AI Executive Office — CXO Assistant Platform  ·  View 26 of 30  ·  7 · Assurance

Security Zones

Where an attacker arrives, what stops them, and what they would actually get if they took the orchestrator.

Editable source SVG draw.io All views
Internet — untrusted Executive device Intune compliant Attacker credential · injection Microsoft 365 Teams · Graph Perimeter — public ingress ends here Front Door + WAF OWASP · rate limit DDoS Protection Entra ID MFA · Conditional Access Application — private, no public endpoint APIM internal VNet injected Experience API managed identity Orchestrator no data credential Tool plane the only data door AI and data — private endpoints, keys in HSM Azure OpenAI no public network AI Search ACL fields Decision store TDE + CMK Fabric + OneLake workspace RBAC Key Vault mHSM per-tenant key Execution and egress — the only outbound path Execution plane write scopes only Firewall Premium FQDN allow-list Enterprise systems over ExpressRoute Management — separate identities, no standing access PIM just-in-time approval + time box Bastion Sentinel SIEM · UEBA Defender for Cloud posture TLS 1.3 blocked at the edge Private Link typed call only caller identity allow-listed FQDN private Security Zones — Where an Attacker Arrives, and What Stops Them Person or role Risk / gap External / third party Interface / broker Security / platform Application we own Data store synchronous failure / alternate The orchestrator holds no credential for any store. Compromising it yields the ability to ask questions as the caller, and nothing more. v 1.0 · owner Data & AI Global Practice · date 2026-09

The blast-radius argument

  • The orchestrator holds no credential for any store. Compromising it yields the ability to ask questions as whoever is calling, and nothing more. That is the point of putting the tool plane in a separate zone
  • Public ingress ends at the perimeter. Every service behind it is private-endpoint only, and administrative access has no standing privilege
  • Egress has exactly one path, through a firewall with an FQDN allow-list. A model that has been talked into exfiltrating data has nowhere to send it

The threats this addresses

  • Prompt injection through a retrieved document, treated as the primary AI-specific threat: retrieved content is data, never instruction, and the model has no write tool to be talked into using
  • Credential theft of an executive account: conditional access, device compliance and MFA, and the platform inherits the account's authority rather than exceeding it
  • The operator as a threat: Customer Lockbox, PIM, and telemetry that excludes content

Risks

  • The tool plane is now the single most security-critical component in the platform. It is small by design, changes rarely, and every tool contract change goes through security review
◀  Degradation Contract All views Identity and Authorisation  ▶
Solution Architecture v1.0 · Azure-native, multi-tenant, sovereign-capable · Data & AI Global Practice · 2026-0926-security-zones