01
Identity & access
SSO/MFA where available, least privilege, separate service identities, controlled administrative access and joiner/mover/leaver processes.
Open reference architecture · vendor-neutral
Secure SME AI Architecture
A practical control model for introducing AI without giving a model unrestricted access to business data or systems. Adapt it to the organisation's actual risk, regulation and technology estate.
02
Application boundary
Keep the business application or workflow as the policy-enforcement point. Validate inputs, authorise actions and constrain tool access before model invocation.
03
AI gateway
Centralise provider configuration, model allow-lists, rate limits, redaction, request logging and policy checks instead of scattering direct model calls across applications.
04
Data boundary
Classify data before use. Minimise prompts, separate sensitive stores, encrypt data in transit/at rest and define retention rules for prompts, responses and embeddings.
05
Retrieval & tools
Use scoped retrieval, permission-aware indexes and narrowly defined tools. Treat retrieved content and tool output as untrusted input.
06
Human control
Require human review for consequential decisions, external communications, irreversible actions and low-confidence or policy-sensitive outputs.
07
Observability
Record model/provider/version, policy outcome, latency, cost, errors and appropriate audit events without logging unnecessary secrets or personal data.
08
Resilience
Define fallback behaviour for provider outage, quota exhaustion, unsafe output, unavailable tools and degraded retrieval. AI failure must not silently become business-process failure.
Security design principles
Assume model output can be wrong, retrieved content can be hostile, credentials can be over-privileged and providers can become unavailable. Keep deterministic controls outside the model, minimise data exposure, make high-impact actions reversible where possible, and preserve human accountability.