Fouad Matin

@fouadmatin

Over the last year, teams have been racing to add "AI" to their product in some form and there's been a dramatic growth in the amount of surface area that they have to manage.

If you're using a proprietary model like OpenAI or Anthropic, who has access to embeddings, fine-tuning data, or prompts? Training your own AI models, who has access to the model weights?

Or if you have to store customer data (e.g. video stream or code) as model inputs, who has access to that data?

It becomes really hard to manage, very fast.

Indent helps accelerate the product development process by enabling you to focus on creating value with AI, rather than spending time on manually granting and revoking access.

“Indent has been game-changer for us. As an AI infrastructure product, we have to balance rigorous security and fast access to assist customers. We're more secure than ever and haven't had to sacrifice our pace — it's the best of both worlds.”

Today, we're excited to share Indent for AI Products to help companies improve their security, without sacrificing speed.

Companies building AI products share a lot of similar risks as with any other market, like account compromise or broken access control, but one of the biggest differences is the sheer volume of data and access.

The security risk is split across three layers of the stack:

• Production — Where do the models run? How are they stored?
• Fine-tuning — Where does RLHF data go? Single or multi-tenant?
• Development — Who has access to the prompts or model code?

Whether you're on AWS, Google Cloud, or Microsoft Azure, it's important to implement the "principle of least privilege", and not to treat it like it's just a checkbox for compliance. If most engineers on the team can SSH into the production servers, that's fake least privilege.

The first step is shifting engineers to read-only access to production, like viewing logs or checking server status, and requesting temporary access for SSH or write permissions in production infrastructure.

This can be as simple as two IAM groups like prod-readonly with everyone and prod-admin that people get for a short period of time after providing a reason for access.

Next, there's fine-tuning and usage data that's likely stored in a cloud storage bucket or service provider like Gantry. For companies using a proprietary model, the core differentiator between competitors is the fine-tuning data combined with the prompts.

It should be locked down like crown jewels in a vault, especially if that data is generated from customers. It could contain PII or confidential information, and access to that customer data should be logically separated from access to the running systems.

Just because an engineer needs to restart a server, doesn't mean they should be able to see what queries users are submitting.

Finally, when developing an AI product, engineers need test data that looks like production but, critically, it should not be production data.

Locking production access behind an on-demand security firewall solves part of this problem and tools like Gretel can help generate synthetic data for testing. The remaining risk is the code for the model itself or the system prompts that instruct model execution.

Teams will typically implement role-based access control (RBAC) through GitHub Teams and grant the necessary level of permission based on team membership, for exampple:

• @exampleinc/platform-write — Write permission on repo
• @exampleinc/platform-admin — Admin permission on repo
• @exampleinc/platform — Used in CODEOWNERS on platform repo
• @exampleinc/ai-triage — Read + Triage on model repo

Indent is built to grant temporary access to engineers quickly through a Slack-based workflow. Requests are automatically routed based on your compliance policies and revoked after the approver’s set duration.

Certain resources can also be configured to instantly approve based on conditions like on-call status. With guardrails that expedite and protect the entire access lifecycle, your access control policies are followed every time without slowing engineers down.

Teams use Indent to:

• Grant temporary production access to engineers
• Auto-revoke access after a configurable duration
• Record comprehensive access logs for compliance audits
• Manage time-bound, granular access to customer and internal data

These on-demand security controls enable teams to move fast, without breaking things. Audit logs for every access change, and time-based revocation that happens instantly based on security policies.

The Indent free tier makes getting started easy and try on-demand access with your team. This can help your team complete requirements for compliance like SOC 2 and prepare for security audits.

With out-of-the-box integrations for your entire production stack, your team can shift toward temporary access without the management headache or disrupting engineers' workflows.

Ready to get started? You can either get a personalized demo and onboarding from our team or get started on your own: indent.com/setup