Module 7 — Security, Governance and Ethics
What this module is about
You have built a system that works. The ontology defines the meaning. The agents act on it. The workflows orchestrate them. The context packages tell each agent what to do. The evaluation suite proves it does its job.
But here is a question you cannot avoid: what happens when someone tries to break it?
And a harder question: what happens when the system works perfectly but causes harm anyway?
Security, governance, and ethics are not afterthoughts. They are not the compliance checklist you fill out after the product ships. They are architectural concerns as fundamental as the data model or the agent design. A system that works but is not secure is a liability. A system that is secure but ungoverned is unpredictable. A system that is governed but unethical is dangerous.
Think of a hospital. A hospital that treats patients effectively but leaves its medicine cabinet unlocked will eventually have drugs stolen. A hospital that locks every cabinet but has no clear protocols for who can prescribe what will paralyze its own staff. A hospital that has tight security and clear protocols but discriminates against certain patients has failed in the most important way.
This module teaches you to think about all three: security (protecting the system from attack), governance (controlling how the system operates), and ethics (ensuring the system does what is right).
Learning outcomes
By the end of this module, you will be able to:
- Identify and model threats specific to AI systems, including prompt injection, data poisoning, model manipulation, and social engineering
- Design governance structures with access controls, audit trails, approval workflows, and compliance frameworks
- Apply ethical reasoning to architecture decisions, including bias detection, fairness metrics, transparency, and human oversight patterns
- Conduct security audits of AI systems using structured assessment methodologies
- Build ethical decision frameworks that make values explicit, measurable, and enforceable
Module map
| # | Content | Type | Estimated time |
|---|---|---|---|
| 1 | Threat modeling — what can go wrong and how | Lesson | 90 min |
| 2 | Governance and access control — who decides what | Lesson | 90 min |
| 3 | Ethics and alignment — doing what is right | Lesson | 90 min |
| A | Security audit of your system | Application | 3 hours |
| B | Ethical decision framework | Application | 2 hours |
| -- | Assessment | Evaluation | 30 min |
What you will build
- A threat model that maps attack vectors, risks, and mitigations for your AI system
- A governance model with access controls, audit requirements, approval workflows, and change management procedures
- An ethical audit identifying bias risks, fairness gaps, transparency requirements, and human oversight needs
- A security assessment applying structured methodology to the system you designed in previous modules
- An ethical decision framework with explicit values, decision criteria, and accountability structures
Prerequisites
- Module 6 completed (you need evaluation and observability infrastructure to monitor security and governance controls)
- All artifacts from Modules 1-6 (your system design is what you will be securing, governing, and auditing)
Estimated time
10-12 hours total (lessons + applications + assessment)