# AI Security Handbook by Harmonic Security ## AI Sec Handbook - [AI Security Handbook](https://handbook.harmonic.security/ai-security-handbook.md): Harmonic Security’s practical AI security handbook for governing AI tools, agents, MCP, data protection, runtime controls, and incident response. - [What is AI Security?](https://handbook.harmonic.security/start-here/what-is-ai-security.md): A plain-language scope for AI security in this handbook: helping security practitioners roll out AI tools, agents, connectors, and data access safely across the business. - [How to Use This Handbook](https://handbook.harmonic.security/start-here/how-to-use-this-handbook.md): A guide for security practitioners on navigating the AI Sec Handbook - how articles are structured, what the depth labels mean, and where to start based on your deployment model. - [Security Team Checklist](https://handbook.harmonic.security/start-here/security-team-checklist.md): A practical checklist for security teams deploying AI tools across identity, data, runtime, supply chain, observability, and rollout. - [Glossary](https://handbook.harmonic.security/start-here/glossary.md): Plain-language definitions of every technical term used across the AI Sec Handbook, from AI agent and MCP to vibe coding and Zero Data Retention. - [Anthropic](https://handbook.harmonic.security/by-ai-vendor/anthropic.md): Security configuration, governance controls, and risk guidance for Claude Cowork, Claude Code, and Claude Tag. - [Claude Cowork](https://handbook.harmonic.security/by-ai-vendor/anthropic/claude-cowork.md): Security guidance for Claude Cowork, including workspace access, connectors, browser use, approvals, data handling, and agent activity evidence. - [Claude Code](https://handbook.harmonic.security/by-ai-vendor/anthropic/claude-code.md): Security guidance for Claude Code, including identity, MCP servers, hooks, filesystem access, sandboxing, approvals, telemetry, and incident response. - [Claude Tag](https://handbook.harmonic.security/by-ai-vendor/anthropic/claude-tag.md): Security guidance for Claude Tag, including identity, deployment scope, data handling, integrations, user access, monitoring, and evidence collection. - [OpenAI](https://handbook.harmonic.security/by-ai-vendor/openai.md): Security configuration, governance controls, and risk guidance for ChatGPT Work and ChatGPT Codex. - [ChatGPT Work](https://handbook.harmonic.security/by-ai-vendor/openai/chatgpt-work.md): Security guidance for ChatGPT Work, including managed workspace use, connectors, browser and Computer Use policy, scheduled work, artifacts, sandbox boundaries, and evidence gaps. - [ChatGPT Codex](https://handbook.harmonic.security/by-ai-vendor/openai/chatgpt-codex.md): Security guidance for ChatGPT Codex across desktop, CLI, IDE, cloud, SDK, and automation workflows, including sandboxing, hooks, OpenTelemetry, approvals, network access, and evidence. - [1. Identity & Access](https://handbook.harmonic.security/handbook/1.-identity-and-access.md): How to manage human and non-human identity across AI platforms, including SSO, SCIM, RBAC, tenant restrictions, domain claiming, and agent service accounts. - [1.1 SSO & SCIM for AI platforms](https://handbook.harmonic.security/handbook/1.-identity-and-access/1.1-sso-and-scim-for-ai-platforms.md): Force managed login and automate lifecycle provisioning so AI platform access follows your joiners, movers, and leavers process. - [1.2 RBAC across AI platforms](https://handbook.harmonic.security/handbook/1.-identity-and-access/1.2-rbac-across-ai-platforms.md): How each vendor exposes roles and permissions, and how to design access models that grant the right capabilities without over-granting. - [1.3 Tenant restrictions: blocking personal accounts](https://handbook.harmonic.security/handbook/1.-identity-and-access/1.3-tenant-restrictions-blocking-personal-accounts.md): How to block personal AI accounts using tenant restrictions, organization headers, proxies, browser controls, detection, and exception handling. - [1.4 Domain claiming: bringing shadow accounts into enterprise](https://handbook.harmonic.security/handbook/1.-identity-and-access/1.4-domain-claiming-bringing-shadow-accounts-into-enterprise.md): How to identify and migrate accounts using your verified corporate domain into a managed enterprise workspace. - [1.5 Agent and non-human identity](https://handbook.harmonic.security/handbook/1.-identity-and-access/1.5-agent-and-non-human-identity.md): How to give AI agents scoped, attributable identities instead of borrowed human credentials. - [1.6 API keys and service accounts governance](https://handbook.harmonic.security/handbook/1.