Security perspective

Lens: Trust boundaries — data in AI prompts, scan gates, threat models, incidents, and policy exceptions.

Phase by phase

Phase	Your job	Key artifacts	Guides & SOPs
Plan	Data classification on intake	Class label on ticket	Data governance · SOP-001
Define	Threat model review (T1/T2 external)	STRIDE outline	Planning & ADR
Build	SAST/SCA/secrets policy	Scan thresholds	Linters · AI guardrails · Identity & secrets
Verify	Block Critical; exception process	SOP-012	SOP-005
Release	DAST on staging; container CVEs	Scan report	CI/CD
Operate	GuardDuty; breach playbooks	Security incident	Incident mgmt
Learn	Postmortem for Sev-1 security	Policy update	SOP-008

Non-negotiables

Rule	Reference
No prod PII in AI prompts	SOP-010
No merge on Critical secret scan	SOP-005
Restricted data never in coding-agent RAG	Data governance
Security exceptions time-bound	SOP-012

Who you collaborate with

Role	When
AIPO	AI platform audit, Bedrock logging
Data steward	Classification glossary
Architect	Security ADRs
DevOps	WAF, IAM, GuardDuty, Secrets Manager
Legal/privacy	Breach and erasure

Pitfalls (Security view)

Pitfall	Mitigation
Consumer AI tools for code	Enterprise tier only
Permanent scan exceptions	Max 30d + remediation
Logs with full PII	Redaction standards
AI RCA on malware in public models	Isolated analysis

← All roles