Secure AI Deployment - Phase 2: Build and Deploy
AI-enabled applications often depend on models, external APIs, vector databases, retrieval services, and autonomous agents that interact with other applications and infrastructure.
These integrations introduce security risks when deployed applications or agents receive excessive permissions, unrestricted network access, sensitive credentials, or unauthorized tool capabilities.
During Build and Deploy, organizations should ensure AI applications and autonomous agents are deployed within controlled environments that enforce access policies, workload isolation, secure configuration, and release authorization.
This activity extends established CI/CD deployment security practices to address the operational capabilities and security requirements of AI-enabled applications.
Secure AI Deployment
Objective: Ensure AI applications, models, and autonomous agents are deployed using verified artifacts, controlled identities, least-privilege permissions, protected credentials, and independently enforced security policies.
The NIST Secure Software Development Framework (SSDF) establishes practices for protecting software development environments and ensuring the integrity of software releases.
The OWASP Top 10 for LLM Applications identifies excessive agency, prompt injection, and improper output handling as risks that can affect deployed AI applications.
For DevOps teams, secure deployment should ensure that AI services and agents operate only within approved access and execution boundaries.
AI-generated instructions must not independently grant permissions or authorize privileged operations. Access decisions should be enforced by trusted application, identity, and infrastructure controls.
AI Security Requirements and Open-Source Tooling
| Framework Reference | Security Activity | CI/CD Implementation | Suggested Open-Source Tools |
|---|---|---|---|
| NIST SSDF PO.5; OWASP LLM06 | Workload identity and authentication | Assign controlled workload identities to AI applications and agents and authenticate access to protected services. | SPIRE, Keycloak |
| NIST SSDF PO.5; OWASP LLM06 | Least-privilege authorization | Restrict access to repositories, databases, APIs, tools, and infrastructure based on approved policies. | Open Policy Agent, Casbin |
| NIST SSDF PO.5 | Secrets management | Protect credentials and API keys through secure configuration and controlled secrets distribution. | SOPS, External Secrets Operator |
| NIST SSDF PO.5 | Workload isolation | Deploy AI workloads in controlled environments with restricted execution privileges and resource boundaries. | Kubernetes, gVisor |
| OWASP LLM06 | Agent tool authorization | Enforce restrictions on the tools, commands, and external operations that agents can invoke. | Open Policy Agent, Kyverno |
| NIST SSDF PS.2 | Deployment artifact verification | Verify approved container images and applicable artifact signatures before deployment. | Sigstore Cosign, Kyverno |
| NIST SSDF PO.5 | Network access restrictions | Restrict connections between AI workloads, internal resources, and external services. | Cilium, Kubernetes NetworkPolicy |
| NIST SSDF PO.1, PS.2 | Deployment authorization | Apply release approval policies and prevent deployment of unauthorized or unverified AI components. | Open Policy Agent, Argo CD |
| NIST SSDF PO.3, PS.1 | Deployment traceability | Record deployed versions, configuration changes, approvals, and release history. | Argo CD, Flux |
These controls apply established software security and infrastructure practices to AI-enabled applications. Deployment authorization and infrastructure security controls should operate independently of model-generated decisions.
Expected Security Evidence
- Approved AI deployment configurations.
- Workload identity and authentication records.
- Agent permission and authorization policies.
- Secrets management and credential access configurations.
- Workload isolation and network security policies.
- Verified container and artifact signatures.
- Deployment policy enforcement records.
- Release approval and change authorization evidence.
- Deployment configuration and version history.
- Records of rejected or unauthorized deployment attempts.
These artifacts provide evidence that AI applications and agents are deployed within controlled environments and operate under defined security restrictions.
Deployment evidence should be retained for continuous security monitoring, vulnerability management, and incident response during Phase 3: Post Deploy.