What it means
- Control who and what can reach AI assets: models, prompts, training data, fine-tuning jobs, vector stores, AI admin consoles and API keys.
- Treat AI agents as identities in their own right, each with its own credentials and the least privilege needed.
- Keep sensitive data inside controlled environments when using external or open-source models.
- ISO 27001 reuse: Strong. Existing ISO 27001 access control, identity, authentication and privileged access controls apply directly. The new parts are scoping them to AI agents, vector stores and permission-aware retrieval.
Why it matters
- RBI FREE-AI expects sensitive data to stay inside controlled environments when external or open-source models are used.
- Over-privileged agents turn a prompt injection into a breach (SC-AI-029 AI-specific security controls (prompt injection, model abuse)).
- Shared API keys for LLM providers are a common source of data leakage and runaway cost.
Checklist
- Add AI assets (model endpoints, vector stores, prompt repositories, training data, LLM API keys) to your access control scope.
- Give each AI agent or service its own identity (service account or workload identity); no shared human credentials.
- Scope agent permissions to specific tools, data sets and actions; prefer read-only by default.
- Store LLM API keys in a secrets manager; rotate them; block keys in code repositories.
- Enforce SSO and MFA on AI platforms, model registries and vendor AI consoles.
- Make retrieval respect the user's own permissions so the AI cannot show documents the user could not open directly.
- Restrict which staff may use which external AI tools with which data classes; block sensitive data to unapproved tools (links to SC-AI-007 Third-party and vendor AI due diligence).
- Include AI identities and privileged AI admin roles in quarterly access reviews.
- Revoke access when a model is retired (SC-AI-021 Model retirement and decommissioning).
Evidence examples
- Access control policy updated to name AI assets and agents.
- List of AI service accounts with owners and scoped permissions.
- Quarterly access review sign-off including AI identities.
- Secrets manager inventory of LLM keys with rotation dates.
- Configuration showing permission-aware retrieval (document ACLs enforced in search).
- Approved AI tools list with permitted data classes.
Common pitfalls
- One organisation-wide OpenAI or Azure key shared by every team.
- RAG chatbot indexing all of SharePoint and showing HR files to everyone.
- Agents running with the deploying engineer's personal credentials.
- AI identities missing from joiner, mover, leaver and access review processes.
Satisfies
- SupervisoryNYDFS AI Cybersecurity Letter 2024
- VoluntaryRBI FREE-AI
Also relevant to
- NITI Aayog Responsible AI for Allguidance mapping (privacy and security; no obligation IDs)
Standards crosswalk
Clause references only. Check the standard itself for the exact wording.
ISO/IEC 42001
- 6.1.3 AI risk treatment
ISO/IEC 27001
- A.5.15 access control
- A.5.16 identity management
- A.5.17 authentication information
- A.5.18 access rights
- A.8.2 privileged access rights
- A.8.3 information access restriction
- A.8.5 secure authentication
SOC 2
- CC6.1
- CC6.2
- CC6.3
Key takeaways
- Extend your existing ISO 27001 access controls to AI; little needs inventing.
- Every agent gets its own identity and least privilege.
- Retrieval must respect the user's own permissions.