-identity-and-access/1.6-api-keys-and-service-accounts-governance.md): How to keep personal keys out of automation and scope, rotate, monitor, and attribute machine access properly. - [1.7 Human-in-the-loop and approval policies](https://handbook.harmonic.security/handbook/1.-identity-and-access/1.7-human-in-the-loop-and-approval-policies.md): Where to require human approval in agentic workflows and how approvals can fail under prompt injection, fatigue, or unsafe defaults. - [2. Supply Chain & Extensibility](https://handbook.harmonic.security/handbook/2.-supply-chain-and-extensibility.md): How to govern connectors, MCP servers, plugins, skills, extensions, hooks, and agent frameworks as a software supply chain with real attack surface. - [2.1 Connectors and apps: the integration backbone](https://handbook.harmonic.security/handbook/2.-supply-chain-and-extensibility/2.1-connectors-and-apps-the-integration-backbone.md): Every connector is standing authenticated access to a real system — how to approve, scope, monitor, and review them. - [2.2 MCP servers: securing the protocol](https://handbook.harmonic.security/handbook/2.-supply-chain-and-extensibility/2.2-mcp-servers-securing-the-protocol.md): Local and remote MCP servers are both attack surfaces — treat every server like a software dependency with permissions and update risk. - [2.3 MCP gateways and allowlisting](https://handbook.harmonic.security/handbook/2.-supply-chain-and-extensibility/2.3-mcp-gateways-and-allowlisting.md): How to centralize which MCP servers exist and who can reach them so users cannot freely add unreviewed tools. - [2.4 Analyzing skills for risk](https://handbook.harmonic.security/handbook/2.-supply-chain-and-extensibility/2.4-analyzing-skills-for-risk.md): Skills and instruction bundles can encode trusted behavior — how to review the full package, dependencies, permissions, and sharing path before use. - [2.5 Plugins and marketplaces](https://handbook.harmonic.security/handbook/2.-supply-chain-and-extensibility/2.5-plugins-and-marketplaces.md): Plugins and marketplaces bundle skills, connectors, agents, extensions, and actions — how to curate distribution and review updates like code. - [2.6 AI hooks: inference controls and lifecycle automation](https://handbook.harmonic.security/handbook/2.-supply-chain-and-extensibility/2.6-ai-hooks-inference-controls-and-lifecycle-automation.md): How AI hooks work, which products support them, how Anthropic's inference hooks differ from lifecycle hooks, and how to use hooks for narrow control and useful runtime evidence. - [2.7 The supply-chain review workflow](https://handbook.harmonic.security/handbook/2.-supply-chain-and-extensibility/2.7-the-supply-chain-review-workflow.md): A repeatable intake process covering allowlist, owner, scopes, credential handling, runtime permissions, update path, and review date for every AI extension. - [2.8 Signing and packaging](https://handbook.harmonic.security/handbook/2.-supply-chain-and-extensibility/2.8-signing-and-packaging.md): How to prefer signed, centrally versioned, and managed packages over hand-deployed binaries or ad hoc local extensions. - [2.9 SaaS agent-building supply-chain](https://handbook.harmonic.security/handbook/2.-supply-chain-and-extensibility/2.9-saas-agent-building-supply-chain.md): How to govern the connectors, actions, triggers, and data sources that non-security staff wire together in Copilot Studio and similar low-code builders. - [2.10 Hosted-agent framework dependencies](https://handbook.harmonic.security/handbook/2.-supply-chain-and-extensibility/2.10-hosted-agent-framework-dependencies.md): How to secure hosted-agent dependencies across SDKs, tools, MCP servers, prompts, models, containers, deployment pipelines, and runtime services. - [3. Runtime, Sandbox & Autonomy](https://handbook.harmonic.security/handbook/3.-runtime-sandbox-and-autonomy.md): How to contain what AI agents can do at runtime — sandbox isolation, network egress, browser access, filesystem scope, approvals, and scheduled task governance. - [3.1 What Even is an AI Sandbox?](https://handbook.harmonic.security/handbook/3.-runtime-sandbox-and-autonomy/3.1-what-even-is-an-ai-sandbox.md): What AI sandboxes give you, which AI work products support them, and how security teams should configure, test, and evidence the boundary. - [3.2 Approval policies and least-privilege autonomy](https://handbook.harmonic.security/handbook/3.-runtime-sandbox-and-autonomy/3.2-approval-policies-and-least-privilege-autonomy.md): How to tune how much an agent can do without asking, based on posture, data sensitivity, user role, and task risk. - [3.3 Network egress control](https://handbook.harmonic.security/handbook/3.