From prompt injection to policy: Building a practical AI control framework for RAG, Copilots and Agents

Most organisations now have AI principles, scattered guidance, and a growing list of AI risks. Far fewer have an implementable control model that security, architecture, engineering, data, and risk teams can actually use. As organisations deploy copilots, retrieval-augmented generation, AI-enabled workflows, and increasingly agentic systems, the gap is no longer awareness. The gap is translation: how to move from a long list of AI threats and fragmented external guidance to a practical set of controls that can be embedded in real operating environments.

This session presents an anonymised case study from a large, decentralised, research-intensive enterprise that needed to build a defensible AI cyber control framework across a complex ecosystem of users, data, platforms, and integration patterns. Rather than treating AI security as an abstract future concern, the work began by identifying the attack paths and failure modes that matter most in practice: prompt injection, retrieval poisoning, insecure tool use by agents, over-privileged integrations, data leakage through prompts and outputs, inference and API abuse, supply-chain compromise of models and components, and weak monitoring of AI-specific runtime behaviour.

The session then shows how overlapping guidance from multiple external sources was rationalised into a smaller, policy-ready control set that could actually be governed, implemented, and tested. Instead of leaving controls at the level of generic principles, the framework was organised into practical domains including governance, data and knowledge protection, identity and access, model and component supply chain, secure development, agent orchestration, integration control, runtime safeguards, monitoring, incident response, and third-party assurance. It was then mapped into an operating model spanning governance forums, architecture patterns, engineering controls, DevSecOps practices, logging and observability, and assurance activities.

A core theme of the talk is that AI changes not just the technology surface, but the control design problem. Traditional app security, cloud security, and data governance controls still matter, but they are not sufficient on their own when systems can ingest untrusted context, generate actions, invoke tools, and produce high-impact outputs at speed. Security teams therefore need a method for connecting AI-specific risks to implementation patterns that business, data, and engineering teams can understand and adopt.

Attendees will leave with a practical method for building their own AI control framework: how to prioritise the risks that matter, how to consolidate fragmented guidance, how to define control domains that are usable in policy and engineering, and how to align those controls to real delivery capabilities for copilots, RAG, GenAI SaaS, and agentic workflows. This is not a product pitch and not a speculative future-of-AI talk. It is a practitioner-focused session on how to turn AI risk into an operationally defensible control model now.