Threat Model

Use this when you need to understand which AI security risks Firefish is designed to reduce.

Firefish focuses on untrusted instructions and sensitive data crossing boundaries between users, documents, models, tools, applications, and operators.

Primary risks

• Direct prompt injection in user input.
• Indirect prompt injection in RAG documents, web pages, emails, PDFs, metadata, or tool results.
• System prompt leakage attempts.
• Sensitive-data leakage through prompts, retrieved content, model outputs, reports, or tools.
• Unsafe tool actions proposed by agents.
• Excessive agency, including external sends, writes, exports, deletes, and code execution.
• Output handling risk such as unsafe Markdown or HTML.
• Regression risk when AI app behavior changes over time.

Controls

• Scanner and policy decisions for prompts and content.
• RAG / Document Firewall before indexing or retrieval.
• DLP and redaction for sensitive data.
• Agent Capability Firewall before tool side effects.
• Runtime gateway input and output checks.
• CI red-team regression runner.
• Security Ops evidence, incidents, approvals, and timelines.

Local-first posture

Firefish defaults to local/self-hosted operation. Hosted model providers are not required for normal local operation. Raw logging is disabled by default. Audit records should use hashes, redacted previews, reason codes, and structured metadata.

Assumptions

• The deployment controls its own API keys and dashboard access.
• Operators configure trusted tools and destinations intentionally.
• Applications still enforce identity, authorization, tenant isolation, and business rules.
• Synthetic benchmarks are used as regression evidence, not as a claim of complete protection.

Out of scope

Firefish does not guarantee full prevention of all prompt injection, data leakage, or unsafe model behavior. It does not replace secure application design, access control, endpoint security, SIEM, or human review.