AI inference is often drawn like this:

User → Application → Model → Response

But production AI systems look more like:

User
  ↓
Application
  ↓
Context Builder ← Retrieved Data
  ↓
Model
  ↓
Policy / Validation
  ↓
Tools → APIs / Database / Cloud

Every transition can cross a trust boundary.

A trust boundary exists when data or control moves between components with different levels of trust, privilege, or authority.

Where the Boundaries Are

1. User → Application

User input is untrusted.

With LLMs, syntactically valid input can still manipulate model behavior through prompt injection. Input validation alone does not solve this.

User content should never automatically become trusted instructions.

2. Retrieved Data → Model

RAG creates another boundary.

Documents retrieved from a vector database may have originally come from users, websites, emails, uploaded files, or third-party systems.

External Content → Vector Store → Retriever → Model

Moving untrusted data into internal storage does not make it trusted. A document may be trusted as data without being trusted as instruction.

3. Model → Application

Model output should also be treated as untrusted.

An LLM can hallucinate, produce malformed data, expose sensitive information, or generate attacker-influenced output.

Model → Validation → Application

Never let raw model output directly control security-sensitive application behavior.

4. Model → Tools

This becomes the critical boundary in agentic systems.

LLM
 ↓
Proposed Action
 ↓
Authorization + Policy
 ↓
Tool
 ↓
Database / API / Cloud

A model might propose deleting a resource, sending an email, querying customer data, or modifying infrastructure.

The fact that the model generated an action does not mean the action is authorized.

The model proposes. The security architecture decides.

Trust Is About Authority, Not Location

Two services running inside the same Kubernetes cluster can still belong to different trust zones.

Trust should be based on:

• identity and authorization
• data provenance
• privilege level
• execution capability
• data sensitivity

An internal vector database containing user-uploaded documents, for example, still contains potentially untrusted content.

The Core Principle

A useful rule for designing secure AI inference systems is:

Never allow information to acquire authority simply because it passed through a model.

• A user prompt does not become trusted because an LLM interpreted it.
• Retrieved content does not become an instruction because the model read it.
• And a model-generated action does not become authorized because the model proposed it.

When threat-modeling AI inference, don’t ask only:

“Can the model be attacked?”

Ask:

“What crosses each trust boundary, under whose authority, and what happens if it is malicious?”

That is where AI architecture security actually begins.