> For the complete documentation index, see [llms.txt](https://handbook.harmonic.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://handbook.harmonic.security/start-here/how-to-use-this-handbook.md).

# How to Use This Handbook

A guide for security practitioners on navigating the AI Sec Handbook - how articles are structured, what the depth labels mean, and where to start based on your deployment model.

*Last reviewed: August 18, 2026*

{% hint style="info" %}
Use this handbook in two ways: start with the security task in front of you, or open the relevant vendor page when you already know the product. From there, use the control matrix and checklist to turn guidance into owned, testable controls.
{% endhint %}

Use 7.4 The vendor-neutral control matrix as the source of truth for deployment models and control applicability. What is AI Security? explains the access, execution, autonomy, and evidence dimensions that change risk.

## 1. Start with the task in front of you

| Situation                                           | Start here                                                                | Then do this                                                                                                                                     |
| --------------------------------------------------- | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| Rolling out an AI product                           | 7. Rollout & Operations                                                   | Confirm identity, data protection, runtime boundaries, and evidence paths before widening access.                                                |
| Assessing an existing deployment                    | 7.4 The vendor-neutral control matrix and 7.3 The security team checklist | Use 6.1 The audit gap, to test whether the expected evidence actually exists.                                                                    |
| Approving a connector, MCP server, skill, or plugin | 2. Supply Chain & Extensibility                                           | Apply 2.7 The supply-chain review workflow before enablement.                                                                                    |
| Enabling a tool or workflow that can take actions   | 3. Runtime, Sandbox & Autonomy                                            | Complete 5.7 Threat modeling AI systems and article 5.1 prompt-injection testing in 5. Threats & Adversarial.                                    |
| Handling sensitive or regulated data                | 4. Data Protection & Residency                                            | Check the applicable obligations in [Governance & Frameworks](/reference/governance-and-frameworks.md).                                          |
| Investigating an AI security incident               | 5. Threats & Adversarial                                                  | Start with 5.6 Incident response for AI systems, then use 6.6 Evidence by surface and investigation paths in 6. Observability, Audit & Evidence. |
| Reviewing a specific AI product                     | Open **By AI Vendor** in the sidebar                                      | Use the vendor page to find its relevant handbook controls and product-specific gaps.                                                            |

## 2. Turn guidance into evidence

A control is not complete because a setting exists. Use the same workflow for each control:

1. **Identify** the applicable control in the control matrix.
2. **Assign** a named owner for implementation and review.
3. **Configure and test** the control using the relevant handbook article.
4. **Record evidence**, including the configuration, test result, log source, and any approved exception.
5. **Reassess** after a significant product update, a newly enabled capability, or an incident.

## 3. Use vendor pages for implementation detail

The handbook articles define the required security outcome and explain why it matters. The **By AI Vendor** pages show where a vendor exposes the relevant settings, which products or plans they cover, and where gaps remain. Start with a vendor page when you already know the product, then return to the handbook articles for the cross-vendor control standard.

## Related handbook guidance

* [AI Security Handbook](/ai-security-handbook.md)
* [Security Team Checklist](/start-here/security-team-checklist.md)
* [7.4 The vendor-neutral control matrix](/handbook/7.-rollout-and-operations/7.4-the-vendor-neutral-control-matrix.md)
* [Governance & Frameworks](/reference/governance-and-frameworks.md)
* [Glossary](/start-here/glossary.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://handbook.harmonic.security/start-here/how-to-use-this-handbook.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.