03 · Analyse risk · SaaS

Assess RAG, model and agent threats

Focus on cross-tenant exposure, prompt injection, unsafe workflow actions, unannounced model changes and customer trust.

SAAS WORKING CONTEXT

Assess SaaS release risk

A fast-growing software provider is embedding third-party AI into a multi-tenant product. Enterprise customers expect security, reliability and contractual clarity.

Evidence bar

Security test report
Prompt-injection workpaper
Supplier change evidence

REVIEW CHECKPOINTS

RAG & Agent Risk Checklists

Test isolation and adversarial inputsRecord contractual and subprocessor gapsDefine blockers for data leakage or unsafe actionTest direct and indirect prompt injectionCheck access control at retrieval timeTreat citations as evidence only when traceable

INTERACTIVE REVIEW MEETING

Pressure-test your reasoning

Knowledge ownerTrusted document

The source is in our repository. Why treat its instructions as untrusted?

Write at least 40 characters to reveal the review criteria.

EngineeringAgent autonomy

The agent saves time only if approvals are removed. What actions may remain autonomous?

Write at least 40 characters to reveal the review criteria.

RAG & Agent Risk Checklists

Complete the fields against the saas operating context. Your work saves automatically in this browser.

RAG risk checklist