# Ship-Safe LLM Features Checklist

Part of the Ship-Safe LLM Features Kit — ventrova.dev/kit

A pre-launch checklist for any feature that puts an LLM in the request path. Use it the same way you'd use a security sign-off checklist for any other feature: every box checked before merge, not after an incident.

## 1. Privilege segregation

- [ ] The LLM's output cannot directly trigger a privileged action (payment, deletion, permission change, external send) without a non-LLM confirmation step.
- [ ] System/developer instructions and user-supplied content are structurally separated (not concatenated into one prompt string) wherever the model API supports it.
- [ ] The LLM process runs with the minimum credentials needed for its task, not the credentials of the user or service account that invoked it.

## 2. Untrusted-content handling

- [ ] Every place external content (web pages, documents, emails, retrieved chunks, API responses) enters the prompt is identified and listed.
- [ ] That content is explicitly marked as untrusted data in the prompt structure (e.g. delimited, tagged, or passed via a separate role/field), not treated as instructions.
- [ ] The system prompt explicitly tells the model to treat delimited/retrieved content as data, never as commands, and this instruction is tested, not assumed.

## 3. Tool and function scoping

- [ ] Each tool/function exposed to the model does exactly one narrow thing; no general-purpose "run this code" or "make this HTTP request" tool without hard constraints.
- [ ] Tool arguments are validated server-side after the model proposes them, not trusted as-is.
- [ ] Any tool capable of a side effect (send, write, delete, spend) has a human-in-the-loop or hard-coded limit (rate, amount, scope).

## 4. Output filtering

- [ ] Model output that will be rendered as HTML/markdown to a user is sanitized against injected markup or links.
- [ ] Model output that will be executed, evaluated, or passed to another system is validated against an expected schema, not passed through raw.
- [ ] Sensitive data (secrets, internal system details, other users' data) that could leak through the model's context is identified and excluded from what the model can see.

## 5. Red-team coverage

- [ ] The feature has been tested against direct override attempts ("ignore previous instructions").
- [ ] The feature has been tested against roleplay/jailbreak framing.
- [ ] The feature has been tested against fake system/developer tag injection.
- [ ] The feature has been tested against encoding tricks (base64, unicode, translation).
- [ ] The feature has been tested against indirect injection via retrieved/RAG content.
- [ ] Test results and any accepted residual risk are recorded somewhere a reviewer can find them.

## 6. Sign-off

- [ ] A named reviewer (not the feature author) has walked this checklist against the shipping implementation.
- [ ] Any unchecked item has an explicit, written reason it's out of scope for this release, not a silent skip.

---

See the paired documents in this kit: `prompt-injection-defense-guide.md` for the reasoning behind each section, `red-team-test-templates.md` for ready-to-adapt test cases, and `eu-ai-act-annex-iv-checklist.md` if you also need EU AI Act technical documentation.

© Ventrova. Reference material for teams shipping LLM features, not legal or professional audit advice.