Pular para o conteúdo principal

Module 5: Governance, Security and Compliance

Learning objectives​

By the end of this module, you will be able to:

  • Name the seven risk categories specific to AI-assisted development and give one concrete example of each.
  • Explain prompt injection in a way a non-engineer understands, and say why it is a design problem rather than a filtering problem.
  • Write a one-page AI usage policy that engineers will actually follow.
  • Configure the technical controls - secret scanning, dependency review, permission scopes, audit logging - that make the policy enforceable.
  • Map your practice to the compliance frameworks your customers ask about (SOC 2, ISO 27001, the EU AI Act) without pretending to be a lawyer.

Module content​

Chapter 1: A risk taxonomy​

Seven categories: secrets and credentials, data leakage to providers, licensing and provenance, prompt injection, supply chain, over-permissioned agents, and accountability gaps. For each: what it looks like, a real-shaped example, and the control that addresses it.

Chapter 2: Policies that work​

The difference between a policy that is enforced and a policy that is a PDF. Allowlists, permission scopes, review gates, audit trails, and the short list of things to say to an auditor.

Quiz​

Six questions.

The stance of this module​

Governance is not the department that says no. It is the set of defaults that let engineers move fast without having to think about whether this particular change is the one that leaks a customer database. Good governance is mostly invisible: the right thing is the easy thing, and the dangerous thing requires a deliberate step that leaves a trace.