Access control only answers who can reach the model. Integrity controls answer whether the model itself has been altered, poisoned, replaced, or degraded in a way that changes the output. If the decision engine is untrusted, downstream workflows inherit that risk even when access is technically correct.
Why integrity controls matter when access control already exists
Access control is about who is allowed to reach a model or service. Integrity controls address a different question: whether the model, its weights, its retrieval layer, or its surrounding execution path still behaves as intended. That distinction matters because a permitted session can still produce unsafe or incorrect outputs if the model has been tampered with, poisoned, swapped, or silently degraded.
For AI systems, integrity is not a nice-to-have safeguard layered on top of access control. It is what preserves trust in the decision engine itself. If the model has been altered upstream, every authorized caller can inherit the compromise even though authentication and authorization are functioning correctly.
What integrity controls actually protect in an AI stack
Integrity controls cover the parts of the AI system that determine whether the output is trustworthy: model artifacts, training and fine-tuning data, prompts or system instructions when they are centrally managed, retrieval sources, tool integrations, deployment pipelines, and approved versions of the model. In practice, teams need provenance, signing, hashing, change review, and controlled release of model artifacts so they can tell whether the thing running in production is the thing they intended to deploy.
This is why supply-chain thinking matters for AI. SLSA helps frame build and release provenance for artifacts, while an AI-specific inventory should make it possible to verify what model version, data source, or adapter is currently in use. For retrieval-augmented systems, the same logic extends to indexing and permissions: if the retrieved material is manipulated or over-shared, the model can stay “available” while still being untrustworthy. NHIMG’s Permission-Aware RAG Guide is useful here because it treats retrieval as part of the trust boundary, not just a convenience layer.
Integrity also protects against silent drift. A model may not be fully replaced to become unsafe; it may be fine-tuned poorly, injected with malicious instructions, or updated in a way that changes safety, accuracy, or policy behavior enough to break downstream decisions. In other words, the control objective is not only “can the model be reached?” but also “can we prove the model we reached is the one we intended?”
Why access control alone leaves a blind spot
Access control limits entry, but it does not verify content. An authenticated user, service, or agent can still call a poisoned model, a corrupted prompt template, or a compromised retrieval pipeline. That means the trust boundary in AI is broader than the login boundary: the output path depends on artifact integrity, dependency integrity, and deployment integrity as much as on authorization.
That blind spot becomes more serious when outputs drive other systems. If an AI model recommends approvals, routes incidents, generates code, or influences customer workflows, a compromised model can create bad decisions at scale without ever breaking authentication. AI supply chain security and AI-BOM practices help teams track what entered the model lifecycle, while agent identity issues become relevant when an AI system is not just producing text but operating with tool access or delegated authority.
Put simply, access control can stop the wrong actor from using the model. Integrity controls stop the right actor from using the wrong model. Both are necessary because trust in AI depends on identity at the perimeter and integrity in the runtime path.
Risk and Threat Considerations
AI integrity failures create a different class of exposure from ordinary access failures: the environment can remain correctly authenticated while the model itself has been poisoned, replaced, backdoored, or subtly degraded. That makes the compromise harder to spot, because normal access logs may look healthy even as the output quality, policy behavior, or decision logic has changed.
Failure mechanism: Attackers or insiders can target model weights, training data, adapters, prompt templates, retrieval sources, or deployment artifacts to alter behavior without needing to defeat access control. The system may continue serving authorized requests while producing manipulated outputs.
Impact: Downstream workflows inherit the compromised decision engine, which can lead to unsafe automation, bad approvals, data leakage, or persistent trust erosion across every caller that relies on the model.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while SLSA and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Model integrity often depends on protected artifacts and secrets. |
| NHI-05 — Overprivileged NHI | AI systems with excessive permissions can alter model artifacts or retrieval paths. | |
| NHI-06 — Insecure Cloud Deployment Configurations | AI model integrity is often broken by misconfigured deployment and storage paths. | |
| Recommendation — Protect model and deployment secrets to prevent tampering paths. Restrict model and pipeline privileges to the minimum required. Harden deployment settings that can expose or replace model artifacts. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agentic systems can misuse delegated access even when model access is allowed. |
| Recommendation — Constrain agent privileges so compromised outputs cannot trigger broad actions. | ||
| SLSA | Supply-chain Levels for Software Artifacts | AI models and artifacts need provenance and integrity across the release chain. |
| Recommendation — Adopt provenance controls that verify model and artifact integrity before release. | ||
| CSA Cloud Controls Matrix | STA — Supply Chain Management and Assurance | AI model integrity depends on controlled sourcing, build, and release assurance. |
| Recommendation — Apply supply-chain assurance controls to model and pipeline artifacts. | ||
| MITRE ATT&CK | Enterprise Matrix | Model tampering and poisoning map to adversary tactics against integrity and trust. |
| Recommendation — Map integrity threats to attacker techniques and detect alteration paths. | ||
Practitioner Guidance
What to verify: Treat model versioning, artifact signing, training-data lineage, and release approvals as operational controls, not documentation extras. If you cannot prove what model or retrieval corpus is live, you do not have integrity, only access.
What good looks like: The team can attest to the approved model, detect unauthorized drift, and roll back quickly when behavior changes unexpectedly. For higher-risk deployments, pair that with restricted deployment rights, monitored change paths, and review of any component that can alter outputs materially.
Decision rule: If the AI system can influence other systems or decisions, prioritize integrity controls before expanding model access or automating more workflows. The more consequential the output, the less acceptable it is to rely on access control alone.
Practitioner takeaway: In AI security, authentication says who may ask the question, but integrity controls determine whether the answer comes from a trustworthy system.
Related resources from NHI Mgmt Group
- How do AI data controls differ from traditional access control?
- What breaks when AI models can access sensitive data without output controls?
- How do NHI and AI access controls differ from human access control?
- Why do data integrity and access control matter so much for AI assistants in security operations?