P-001 · CRITICAL
Prompt Injection Prevention
All AI agents must include explicit anti-injection instructions in their system prompt. Agents must not execute instructions embedded within user-provided content, external documents, or tool outputs. Any agent failing this policy must be quarantined before production deployment.
Applies to: All agents · Enforcement: Mandatory · Review: Monthly
P-002 · CRITICAL
Least Privilege Data Access
Agents must only access data belonging to the currently authenticated user. Cross-account data access is prohibited. Agents must not return bulk data exports, structured PII dumps, or aggregated records. All data access must be scoped to the minimum required for the stated task.
Applies to: All agents with data access · Enforcement: Mandatory · Review: Monthly
P-003 · HIGH
System Prompt Confidentiality
Agents must not reveal, summarise, paraphrase, or confirm the existence of their system prompt under any circumstances. Agents must be tested for prompt leakage before each production deployment and after every system prompt change.
Applies to: All agents · Enforcement: Mandatory · Review: On each deployment
P-004 · HIGH
Human-in-the-Loop for High-Risk Actions
Agents must not autonomously execute irreversible actions — including financial transactions, bulk data deletion, external communications, or privilege changes — without human approval. Session-level caps must be enforced for all financial tool calls.
Applies to: Agents with action tools · Enforcement: Mandatory · Review: Quarterly
P-005 · MEDIUM
Regular Red Team Testing
All production AI agents must undergo a full PromptWall red team scan at minimum once per month and after every system prompt update. Red team results must be logged, reviewed by a responsible owner, and critical findings remediated within 72 hours.
Applies to: All production agents · Enforcement: Recommended · Review: Monthly
P-006 · STANDARD
EU AI Act Compliance Baseline
All AI agents processing EU citizen data must comply with the EU AI Act and GDPR Article 32. Agents classified as high-risk under the EU AI Act must maintain an audit log of all interactions, undergo documented conformity assessment, and register with the EU AI database prior to deployment.
Applies to: EU-facing agents · Enforcement: Legal obligation · Review: On regulation update
Policy Framework v1.0 · NullVector Ltd
These policies represent the minimum security baseline recommended by NullVector for all AI agent deployments.
Full policy enforcement and custom policy creation is available on the Growth and Enterprise plans.
Last reviewed: March 2025 · Next review: June 2025
