Derive a blueprint from existing apps
Three GenAI assistants reviewed this quarter share one skeleton and the same three failing OWASP controls. Daedalus keeps the skeleton, writes the failures in as requirements, and publishes the result as a blueprint every future assistant is held against.
Sources read2Pattern extracted3Published
Three reviewed assistants
3 reviews · 6 of 6 weakness checks failedHighlight shared pattern
HR Policy AssistantPeople Services Digital · Tomas Berg
7112 components · 4 OWASP LLM controls failingOpen controls →
IT Service Desk AssistantIS Service Management · Aisha Khan
7412 components · 4 OWASP LLM controls failingOpen controls →
Sales Proposal AssistantDrives Sales Excellence · Lukas Hoffmann
6612 components · 4 OWASP LLM controls failingOpen controls →
Shared pattern extracted
Internal GenAI assistant with retrieval · v1.0Drawing the reference
0 of 140 components · 16 flows
Lifting the components all three assistants share, in the order a request meets them
Shared weaknesses — called out, not copied
Retrieval ignores per-user permissionsLLM08 · Vector and Embedding WeaknessesLLM02 · Sensitive Information Disclosure
3 of 3 failCSF PR.AA-05 · PR.DS-01“The index stores document chunks and embeddings; access to the assistant is granted to all employees through the corporate identity provider.”HR Policy Assistant · §6. Retrieval · p.3
What the blueprint does insteadRetrieval enforces per-user permissions at query timeThe ingestion job stores each document's access control list with its embedding, and the chat API passes the requesting user's group memberships as restricts on every similarity search. The index therefore returns only what the source repository would let that user read; a shared index with no restricts is the failure all three source reviews shared.
Nothing screens prompts or responsesLLM01 · Prompt Injection
3 of 3 failCSF PR.PS-06“The user's message and the retrieved chunks are passed to the model without any screening, and the model's answer is returned to chat-web without any screening beyond Gemini's default safety settings.”HR Policy Assistant · §7. Generation · p.3
What the blueprint does insteadPrompts, retrieved passages and responses are screenedModel Armor sits between the chat API and Gemini in both directions: prompts and retrieved passages are screened for injection and jailbreak attempts before they reach the model, and responses are screened with sensitive data protection filters before delivery. Retrieved content is treated as untrusted input.
Internal GenAI assistant with retrieval · v1.014 components · 16 flows · 17 required controls · 10 guidance entries · derived from 3 reviews on 8 Sept 2026
Open blueprint