A concise research note for extending cloud threat models around production AI workloads.
Follow the action path
Start with what the application can cause, not only what the model can produce. Map each tool call, queue, function, data store, and human approval that turns output into an effect.
Separate data roles
Training, retrieval, evaluation, conversation, and operational telemetry serve different purposes. Give each a named owner, provenance expectation, retention decision, and permitted set of consumers.
Questions for the review
Ask questions that connect model behavior to cloud control evidence.
- Which identity performs retrieval?
- Where are tool arguments logged?
- Can an operator replay a sensitive request?
- What stops output from invoking an unintended action?