AI Technologies and Controls · Topic 2 of 7
AI in Enterprise Architecture, RAG and Agents
Advising on AI within enterprise architecture: deployment options, shared security services, reference patterns, and securing RAG and AI agents.
- 5 min
- Integrate AI into EA with principles, reference patterns, shared services and architecture review.
- Choose the deployment model from data classification and risk tier.
- An AI gateway centralizes authentication, filtering, limits and logging for model traffic.
What it is
Enterprise architecture (EA) describes how the organization's business processes, data, applications and technology fit together. AI should enter that picture as a governed capability, not as a collection of one-off projects that each solve security differently.
The security manager advises on how AI integrates with EA: which deployment model fits each use, which shared security services AI must use, and which reference patterns teams follow for common designs such as retrieval-augmented generation (RAG) and AI agents.
How it works
AI as part of enterprise architecture
| EA practice | AI application |
|---|---|
| Architecture principles | For example: AI uses enterprise identity; model output is untrusted; data stays in approved regions |
| Reference architectures | Approved patterns for chat assistants, RAG, agents and model hosting |
| Shared services | Identity, secrets management, key management, logging, data loss prevention and monitoring reused by every AI system |
| Architecture review board | Reviews new AI designs, with security and data governance represented |
| Technology standards | Approved model providers, hosting platforms and AI gateways |
| Roadmap | Planned AI capabilities aligned with business strategy |
Reusing shared services gives consistent control and visibility. An AI system with its own separate identity store, logging and keys is harder to monitor and to respond to.
Deployment options
| Option | Strengths | Trade-offs |
|---|---|---|
| Public model API | Fast, capable, little infrastructure | Data leaves the organization; depends on vendor terms and availability |
| Model hosted in the organization's cloud tenancy | More control over data location and access | More operational responsibility |
| On-premises or private hosting | Maximum control for sensitive data | Cost, capacity, skills; smaller models |
| On-device or edge | Data stays local; works offline | Limited capability; harder to update and monitor |
| AI embedded in SaaS | No build effort | Least control; depends on vendor configuration |
The right choice follows the data classification and risk tier of the use case. Restricted data may require private hosting even when a public API would be cheaper.
AI gateways
Many organizations route all model traffic through an AI gateway: a central service between applications and model providers. It enforces authentication, applies input and output filtering, redacts sensitive data, sets rate and cost limits, logs consistently and lets the organization switch providers. It is the AI equivalent of a secure web gateway or API gateway.
Securing retrieval-augmented generation
RAG lets a model answer from the organization's own content by retrieving relevant documents at query time and adding them to the prompt.
| Risk | Control |
|---|---|
| Users see content they should not | Permission-aware retrieval that applies source access rights per user |
| Poisoned or injected documents | Curate sources, control who can add content, scan ingested content |
| Sensitive data in the index | Classify sources before indexing; exclude or redact restricted data |
| Stale content | Synchronize deletions and permission changes from the source |
| Weak vector store security | Authentication, encryption and segregation per tenant or data domain |
Securing AI agents
An AI agent uses a model to plan and carry out tasks by calling tools, such as sending email, querying databases or making changes in other systems. Agents raise the stakes because model errors become actions.
| Control | Purpose |
|---|---|
| Least privilege tools | Only the functions and data the task needs |
| Act with the user's rights | The agent cannot exceed the permissions of the person it serves |
| Human approval for high-impact actions | Payments, deletions, external messages and access changes need confirmation |
| Sandboxing | Run code and browsing in isolated environments |
| Limits | Caps on steps, spend and rate |
| Full action logging | Every tool call recorded and attributable |
| Vetted tool connections | Tool servers, plugins and connectors approved like any integration, including those using tool protocols such as the Model Context Protocol |
Multi-agent designs, where agents call other agents, need the same controls at each hop. Trust does not pass automatically from one agent to the next.
A worked example
Three business units have each built their own chat assistant, with separate API keys stored in code, no common logging and different providers.
The security manager proposes a reference architecture through the architecture review board: all model calls through one AI gateway using enterprise identity, keys in the secrets manager, logs into the security monitoring platform, and a standard RAG pattern with permission-aware retrieval. Existing assistants migrate on a roadmap; new ones must use the pattern.
How the exam asks about this
- "What is the BEST way to ensure consistent security across many AI projects?" Approved reference architectures and shared security services through enterprise architecture.
- "Which control MOST reduces the risk of an agent making unauthorized payments?" Human approval for high-impact actions, with least privilege tools.
- "Which deployment option BEST fits a use case processing highly restricted data?" A privately hosted model under the organization's control, as determined by data classification and risk.
What to remember for the exam
- Integrate AI into EA with principles, reference patterns, shared services and architecture review.
- Choose the deployment model from data classification and risk tier.
- An AI gateway centralizes authentication, filtering, limits and logging for model traffic.
- RAG needs permission-aware retrieval and curated, classified sources.
- Agents need least privilege, the user's own rights, human approval for high-impact actions and full logging.
Agents turn model mistakes into real actions. Any tool an agent can call should be treated as if an attacker might trigger it through injected content.
Common mistakes
Letting every team build AI its own way. This multiplies keys, logs and providers and leaves gaps that no one sees.
Indexing everything into RAG. Sensitive and unvetted content in the index becomes reachable through the assistant.
Approving tools without reviewing them. A plugin or tool server is an integration with privileges and must go through the same review as any other.
Check yourself
What does permission-aware retrieval do?
It applies the source system's access rights for the requesting user, so the AI only retrieves content that user may see.
Why route model traffic through an AI gateway?
To enforce authentication, filtering, redaction, limits and logging consistently and to make provider changes easier.
Which agent actions should require human approval?
High-impact actions such as payments, deletions, external communications and access changes.
Topic 2 of 7 in AI Technologies and Controls
Test yourself on AI Technologies and Controls
The full ISACA AAISM question bank has 747 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.