Introduction
Who can access the data? What could cause harm? Who is responsible for the decision? Security, safety, and governance overlap, but each brings a different question. Security addresses unauthorized access, manipulation, and disruption. Safety considers harmful outcomes. Governance establishes ownership, rules, evidence, and accountability.
The risks extend beyond the model to data, retrieval, prompts, tools, credentials, interfaces, vendors, people, and processes. We will identify those risks and design controls we can test. Your project is a threat model and risk register for the research agent from Module 22.
Begin with boundaries and threats, then evaluation and governance, then an incident example. The aim is to support useful, authorized work with a clear understanding of who can act and what the consequences may be.