AI governance becomes concrete at the point where an application grants permission, consumes a budget, handles untrusted content, or records a consequential decision. These guides focus on those engineering boundaries rather than abstract promises of responsible behavior. Compare model proposals with executor actions, separate usage estimates from confirmed reporting, and connect approvals to specific resources and parameters. Use the collection to frame a review shared by application, platform, and security teams. The examples are adaptable practices, not a compliance framework or a guarantee about model behavior.
AI agent least privilege: let the model propose, let policy decide
A permission model for tool-using agents, with scoped identities, specific approvals, and auditable execution.
AI token budgets: control consumption before the bill arrives
Design per-request, workflow, and tenant budgets with explicit estimates, reconciliation, and safe stopping behavior.
Prompt injection and API security: keep untrusted content out of control
Why valid requests can still carry unsafe instructions, and how to protect the boundaries around retrieval, tools, and output.
AI API monitoring: connect latency, usage, and policy decisions
Build an observability plan that follows the whole AI workflow instead of stopping at a successful HTTP response.