Prompt injection: direct, indirect, and how to contain both
Why the model can't fix it alone, what an attack hidden in a document looks like, and how to contain it.
Read about prompt injectionFinancial services · 4 min read
Building an AI audit trail for financial services
The question that stops projects is not what the system did, but what it was configured to do on the day. Four properties make that answerable.
The audit question people prepare for is 'what did the system do'. The one that actually stops projects is 'what was the system configured to do on the day in question, and what has changed since'. Without configuration history that question has no answer at all, and a control you cannot reconstruct is a control you cannot attest to. This is a walkthrough of the four properties that make an AI system auditable, written for the engineer who has to build them rather than the reviewer who will ask for them.
Scope note: this is engineering guidance about controls, not legal advice or a statement of what any rule requires. NeuralSeek holds SOC 1 and SOC 2 Type II reports and is HIPAA compliant. Your counsel, regulators and internal audit decide what applies to your organization.
Why this is the whole conversation
In a regulated firm, an AI system that touches books, records or customer interactions is not evaluated on capability first. It is evaluated on whether it produces a complete, trustworthy account of what happened: who did what, when, under which configuration, and whether that account can be handed over promptly and stand up to someone who assumes nothing.
That is a tractable engineering problem, and it decomposes into four properties. None of them is exotic. What makes them hard is that they have to be in place from the beginning. An audit trail cannot be added to history.
One: a durable record of every interaction
Two complementary logs, plus control over where they live. An organization-wide, tamper-evident record of every interaction gives you the account. A record of the prompts themselves gives you the reconstruction: when a specific answer is questioned later, you can show precisely what was asked and what material the system was working from.
The part teams under-plan is storage. Retention obligations for regulated records are usually longer than anyone's default log retention and often require a specific kind of durability. The ability to route these records to the backend your firm already uses for regulated records, instead of whatever the application defaults to, is what makes the control real rather than nominal.
Two: a history of every settings change
This is the property most AI systems lack and the one that most often turns a review into a project. If the retrieval thresholds, the guardrail policy or the model assignments changed at some point, and nobody can say when or to what, then every answer produced before that change is unexplainable.
What's needed is a timestamped log of every settings change, so you can see what changed and when, and undo it. That turns a control change from an untracked edit into a reviewable event, which is what a controls framework asks for.
Three: attribution, without leaking credentials
A trail that cannot be tied to an identity fails the audit at one end; a trail that leaks secrets fails it at the other, and more expensively. Every recorded interaction should attach to a known access path and identity rather than to an anonymous call, which is a design decision about how the system is fronted rather than something you can add later.
At the same time, keys and connection secrets must be kept out of prompts, out of responses and out of the logs themselves. The record you produce as evidence is a document that will be copied, mailed and stored by people outside your team. It should not be a place credentials can be found.
Four: evidence that exports rather than assembles
The final property is whether the trail can be turned into something a reviewer accepts without a translation layer. In practice that means mapping each control to the requirement it satisfies, in the format your reviewers already use, so that the answer to a walkthrough request is a document rather than an investigation.
The test is simple and worth applying to whatever you are evaluating: when the request arrives, is producing the evidence an export, or is it an emergency?
Configure it once, or assemble it forever
The difference between an AI initiative that ships inside a regulated firm and one that stalls is rarely the model. It is whether the audit trail is a product of the configuration or something reconstructed under pressure each time someone asks.
All four properties above are settings in NeuralSeek rather than components to integrate, and they apply to every workflow built on the deployment rather than to the ones whose authors remembered. You get them by default instead of rebuilding them for each workflow.
Keep reading
More guides to governed AI
Practical reading on building, governing and running AI agents.
For settings and parameters, see the product documentation.
Finding the PII that pattern matching misses
Regular expressions find the personal data that looks like personal data. 'Maria in room 4B' identifies a patient and matches nothing. How a second, contextual pass catches it.
Read about PII detection
Start building with NeuralSeek today.
Sign up online and start with a two-week trial, or talk to a NeuralSeek expert about running it in your own cloud.