-runtime-sandbox-and-autonomy/3.3-network-egress-control.md): Why default-deny outbound access with administrator-owned allowlists is safer than broad internet access for AI agents. - [3.4 Internet access and browser automation](https://handbook.harmonic.security/handbook/3.-runtime-sandbox-and-autonomy/3.4-internet-access-and-browser-automation.md): Browser agents operate near the user’s signed-in sessions, so controls must cover page context, blocklists, per-site approval, and browser bridges. - [3.5 Computer Use / desktop control risks](https://handbook.harmonic.security/handbook/3.-runtime-sandbox-and-autonomy/3.5-computer-use-desktop-control-risks.md): Screen-and-click control can see and act across desktop apps, creating risks that differ from sandboxed code execution. - [3.6 Scheduled and background tasks](https://handbook.harmonic.security/handbook/3.-runtime-sandbox-and-autonomy/3.6-scheduled-and-background-tasks.md): Unattended agent runs execute without a human watching, so they need stricter controls than interactive sessions. - [3.7 Remote access, dispatch and SSH](https://handbook.harmonic.security/handbook/3.-runtime-sandbox-and-autonomy/3.7-remote-access-dispatch-and-ssh.md): Mobile-to-desktop bridges, remote dispatch, and SSH can let remote triggers drive local tools and files, expanding the attack surface. - [3.8 File and filesystem access controls](https://handbook.harmonic.security/handbook/3.-runtime-sandbox-and-autonomy/3.8-file-and-filesystem-access-controls.md): How to scope which folders an agent can read and write, and how to keep home directories, secrets, and cloud-synced roots out of default access. - [3.9 Central hosted-agent runtime hardening](https://handbook.harmonic.security/handbook/3.-runtime-sandbox-and-autonomy/3.9-central-hosted-agent-runtime-hardening.md): For agents you run yourself on frameworks or cloud platforms — container isolation, egress, secrets, tool sandboxing, and audit are yours to own end-to-end. - [4. Data Protection & Residency](https://handbook.harmonic.security/handbook/4.-data-protection-and-residency.md): How to control sensitive data in AI prompts, outputs, files, tools, and agent actions — including DLP, classification, residency, retention, and secrets hygiene. - [4.1 DLP for GenAI](https://handbook.harmonic.security/handbook/4.-data-protection-and-residency/4.1-dlp-for-genai.md): How to detect and control sensitive data moving into prompts, files, tools, connectors, and outputs where classic DLP often lacks visibility. - [4.2 Data classification for AI prompts and outputs](https://handbook.harmonic.security/handbook/4.-data-protection-and-residency/4.2-data-classification-for-ai-prompts-and-outputs.md): Which data classes may touch which AI tools and how to enforce the matrix technically across browsers, endpoints, APIs, and agents. - [4.3 Data residency and regional inference](https://handbook.harmonic.security/handbook/4.-data-protection-and-residency/4.3-data-residency-and-regional-inference.md): How to keep AI processing in-region using cloud model hosting and vendor-specific regional controls rather than assuming a plan setting solves residency. - [4.4 Retention and Zero Data Retention](https://handbook.harmonic.security/handbook/4.-data-protection-and-residency/4.4-retention-and-zero-data-retention.md): Where conversations, prompts, files, logs, and tool data live, for how long, and what Zero Data Retention does and does not cover. - [4.5 Training opt-out and data usage](https://handbook.harmonic.security/handbook/4.-data-protection-and-residency/4.5-training-opt-out-and-data-usage.md): How to confirm whether prompts, files, connector data, and feedback are used for model improvement across consumer, business, enterprise, and API plans. - [4.6 Cross-app data flow and live artifacts](https://handbook.harmonic.security/handbook/4.-data-protection-and-residency/4.6-cross-app-data-flow-and-live-artifacts.md): How to control AI data moving through apps, connectors, generated artifacts, shared links, publishing workflows, and downstream systems. - [4.7 Secrets and credential hygiene in prompts and tools](https://handbook.harmonic.security/handbook/4.-data-protection-and-residency/4.7-secrets-and-credential-hygiene-in-prompts-and-tools.md): How to keep secrets out of prompts, files, tool parameters, shell history, logs, telemetry, and model-visible context. - [5. Threats & Adversarial](https://handbook.harmonic.security/handbook/5.