What you’ll learn
- Map data flows and model-related application risks.
- Constrain tool permissions and sensitive-data exposure.
- Evaluate safeguards with repeatable authorized test cases.
Proposed course content
6 sections · 13 illustrative lesson records
Threat models and trust boundaries3 lessons
- Introduction to AI Application Security & Privacy
Explore AI application threat modeling, prompt-injection boundaries, data minimization and permission controls with synthetic data in authorized labs.
Public introduction · Video not supplied - Map users, retrieved text, model outputs and tools
Map users, retrieved text, model outputs and tools. Module: Threat models and trust boundaries.
Enroll to access · Video not supplied - Record assets, assumptions and permitted testing scope
Record assets, assumptions and permitted testing scope. Module: Threat models and trust boundaries.
Enroll to access · Video not supplied
Data handling and privacy2 lessons
- Minimize logged and transmitted content
Minimize logged and transmitted content. Module: Data handling and privacy.
Enroll to access · Video not supplied - Plan retention, redaction and access controls
Plan retention, redaction and access controls. Module: Data handling and privacy.
Enroll to access · Video not supplied
Prompt-injection boundaries2 lessons
- Treat retrieved content and model instructions as untrusted inputs
Treat retrieved content and model instructions as untrusted inputs. Module: Prompt-injection boundaries.
Enroll to access · Video not supplied - Evaluate synthetic instruction-conflict cases in the authorized lab
Evaluate synthetic instruction-conflict cases in the authorized lab. Module: Prompt-injection boundaries.
Enroll to access · Video not supplied
Tool and API permissions2 lessons
- Use allowlists and least-privilege credentials
Use allowlists and least-privilege credentials. Module: Tool and API permissions.
Enroll to access · Video not supplied - Require confirmation before consequential actions
Require confirmation before consequential actions. Module: Tool and API permissions.
Enroll to access · Video not supplied
Guardrails and evaluation2 lessons
- Validate structured outputs and refusal paths
Validate structured outputs and refusal paths. Module: Guardrails and evaluation.
Enroll to access · Video not supplied - Track missed cases and false positives
Track missed cases and false positives. Module: Guardrails and evaluation.
Enroll to access · Video not supplied
Monitoring and incident planning2 lessons
- Log safe diagnostic signals without sensitive prompts
Log safe diagnostic signals without sensitive prompts. Module: Monitoring and incident planning.
Enroll to access · Video not supplied - Document rollback, reporting and safeguard limitations
Document rollback, reporting and safeguard limitations. Module: Monitoring and incident planning.
Enroll to access · Video not supplied
Requirements
- Basic API programming and familiarity with model-backed applications.
- An owned or explicitly authorized test application and synthetic, non-sensitive data.
Tools and resources
- A development computer with resources appropriate to the proposed local exercises.
- A local application framework, test model access or a local model and synthetic documents.
- Automated test tools, secret management and redaction utilities; external API access may require separate authorization and resources.
Description
Explore AI application threat modeling, prompt-injection boundaries, data minimization and permission controls with synthetic data in authorized labs.
Who this course is for
Application developers integrating model-based features.
Example practical project
Proposed capstone: a synthetic-document assistant with bounded tools, privacy-aware logs and a documented safeguard evaluation.