SECAI Core · phase 7 of 15
Input validation
Any technique used to ensure that the data entered into a field or variable in an application is handled appropriately by that application.
The Explain card
- Plain English
- Input validation is any technique that ensures data entering a field or variable is handled appropriately by the application: checked for type, length, format and content before it is trusted.
- Example
- An AI assistant accepts uploaded documents for summarisation. Validation enforces file type and size, rejects embedded scripts, and strips hidden text before the content reaches the model, closing a common prompt injection route.
- Why it matters
- Validation is the oldest control in application security and it still applies to AI: prompts, files and retrieved content are all input. Validating early reduces what an attacker can smuggle into the model.
- Hook
- Input validation: never trust input, and a prompt is input.
Where it sits in the deck
Phase 7: AI-Specific Runtime Controls: Guardrails, Limits, and Enforcement
Responsible AI principles must be enforced mechanically — learn the runtime controls that constrain model inputs, outputs, and resource consumption.
