What are OpenAI's security best practices for building safe LLM applications and agents?

OpenAI's security best practices for building safe LLM applications and agents emphasize layered controls, treating the model as one safety layer within a larger system that includes authentication, rate limiting, and human review. These practices aim to mitigate risks such as prompt injection, sensitive information disclosure, and excessive agency.

• Authentication and Access Control: Require users to register and log in, bind activity to durable account identifiers, and use stronger verification for higher-risk workflows. Apply rate limits by user, organization, IP, credential, and tool action, and monitor for abnormal consumption patterns. Do not expose raw model access through unauthenticated public endpoints. This aligns with NIST AI RMF Govern and Manage by converting usage policies into documented ownership and abuse response.
• Input and Output Constraints: Constrain free-form inputs, limit output tokens, and use validated choices instead of open text when possible. For enterprise assistants, constrain retrieval sources, use structured output schemas, cap context size, and separate untrusted content from trusted instructions. Do not rely solely on prompts like "ignore malicious instructions" for prompt injection defense. This addresses OWASP LLM01 Prompt Injection by treating user, document, web, and tool-result text as untrusted.
• Data Handling and Least Privilege: Follow least data and least retention principles, avoiding the sending of secrets, passwords, or regulated data unless approved and logged. Use data classification labels, redact unnecessary fields, and maintain application-side audit trails. Store API keys in managed secret stores, rotate them, scope them by environment, and monitor for unusual use. This mitigates OWASP LLM02 Sensitive Information Disclosure by redacting secrets and segmenting retrieval.
• Human Review and Guardrails: Implement human review for generated code, security advice, legal, financial, medical, or operational decisions before they affect production systems or people. The reviewer needs access to original evidence, not just the model's summary. For agents, use input, output, and tool guardrails, with blocking guardrails for side-effecting tools before execution. This aligns with NIST AI RMF Manage by enforcing human-in-the-loop for critical actions.
• Tool Scoping and Sandboxing: Limit tool scope, require approvals for side effects, and use server-side policy checks for every action. Sandbox code execution, browsing, and computer-use workflows away from production credentials. This addresses OWASP LLM06 Excessive Agency and OWASP ASI02 Tool Misuse and Exploitation by limiting tool scope and applying rate limits.
• Monitoring and Adversarial Testing: Use moderation APIs or equivalent classifiers at both input and output boundaries, considering user role, use case, and other factors. Log prompts, retrieved sources, tool calls, approvals, outputs, and policy decisions with privacy controls. Red-team direct and indirect prompt injection before launch and after every material change. This aligns with NIST AI RMF Map and Measure by measuring jailbreak, prompt injection, and data leakage rates.