A valid login is not a permission check
Follow one request from identity to resource access, and find the security decision that authentication alone cannot make.
A FIELD JOURNAL FOR THE AI SECURITY ERA
Understand AI.
Think in
boundaries.
Follow your curiosity from the first principle to the next attack surface. Clear explanations, hands-on experiments, and the notes that connect it all.
ANATOMY OF AN AI SYSTEMFIG. 01
01 / THE INPUTLooks like data.ignore previous…
03 / THE ACTIONTools have power.
Question whatcrosses the line.
PERMISSION CHECKVerify before acting.
Context is not authority. Retrieved text can inform an answer. It should never grant new permissions.
CURIOUS MINDS BUILD SAFER SYSTEMS.SCROLL TO CONNECT THE DOTS
THE LEARNING LOOP Understand the system Question the assumptions Test. Reflect. Share.
01 / OPEN THE NOTEBOOKA little deeper.
A little deeper.
A lot clearer.
Ideas worth sitting with.
Notes worth coming back to.
AI / LLM / RAG Security
When retrieved text becomes an instruction
A closer look at indirect prompt injection, the RAG trust boundary, and why retrieved content should never inherit authority.
Sep 12, 2026Read the field guide
Before the exploit, draw the boundary
A practical starting point for threat modeling: identify the assets, follow the data, and ask where trust changes.
An agent tool is a permission boundary
Look past the tool description. What can the agent actually do, with whose identity, and under which constraints?
Write a lab note your future self can reproduce
A small template for turning an interesting result into a useful experiment: setup, observation, explanation, and limits.
4 notes to explore
02 / MAKE YOUR OWN CONNECTIONSOne curious mind.
One curious mind.
Twelve ways forward.
Start at the foundations, follow a thread,
or jump into something unfamiliar.
03 / LEARNING GETS INTERESTING HEREDon't just
Don't just
read the theory.
Pull a thread.
What happens when a document gives an agent instructions? Change the input. Test the boundary. See the decision for yourself.
Step into the playground One small experiment. A much bigger idea.EXPERIMENT NO. 001 Ready to explore
Can data become
an instruction?
Document Proposal Check
THE HYPOTHESIS
A model can propose an action.
The application decides what is allowed.
Let's find out.
A PLACE TO STAY WITH AN IDEA
Settle into a field guide Made for your next deep dive.
Unhurried reading. Adjustable text and paper tones. Room to think, and a clear path to the next question.
Stay curious.
Leave a trail.
Learn something. Test it. Write it down.
Help the next person connect the dots.