AI Module Security

When to Use

Use this guide before deploying any user-facing AI feature. All items in the checklist are required for production.

Decision

Situation	Choose	Why
User-facing chat	Guardrails enabled	Prompt injection can bypass instructions
Agent with entity access	Property Restrictions	Prevents writing to unintended entity types
Monitoring AI usage	`ai_observability`	Audit trail without DB overhead
MCP tools on production	Do not use	Tool description injection risk

Security Checklist

[ ] Tools check $this->currentUser->hasPermission() before operations
[ ] Agent max_loops set conservatively (3-5)
[ ] Tool Property Restrictions configured (entity types, bundles)
[ ] ai_observability enabled for audit trail
[ ] XSS protection: responses sanitized with Xss::filter()
[ ] CSRF tokens required for DeepChat API
[ ] Guardrails enabled for user-facing AI features
[ ] No MCP tools on critical production sites
[ ] Separate high-privilege agents from user-facing ones
[ ] Prompt injection awareness: any user content is a vector

Permissions Reference

Permission	Module	Description
`access deepchat api`	ai_chatbot	REST API access
`administer ai_assistant`	ai_assistant_api	Manage assistants
`administer ai_automator`	ai_automators	Manage automators
`use ai ckeditor`	ai_ckeditor	CKEditor AI features
`access ai prompt`	ai_api_explorer	API testing UI
`access ai content suggestion tools`	ai_content_suggestions	Content review
`create ai content translation`	ai_translate	Trigger translation
`administer ai observability`	ai_observability	Monitoring config
`view ai log`	ai_logging	View logs

Prompt Injection

Any user-controlled content that reaches the AI context is a potential injection vector: - Entity titles, body text, field values, user names - URL parameters passed as context - Messages from other users in multi-user assistants

Mitigation: Use Guardrails for pre-processing; write explicit instructions in system prompts; separate high-privilege agents from user-facing ones.

`search_api_bypass_access` Warning

Using search_api_bypass_access in RAG queries leaks entity access-controlled content into AI responses. Always query with proper access control unless you have confirmed all indexed content is public.

Common Mistakes

Mistake	Why it's wrong
Exposing agent tools without permission checks	Any user who can chat with the agent inherits tool permissions
Using `search_api_bypass_access` without caution	Leaks entity access-controlled content into AI responses
Not using guardrails on user-facing features	Prompt injection can bypass agent instructions