Module 5: Autonomous AI & Connected Systems - DRAFT
Why This Is Higher Risk
Section titled “Why This Is Higher Risk”When AI can act (send emails, modify data, call APIs), failures or attacks can cause:
- Data exposure
- Unauthorized changes
- Financial loss
- Compliance violations
This is a different risk class from simple chat.
Pre-Connection Checklist (Required)
Section titled “Pre-Connection Checklist (Required)”Before connecting AI to any internal or client system:
- Business justification documented.
- Least‑privilege access: only required permissions.
- Human‑in‑the‑loop: define what needs explicit approval.
- Kill switch: tested and documented path to revoke access quickly.
- Logging: all actions logged and reviewable.
- Data classification: confirm if PII/PHI/financial data is involved.
- Client communication: [Client Name] informed and, when needed, has consented.
Internet-Connected AI Rules
Section titled “Internet-Connected AI Rules”- Do not give an internet-browsing AI direct write access to sensitive systems.
- Assume external content may contain prompt injection.
- Use sandboxes:
- Agent does research in a limited environment.
- Human reviews.
- Approved insights are applied manually or via a tightly controlled step.
Employee Checklist (Autonomous AI)
Section titled “Employee Checklist (Autonomous AI)”- I understand that action-capable AI is higher risk than chat-only tools.
- I do not connect AI to systems without appropriate approvals.
- I know how to escalate issues or shut down an AI agent.