Chapter 21 — AI and machine-learning security: service integration
Lesson map
Lesson 21 published. Map, example, EX061.
flowchart TD
N0["Learning outcomes"]
N1["21.1 Platform integration"]
N2["21.2 Vendor APIs"]
N3["21.3 Multi-service and multi-agent"]
N4["21.4 Integration contracts"]
N5["21.4b Testing integrations"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX061"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["21.1 Platform integration"]
N2["21.2 Vendor APIs"]
N3["21.3 Multi-service and multi-agent"]
N4["21.4 Integration contracts"]
N5["21.4b Testing integrations"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX061"]
[Learning outcomes]
|
v
[21.1 Platform integration]
|
v
[21.2 Vendor APIs]
|
v
[21.3 Multi-service and multi-agent]
|
v
[21.4 Integration contracts]
|
v
[21.4b Testing integrations]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX061]
Learning outcomes
You will (1) integrate AI services with identity, logging and secrets platforms; (2) secure vendor model APIs; (3) handle multi-service and multi-agent integrations; and (4) review integration contracts.
21.1 Platform integration
AI services should use the same platforms as everything else: the company identity provider for users and service identities; the secrets manager for keys; central logging; the standard deployment pipeline. Special-case AI services drift out of security coverage. At Brightwell, Ask Brightwell now uses the company identity provider for delegated tokens, the secrets manager for the vendor key, the central log store and the standard pipeline. The marketing email writer, found outside the inventory, had none of these until Jonas's review brought it onto the same platforms.
21.2 Vendor APIs
Check: does the vendor use your data for training, and can you opt out? How long are prompts retained? Which region processes data? Can you pin model versions and get notice of changes? Are there spending limits? Store the key server-side; restrict it to needed models; set quotas. For the email writer integration, Jonas required zero-day retention at the vendor. For Ask Brightwell, he pins the model version so that a vendor update cannot change behaviour without passing the release gate first. Spending limits on the vendor account back up the daily token budget.
21.3 Multi-service and multi-agent
When one AI service calls another, treat the response as untrusted input. An injected instruction can travel from a document to agent A to agent B. Each service enforces its own policy on what it does, regardless of who asked. The email writer review applied this: Ask Brightwell's conversation text, which may contain injected instructions, would become the email writer's input. So the email writer enforces its own limits, sending only to the signed-in customer's verified address, whatever Ask Brightwell asks.
21.4 Integration contracts
Write down for each integration: data exchanged, format, validation rules, authentication, rate limits, error handling, and who to contact. Review contracts when either side changes. For the email writer integration, the contract records that Ask Brightwell sends a template ID and one short escaped field, that mail goes only to the verified address, the one-email rate limit, and contacts in marketing and Jonas's team. The email writer contract is the first written this way, and it now serves as Brightwell's template for later integrations.
21.4b Testing integrations
Add integration cases to the harness: plant instructions in the upstream service's input and check that the downstream service does nothing outside its contract. Test failure paths too — timeouts, malformed responses — and confirm that each side fails closed. For the email writer, Jonas's harness plants an instruction in a conversation asking for mail to an outside address and checks that nothing is sent. A timeout from the email service results in no email and a logged error, not a retry loop.
21.5 Worked example (synthetic Brightwell case)
Marketing wants Ask Brightwell to call their email writer to send follow-ups. Jonas reviews: the email writer would receive conversation text (untrusted) and could send mail to any address. He requires: the email tool only sends to the signed-in customer's verified address; content comes from a fixed template with model text limited to a short field that is escaped; rate limit one email per conversation; vendor data retention set to zero days. Each requirement limits what an injection could achieve even if it reaches the email writer. Sending only to the verified address prevents mail to strangers; the template and escaped field prevent arbitrary content; and the rate limit stops a single conversation from flooding a customer.
21.6 Errors and limits
- AI services outside standard platforms.
- Trusting another agent's output.
- Undocumented integrations.
The email writer showed all three before Jonas's review: it ran outside the standard platforms, it would have trusted Ask Brightwell's text, and no contract described the integration. Bringing it inside the inventory and the harness addressed each. An integration nobody documented is also one nobody tests when either side changes. Each integration now has a contract, an owner and a harness case, so a change on either side is tested before release.
Exercises
- EX061 — Vendor checklist. Write six vendor API checks. Rubric: 3 = six apt; 2 = four or five; 1 = two or three; 0 = fewer.
- EX062 — Agent chain. Explain how an injection could pass from a review to the email writer and how the email-writer controls stop it. Rubric: 3 = path plus each control's effect; 2 = path and one control; 1 = vague; 0 = none.
- EX063 — Contract. Write an integration contract for Ask Brightwell → email writer. Rubric: 3 = all seven elements; 2 = five; 1 = three; 0 = none.
Synthesis
Integrate AI services into standard platforms, treat every cross-service message as untrusted and document each integration's contract.
Continue studying — chapter 21 of 30
← Chapter 20 (draft) · Course chapter index · Chapter 22 (draft) →