CCAR-F Domain 5: Production Reliability & Security Guardrails
Enforcing defense-in-depth safety guardrails in execution code, least-privilege tool execution, circuit breaker fallbacks, and production monitoring.
1. The Golden Rule of LLM Security
Never Rely Solely on Prompting for Security
System prompts are probabilistic natural language instructions. In production architectures, hard deterministic validation in backend execution code must always enforce authorization, permission boundaries, and parameter validation before executing tool actions.
2. Least-Privilege Tool Execution Patterns
- Strict Typing: Enforce strict JSON schemas and validate argument types using Pydantic / Zod before passing them to internal database drivers.
- Read-Only Database Credentials: Give LLM SQL tools access only to read-only database replicas with restricted user permissions.
- Human Confirmation for Irreversible Writes: Require two-factor or explicit human UI confirmation before executing state-altering actions (e.g. deleting files, initiating wire transfers).
3. Circuit Breaker & Fallback Architecture
If the primary model tier experiences unexpected latency or 529 throttling during peak events, a circuit breaker pattern smoothly degrades user requests:
Primary: Claude 3.5 Sonnet → (If circuit open or 529) → Fallback: Claude 3.5 Haiku → Static Cache Fallback