Hospital Assistant: s3:* on Everything, a Poisoned Ticket, and a 7-Year Audit Duty

1. Prompt injection via ingested content (highest - it is already live). Untrusted external text entered the corpus and the assistant treats retrieved chunks as instructions. Gaps: no ingestion review or content scanning, no separation between data and instructions, no restriction on what the model can do with retrieved text (e.g., enumerate documents). Controls: treat the knowledge base as untrusted input, apply input and output guardrails, remove any tool capability that can list or exfiltrate documents, add a red-team regression suite, and quarantine/purge the poisoned document now.

2. Over-broad IAM (high, and cheap to fix). s3:* and bedrock:* on all resources means the retrieval function can read, delete, or rewrite every bucket and invoke any model action. Controls: least privilege - read-only on the specific knowledge base prefix, invoke only the specific model and knowledge base ARNs, no delete, resource-scoped conditions, and separate roles for ingestion versus retrieval.

3. PHI in a public chatbot (high, governance). A direct privacy incident outside any contractual control. Controls: approved-tenant tooling with no-training terms and a DPA, acceptable-use policy, DLP on egress, and an incident process - this one should already be logged as a breach assessment.

4. Unproven access accountability (medium, but blocking for the EU expansion). 30-day CloudWatch retention cannot satisfy 7 years, and default encryption with no customer-managed keys weakens the audit story. Controls: CloudTrail data events for S3, structured application logs to S3 with Object Lock, KMS customer-managed keys, and network isolation via VPC endpoints so traffic never traverses the public internet.

Separate the two things '7 years' is being asked to cover.

• Access events (who queried what, when, from where): retain 7 years, immutable.
• Content (prompts and model responses, which may contain PHI): retain only as long as clinically or legally necessary, redacted.

Retaining every prompt for 7 years creates a large, attractive PHI archive and conflicts with minimisation principles. The defensible pattern:

1. CloudTrail data events on the knowledge base bucket and model invocations, delivered to a dedicated log-archive account - this is the 'who accessed what' evidence.
2. Application logs capturing user identity (via SSO subject), document IDs retrieved, model and version, latency, guardrail outcomes, and a hash of the prompt rather than the text. Full content only when a flag is set (e.g., a safety event), with a defined short retention.
3. Storage: S3 with Object Lock in compliance mode, versioning, KMS customer-managed key, and a bucket policy that denies deletion to everyone including administrators. Lifecycle: 90 days in an interactive tier, then archive tier for the remainder.
4. Residency: pin the EU deployment to an EU region, disable cross-region inference for that workload, keep the log archive in-region, and put a DPA and sub-processor list behind the partner arrangement. Confirm the inference option chosen does not route prompts outside the EU.
5. Queryability: an index over access events so a DSAR or audit request can be answered in hours, not by scanning seven years of text.

Immediate remediation

1. Identify and quarantine the document (and any variant) - remove it from the index, not just the bucket, and force a re-index of affected shards.
2. Assess exposure: did any session retrieve it, and did any output contain document names or clinician names? CloudTrail plus retrieval logs answer this; treat a 'yes' as a privacy incident.
3. Add ingestion validation: provenance record per document, source allow-list, scanning for instruction-like patterns, and a human approval step for any content originating outside the controlled document pipeline. Support tickets should never be ingested automatically.

Ongoing defence - assume retrieval content is hostile

• Instruction hierarchy: system prompt states retrieved text is data to be quoted, never instructions to be followed; the model has no capability whose misuse matters (no document listing, no arbitrary fetch, no write actions).
• Guardrails on input and output: block patterns that request enumeration or instruction override; block responses that name individuals or dump document inventories. This is defence in depth, not the primary control.
• Least privilege at the tool layer: even if the model is persuaded, the IAM role it acts through cannot list the bucket or read outside the knowledge base prefix.
• Detection: alert on anomalous retrieval (spikes in queries retrieving the same chunk, queries containing 'ignore previous instructions'), and on unusual output volume.
• Testing: a maintained red-team suite of injection documents re-run on every model, prompt, or index change; a regression here is a release blocker.