-threats-and-adversarial.md): The attack patterns unique to AI systems — prompt injection, tool-based exfiltration, supply-chain compromise, tool poisoning, confused deputy, and AI red-team response. - [5.1 Prompt injection: the connective risk](https://handbook.harmonic.security/handbook/5.-threats-and-adversarial/5.1-prompt-injection-the-connective-risk.md): Direct and indirect prompt injection runs through every other AI security risk — how it works, where it comes from, and how to test for it. - [5.2 Data exfiltration via tools and connectors](https://handbook.harmonic.security/handbook/5.-threats-and-adversarial/5.2-data-exfiltration-via-tools-and-connectors.md): The injection-to-egress chain uses legitimate tools to move data out, making egress allowlists, connector scoping, and approvals key choke points. - [5.3 Supply chain attacks and notable CVEs](https://handbook.harmonic.security/handbook/5.-threats-and-adversarial/5.3-supply-chain-attacks-and-notable-cves.md): AI supply-chain attack patterns and CVEs involving repositories, MCP configurations, packages, extensions, hooks, clients, and agent runtimes. - [5.4 Agent-specific threats: tool poisoning and confused deputy](https://handbook.harmonic.security/handbook/5.-threats-and-adversarial/5.4-agent-specific-threats-tool-poisoning-and-confused-deputy.md): Threats unique to tool-using agents include poisoned tool descriptions, misleading instructions, overbroad credentials, and confused-deputy privilege abuse. - [5.5 Red-teaming AI systems](https://handbook.harmonic.security/handbook/5.-threats-and-adversarial/5.5-red-teaming-ai-systems.md): A repeatable program to probe injection, exfiltration, destructive actions, permission abuse, tool misuse, and unsafe agent autonomy across your AI deployment. - [5.6 Incident response for AI system](https://handbook.harmonic.security/handbook/5.-threats-and-adversarial/5.6-incident-response-for-ai-system.md): An AI incident response runbook covering tokens, API keys, MCP grants, apps, connectors, automations, browser permissions, desktop access, and hooks. - [5.7 Threat modeling AI systems](https://handbook.harmonic.security/handbook/5.-threats-and-adversarial/5.7-threat-modeling-ai-systems.md): A lightweight method to threat-model an AI workflow before enabling it, covering surface enumeration, trust boundaries, data flows, tools, and failure modes. - [6. Observability, Audit & Evidence](https://handbook.harmonic.security/handbook/6.-observability-audit-and-evidence.md): What security teams can and cannot see across AI platforms — compliance APIs, usage logs, OpenTelemetry, SIEM routing, investigation paths, and review cadence. - [6.1 The audit gap: what you can and can't see](https://handbook.harmonic.security/handbook/6.-observability-audit-and-evidence/6.1-the-audit-gap-what-you-can-and-cant-see.md): Every AI platform has blind spots, and knowing exactly what each platform’s logs miss is the difference between a real control and an assumption. - [6.2 OpenTelemetry for AI runtime visibility](https://handbook.harmonic.security/handbook/6.-observability-audit-and-evidence/6.2-opentelemetry-for-ai-runtime-visibility.md): How to use OpenTelemetry for AI runtime visibility across Work, Cowork, Codex, Claude Code, Copilot, Grok, and adjacent evidence sources. - [6.3 Compliance APIs by platform](https://handbook.harmonic.security/handbook/6.-observability-audit-and-evidence/6.3-compliance-apis-by-platform.md): The programmatic audit endpoint per vendor, what each one returns, and exactly where each one stops. - [6.4 Analytics and usage APIs](https://handbook.harmonic.security/handbook/6.-observability-audit-and-evidence/6.4-analytics-and-usage-apis.md): Adoption, cost, and usage telemetry help spot shifts in AI behavior, tool adoption, connector usage, and spend anomalies. - [6.5 Routing AI telemetry to your SIEM](https://handbook.harmonic.security/handbook/6.-observability-audit-and-evidence/6.5-routing-ai-telemetry-to-your-siem.md): How to get compliance APIs, usage logs, and runtime telemetry into the SOC with starter detections for AI-specific events. - [6.6 Evidence by surface and investigation paths](https://handbook.harmonic.security/handbook/6.-observability-audit-and-evidence/6.6-evidence-by-surface-and-investigation-paths.md): Which log answers which question, per AI surface — the reference table you reach for during an AI security incident. - [6.7 Continuous review cadence](https://handbook.harmonic.security/handbook/6.-observability-audit-and-evidence/6.7-continuous-review-cadence.md): The monthly, weekly, and quarterly rhythm that keeps AI security controls from drifting as tools and capabilities evolve. - [7. Rollout & Operations](https://handbook.harmonic.security/handbook/7.