Design the security architecture for an LLM chatbot that talks to people outside the company, protecting its data, the systems it can reach and its users.

Assume anything in the context can steer the model, so enforce security outside it.

Tools run with the end user's permissions, checked server-side on every call; writes need confirmation. Retrieval filters by access control before text reaches the model, and no secrets go in prompts. Outputs are scanned for personal data, and links or images are rendered safely to block exfiltration. Add injection classifiers, rate limits, redacted logs and ongoing red-teaming.