Spring AI Security

Version boundary

Target Spring Boot 3 and the project's compatible Spring AI 1.x line. Preserve the repository's managed coordinates and provider choices. The Java 17 tool boundary here is deliberately independent of Spring AI APIs. Wire it into the selected version's tool mechanism and verify that adapter separately.

Establish the trust boundary

Map user input, uploaded documents, retrieved chunks, memory, tool output and rendered model responses. All can contain attacker-controlled content. A prompt instruction such as "ignore malicious text", a delimiter, classifier or keyword denylist is not an authorization boundary. Record what the model can read and which effects its tools can cause.