critical, High, Medium, Low) with the reason for it
- Mapping to the OWASP Top 10 for LLM Applications (2025) and for Agentic Applications (2026), in both directions
- Release gate: all Critical items pass, no more than 2 High items deferred
- Excel review tracker: result drop-downs, evidence and owner columns, severity counts, and the outcome computed
- Review summary with a sign-off recommendation (approved, approved with conditions, or blocked)
- Single-organization commercial license
Instant download. One Word document (.docx) and one Excel review tracker (.xlsx). Version 3.0, 19 October 2026.
Questions
Is this a pass/fail test?
Yes, with a severity on every item. Each of the 47 checks is pass/fail and rated Critical (10), High (20), Medium (16), or Low (1). The review summary sets the release gate: every Critical item must pass, no more than 2 High items may be deferred, and Medium items go to the backlog. It ends with a recommendation: approved, approved with conditions, or blocked. Every check also states what to look for, how to test it, and the evidence to keep, and the Excel tracker computes the gate from your Pass, Fail, and NA entries.
How long does it take?
It depends on the size of the system. Some checks require inspecting code or infrastructure configs. The checklist is designed to be completed in a single working session, not spread across weeks.
Does this replace a pen test?
No. This is a self-assessment that identifies gaps before a pen test finds them for you. Use this to fix the obvious issues first, then bring in a pen tester to validate and find what you missed.
Should we run this before or after building?
Ideally both. Run it at architecture review stage (before building) to validate your design decisions. Run it again before launch to catch implementation gaps. The checklist is structured to be useful at both stages - some checks evaluate design decisions, others evaluate implementation specifics that only exist after you've built the system.
How often should we re-run it?
Quarterly, or whenever you make significant architecture changes - adding a new AI capability, switching model providers, adding multi-tenant features, integrating retrieval-augmented generation. The 8-category structure lets you scope the review to just the areas that changed rather than running all 47 checks every time.
Is this relevant for AI features, not just standalone AI products?
Yes. Whether you've built an AI-native product or added AI features to an existing application, the security considerations are the same. Prompt injection, tenant isolation, and output validation are just as relevant to a copilot feature in a SaaS product as they are to a standalone AI assistant. The checklist works for both architectures.
David A. Moline, CISSP | CISM
Your AI automation, built by someone who secures DoD systems.
Find Your Gaps Before Your Auditor Does
47 checks. A severity on every gap and a clear release gate. Know exactly where your AI architecture stands.