THE STARTING POINT
Three things to get right.
- Authorize every sensitive operation on the server.
- Validate model output before passing it into code or tools.
- Review dependencies and remove secrets from source and build output.
TRY THIS IN THE LAB
A question worth testing.
Review a toy AI-enabled API. Follow one request from authentication through data access and tool execution, checking authorization at every step.
Browse the lab notesLeave a useful trail.
Write down your starting assumptions, scope, expected behavior, observed behavior, and evidence. A successful test should explain what happened and which question to investigate next.