-rollout-and-operations.md): How to deploy AI tools safely by risk phase, design pilots, measure adoption and control effectiveness, and maintain AI governance over time. - [7.1 Roll out by risk: the phased plan](https://handbook.harmonic.security/handbook/7.-rollout-and-operations/7.1-roll-out-by-risk-the-phased-plan.md): Four phases from inventory and ownership through pilot, controlled expansion, and steady-state operations — the sequence that avoids governance gaps. - [7.2 Pilot design and success metrics](https://handbook.harmonic.security/handbook/7.-rollout-and-operations/7.2-pilot-design-and-success-metrics.md): What a good AI security pilot looks like, how to select cohorts, and how to know whether controls worked before widening rollout. - [7.3 The security team checklist](https://handbook.harmonic.security/handbook/7.-rollout-and-operations/7.3-the-security-team-checklist.md): A keep-it-by-your-desk checklist across identity, runtime, browser, desktop, supply chain, cloud, data, and audit controls. - [7.4 The vendor-neutral control matrix](https://handbook.harmonic.security/handbook/7.-rollout-and-operations/7.4-the-vendor-neutral-control-matrix.md): One matrix mapping every control to deployment model and posture so readers can apply the handbook to any AI surface. - [Governance & Frameworks](https://handbook.harmonic.security/reference/governance-and-frameworks.md): Frameworks, regulations, and program-level guidance for enterprise AI security - covering NIST AI RMF, NIST CSF 2.0, EU AI Act, DORA, ISO 42001, acceptable use policy, and ownership models. - [G.1 Map your controls to NIST AI RMF and CSF 2.0](https://handbook.harmonic.security/reference/governance-and-frameworks/g.1-map-your-controls-to-nist-ai-rmf-and-csf-2.0.md): The backbone mapping every AI security control family to NIST AI RMF GOVERN, MAP, MEASURE, and MANAGE and NIST CSF 2.0 functions. - [G.2 EU AI Act obligations for deployers](https://handbook.harmonic.security/reference/governance-and-frameworks/g.2-eu-ai-act-obligations-for-deployers.md): EU AI Act obligations for enterprise deployers, including classification, human oversight, monitoring, logging, transparency, and evidence. - [G.3 DORA and AI resilience in financial services](https://handbook.harmonic.security/reference/governance-and-frameworks/g.3-dora-and-ai-resilience-in-financial-services.md): ICT risk management, third-party risk, operational resilience testing, and incident reporting applied to AI vendors, agents, and model-hosting platforms under DORA. - [G.4 Colorado AI Act and the US state patchwork](https://handbook.harmonic.security/reference/governance-and-frameworks/g.4-colorado-ai-act-and-the-us-state-patchwork.md): Colorado’s 2026 ADMT law, consequential-decision disclosures, consumer rights, and the emerging multi-state AI regulation picture. - [G.5 SANS Critical AI Security Guidelines mapping](https://handbook.harmonic.security/reference/governance-and-frameworks/g.5-sans-critical-ai-security-guidelines-mapping.md): How the handbook controls map to the SANS Critical AI Security Guidelines for a practitioner-first cross-check. - [G.6 Write an AI Acceptable Use Policy that holds up](https://handbook.harmonic.security/reference/governance-and-frameworks/g.6-write-an-ai-acceptable-use-policy-that-holds-up.md): A reusable AUP template covering approved tools, data classes, personal accounts, connectors, agents, coding tools, mobile apps, and incident duties. - [G.7 Ownership and RACI for AI security](https://handbook.harmonic.security/reference/governance-and-frameworks/g.7-ownership-and-raci-for-ai-security.md): Names the owners across workspace admin, platform admin, security policy, endpoint, compliance, legal, privacy, procurement, and incident response. - [G.8 ISO/IEC 42001 AI management system](https://handbook.harmonic.security/reference/governance-and-frameworks/g.8-iso-iec-42001-ai-management-system.md): How the handbook supports an AI management system certification effort with clause mapping, control ownership, and evidence artifacts. - [G.9 HIPAA controls for AI systems handling PHI](https://handbook.harmonic.security/reference/governance-and-frameworks/g.9-hipaa-controls-for-ai-systems-handling-phi.md): HIPAA security and privacy controls for AI systems handling PHI, including BAAs, access, data flows, de-identification, evidence, and incident response. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on a page URL with the `ask` query parameter: ``` GET https://handbook.harmonic.security/ai-security-handbook.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.