The short answer
Procurement and security will ask about model and inference data handling (zero-retention tiers, dedicated capacity, self-hosted options), identity and authorization (which user does the agent act as, ACL propagation through retrieval), prompt-injection defenses, audit logging (every input, output, tool call, and human approval), data residency, secret management, and incident response. Treating these as an afterthought adds 4–8 weeks to launch. Designing for them from week one is a sales accelerator with security teams.
The eight controls procurement actually asks about
Across hundreds of enterprise security reviews, the same eight controls drive the conversation. Designing for them on day one shortens the security review from months to weeks.
- ›Inference data handling: zero-retention API tier, dedicated capacity, or self-hosted weights — documented per workflow.
- ›Identity and authorization: which authenticated user the agent acts on behalf of, and how authorization is preserved end-to-end.
- ›ACL propagation in retrieval: retrieval respects per-document access controls — no leaking confidential docs into a response a user could not have read.
- ›Prompt-injection defenses: input sanitization, structured tool schemas, output filtering, capability scoping.
- ›Audit logging: every input, output, tool call, retrieval, and human approval logged immutably with timestamps and identities.
- ›Data residency: where inputs, outputs, embeddings, and logs are stored geographically.
- ›Secret management: API keys, tokens, and credentials handled via your existing secret manager, never in prompts or repos.
- ›Incident response: documented playbook for prompt-injection, hallucination-caused customer harm, and accidental data exposure.
The two controls most pilots get wrong
ACL propagation in retrieval (agents that helpfully surface documents the user was not supposed to see) and audit logging granularity (logs that capture the outputs but not the tool calls and reasoning steps). Both are nearly impossible to retrofit — they have to be in the architecture from the start.
What 'zero-retention' actually means
OpenAI's zero-retention tier, Anthropic's no-training commitment, AWS Bedrock's no-training default — these are real and meaningful controls. They are not equivalent to self-hosting open-weights models on your own infrastructure; for the most sensitive workloads, self-hosting is the only answer. Knowing which workload deserves which tier is part of architecture, not a procurement checkbox.
Why this is a sales accelerator
Vendors who arrive at security review with a written architecture covering the eight controls move through review in 4–8 weeks. Vendors who arrive without one spend 16–24 weeks in iterative Q&A. The faster path is shorter, less costly, and produces a better-governed system. Front-loading the design pays back many times over.
Key takeaways
- Eight controls drive 90% of enterprise security reviews — design for them from day one.
- ACL propagation and audit-log granularity are the two controls you cannot retrofit.
- Zero-retention API tiers are a real control for sensitive but not top-secret workloads.
- A written security architecture is the fastest path through enterprise procurement.
Frequently asked questions
Do we need a self-hosted model for compliance?+
Not always. Many regulated workloads run on zero-retention API tiers with full audit. Self-hosting is the right answer for the most sensitive data classes (regulated health, defense, attorney-client) — not for every workload.
How do we test prompt-injection defenses?+
Run a small red-team exercise before launch with documented injection patterns (Hidden instructions in retrieved docs, tool-result poisoning, output exfiltration attempts). Then automate the test in your regression suite.
Who owns incident response for an AI agent?+
The build team for the first 90 days, then a joint incident-response process with security and the business owner. The playbook should pre-categorize incidents (Sev-1 customer harm, Sev-2 quality regression, Sev-3 cost anomaly) so the responder is not making categorization decisions under stress.