LLM security is a threat surface map, not a prompt tip

Prompt injection gets the headlines. Real products fail because nobody drew the trust boundaries: who can write context, which tools can run, what secrets land in the sandbox, and how output re-enters privileged paths.

A working checklist

1. Ingress — user text, retrieved docs, tool results, emails: all are untrusted.
2. Privileges — each tool is an RPC with an authz model; default deny.
3. Egress — model output that becomes SQL, shell, or HTTP is a confused deputy until validated.
4. Persistence — memory stores are durable attack surface; poison once, hit forever.
5. Identity — “run as the user” without parking long-lived tokens on disk.

Naive path

Bolt a chat UI onto an API key and a bash tool. Measure “demo coolness.” Skip the map.

Better path

Draw the surface first. Then add the model. Security basics for LLM systems start as architecture, not as a system prompt.

Useful overview to cross-check your map: ByteByteGo — LLM Security Basics.