Threat modeling
Identify what information and actions need protection, who can influence inputs, and how failures could affect the business.
Operate & govern
AI Security & Risk Engineering
AI security engineering for businesses and portfolio companies. Protect business records and connected actions with access controls and application testing.
Discuss your AI project ↗Untrusted content stays outside the authority boundary
External inputMessages · documents · retrieved text
Model outputA suggestion, not an authorization
Application-enforced boundaryIdentity · permissions · validation
Permitted recordsEnforce access at the source
Allowed toolsExecute only validated actions
Protect what the application can reach.
AI applications introduce additional paths between external information, model behavior, and business systems. Blake Technologies examines those paths as part of architecture and implementation. We treat retrieved documents and user inputs as untrusted, constrain tool permissions, and test failure scenarios. Security work is scoped to the actual application and does not substitute for every form of independent assurance.
Service-business AI systems may handle customer information, operational records, and tools that change schedules or create work. Private equity portfolio deployments add boundaries between companies and shared services. We evaluate those access and action paths, helping the software enforce the permissions that business owners approve instead of relying on a model to decide what it may do.
A useful distinction
Can a prompt alone enforce access permissions?
No. Access decisions need enforcement in the application and connected systems. Model instructions may guide behavior, but they should not be the sole barrier protecting records or authorizing consequential actions.
Trace a misuse path before release
Design, enforce, and test the boundary
Application boundaries
Enforce authorization in application code, validate tool requests, and keep secrets out of model context where they are not needed.
Adversarial evaluation
Test relevant instruction conflicts, unauthorized retrieval attempts, and misuse scenarios, then document findings and remediation.
Keep findings connected to remediation
Your engagement outputs
- An application threat model and prioritized control requirements
- Implemented permission, validation, and logging controls
- Scoped security evaluation findings and remediation guidance
Scope, schedule, team, and support are agreed for the engagement.