What do we want to protect in an AI system

When we start reading about AI and agentic security, frameworks make for a good starting point. OWASP’s LLM Top 10 ranks the list of risks. MITRE ATLAS gives an attacker-behaviour catalogue with tactics describing what an adversary is trying to achieve and techniques describing how. Google’s SAIF provides a set of engineering and governance principles for securing AI systems, written from the perspective of an organisation that runs them at scale.

But in all of this, of what we were trying to protect. An AI system runs on something, learns from something, is something, consults things at runtime, is directed by something, acts with an identity, acts through tools, and produces output. Essentially, we are protecting every aspect of what is linked to the AI and Agentic system. So I am summarising these as follows –

1. Foundation — compute, GPU, network, storage, secrets management, serving runtime, MLOps pipelines
2. Training and tuning data — corpora, fine-tuning sets, preference data, labels, evaluation sets
3. Model artifacts — weights, adapters, quantised copies, embedding models, registry entries
4. Knowledge stores — RAG corpora, vector indexes, retrieval configuration
5. Memory — session state, persistent user memory, scratchpads, shared agent memory
6. Instructions — system prompts, templates, agent configuration, guardrail rules
7. Agent logic — planners, reasoning loops, task decomposition, multi-agent topology
8. Tools and integrations — MCP servers, plugins, function definitions, execution environments
9. Identity and credentials — agent identities, tokens, OAuth grants, delegation chains, scopes
10. Outputs and actions — generated content, consequential tool calls, logs, provenance markings

SAIF names four areas — Data, Infrastructure, Model and Application as the components of a developing an AI system. SAIF’s risks also directly map to it. An Agent obviously sits inside the Application in SAIF. Today, Agents are becoming more and more anonymous. An agentic system does a lot of interesting work: consulting knowledge and memory, following instructions, planning, acting with a credential, acting through tools, producing effects. So, the framework zooms in on the Application asset part. A direct mapping of SAIF and the laid out asset classes looks like this.

Have tested a number of different assets and they do fit in with in the ten asset classes. More on that later once the framework is fully introduced.

An asset tells you what is exposed, not when the exposure becomes damage. Poisoned training data fires at inference. A planted document fires at retrieval. A written memory fires next session. We look at the security lifecycle of the AI system next.