Most AI security conversations begin too late. They start with the model, asking whether it can be jailbroken or whether its output can be trusted. The meaningful risk usually starts around it: a tool call with broad permission, a data store without a trust boundary, or an identity that has not been verified.
Model the system as a chain of decisions. What input enters the system? Which tools can it invoke? What data can it see? What action can it take, and what independent signal confirms that action is appropriate? This moves threat modeling from a speculative exercise to an engineering design tool.