Controls¶
This is where you choose the controls. Once you have threat modelled the system and sized its risk tier, this section gives you the control set to apply: the three-layer pattern, agentic and IAM controls, the reviewing layer (scanners, semantic firewall, model-as-judge), and the specialised controls particular deployments need. Select what fits the risk, adapt it to how your organisation works, and consciously deselect the rest.
Canonical home: airuntimesecurity.io
The runtime control definitions are maintained in depth on AI Runtime Security. These pages mirror that material so an architect can design the control set here and hand off to AIRS for runtime operation. Where the two differ, airuntimesecurity.io is authoritative.
Reading Order¶
Start with the essentials, then branch into specialised topics based on your deployment:
Essential (read in order): 1. Risk Tiers - classify your system 2. Risk Assessment - quantify control effectiveness and residual risk per tier 3. Controls - implement the three-layer pattern 4. Agentic - add controls if your agent has tool access 5. IAM Governance - identity, lifecycle, delegation 6. Judge Assurance - measure and calibrate the model-as-judge within the reviewing layer 7. Checklist - track implementation progress
Specialised (read based on your deployment type):
| If you're deploying... | Read |
|---|---|
| Multimodal models (image, audio, video) | Multimodal Controls |
| Reasoning models (chain-of-thought) | Reasoning Model Controls |
| Streaming responses | Streaming Controls |
| Persistent memory or long context | Memory and Context |
| Multi-agent systems | Multi-Agent Controls then MASO (Multi-Agent Security Operations) |
| Open-weight / self-hosted models | Open-Weight Models Shift the Burden |
PACE resilience (read after controls): - Control Layer Resilience - PACE for each control layer - PACE for Agentic AI - PACE for agentic deployments - PACE Checklist - verify your fail postures
The Fundamental Shift¶
Traditional software can be tested before deployment. AI cannot - not fully.
| Traditional Software | AI Systems |
|---|---|
| Deterministic outputs | Non-deterministic |
| Testable at design time | Emergent behavior |
| Known failure modes | Adversarial discovery |
The shift: From design-time assurance to runtime behavioral monitoring.
The Pattern¶
The industry is converging on three layers:
| Layer | Function | Timing |
|---|---|---|
| Guardrails | Block known-bad inputs/outputs deterministically | Real-time |
| Reviewing controls | Second opinion on unknown-bad: scanners, semantic firewall, model-as-judge | Inline and async |
| Human Oversight | Decide, act, remain accountable | As needed |
Guardrails prevent. Reviewing controls catch what they miss. Humans decide. Circuit breakers contain. The judge within the reviewing layer informs the decision; it never replaces the deterministic guardrails beneath it. The circuit breaker sits behind all three as containment, not a behavioural layer, tripping to a non-AI fallback when they are bypassed or overwhelmed, and maps to PACE Emergency.
Where This Pattern Exists¶
This isn't theoretical. Production implementations include:
| Platform | Implementation |
|---|---|
| NVIDIA NeMo Guardrails | Input, dialog, retrieval, execution, output rails |
| LangChain | Middleware + human-in-the-loop |
| Guardrails AI | Open-source validator framework |
| Galileo | Eval-to-guardrail lifecycle |
| DeepEval | Model-as-Judge evaluation |
| AWS Bedrock Guardrails | Managed filtering |
| Azure AI Content Safety | Content moderation |
What has been missing: clear guidance on why this pattern is necessary and how to implement it proportionate to risk, in a way that respects how each organisation actually works.
Scope¶
In: Custom LLM apps, AI decision support, document processing, agentic systems
Out: Vendor AI products, model training, data preparation
Quick Start¶
1. Classify Your System¶
| Tier | Profile | Examples |
|---|---|---|
| CRITICAL | Direct decisions, customer/financial/safety impact | Credit decisions, fraud blocking |
| HIGH | Significant influence, sensitive data | Customer service with account access |
| MEDIUM | Moderate impact, human review expected | Internal Q&A, document drafting |
| LOW | Minimal impact, non-sensitive | Public FAQ, suggestions |
2. Select Controls¶
| Control | LOW | MEDIUM | HIGH | CRITICAL |
|---|---|---|---|---|
| Input guardrails | Basic | Standard | Enhanced | Maximum |
| Output guardrails | Basic | Standard | Enhanced | Maximum |
| Reviewing controls | Scanners | Scanners + sampled judge | + Semantic firewall, inline judge | Full layer, inline on high-impact |
| Human review | Exceptions | Sampling | Risk-based | All significant |
3. Implement in Order¶
- Logging - Can't evaluate what you don't capture
- Basic guardrails - Block obvious attacks
- Reviewing controls in shadow mode - Scan and evaluate without action
- HITL queues - Somewhere for findings to go
- Operationalise - Act on findings, tune continuously
Core Documents¶
| Document | Purpose |
|---|---|
| Risk Tiers | Classification criteria, control mapping |
| Risk Assessment | Quantitative control effectiveness, residual risk analysis, worked examples per tier |
| Controls | Guardrails, reviewing controls, HITL implementation |
| Agentic | Additional controls for agents |
| IAM Governance | Identity governance, agent lifecycle, delegation, threats |
| Checklist | Implementation tracking |
| Emerging Controls | Multimodal, reasoning, streaming overview |
Specialized Controls¶
| Document | Purpose |
|---|---|
| Judge Assurance | Judge accuracy measurement and calibration |
| Multi-Agent Controls | Controls for multi-agent systems |
| Multimodal Controls | Controls for image, audio, and video AI |
| Memory and Context | Long context and persistent memory controls |
| Reasoning Model Controls | Controls for chain-of-thought reasoning models |
| Streaming Controls | Controls for real-time streaming outputs |
PACE Sections¶
| Document | Purpose |
|---|---|
| PACE Controls Section | PACE framework - controls |
| PACE Agentic Section | PACE framework - agentic controls |
| PACE Checklist Section | PACE framework - implementation checklist |
Architecture Overview¶
Key Principles¶
- Match controls to risk - Apply the right controls at the right time for the right purposes. Do not over-engineer low-risk systems
- Respect organisational context - Every organisation has its own structures and ways of working. Select and adapt controls accordingly
- Guardrails are necessary but not sufficient - They miss novel attacks and nuance
- The reviewing layer is assurance, not a hard gate - Scanners and the semantic firewall add deterministic and semantic checks; the model-as-judge informs the decision but is probabilistic and can be fooled, so it never replaces the deterministic guardrails beneath it
- Infrastructure beats instructions - Enforce technically, not via prompts
- Assume bypasses happen - Design for detection, not just prevention
- Humans remain accountable - AI assists; humans own outcomes