AFP engineering · October 15, 2026
Build agents that keep authority under control.
25 in-depth articles and five interactive labs on LLM abuse and fraud prevention: why failures happen, where guardrails belong, and how to verify the final effect.
ADK · Model Armor · LangGraph · NeMo · MCPChoose a learning path
Start with attack mechanics if you are new to prompt injection. Move through ADK enforcement to understand model, tool, and approval boundaries. Compare other guardrail methods by the controls they provide, then work through fraud workflows and release evidence. Every chapter includes a worked case, implementation detail, failure tests, and primary references.
For a payment or support agent, prioritize tool authorization, exact-action approval, refund ledgers, account recovery, and incident response. For a read-only RAG assistant, prioritize indirect injection, source provenance, memory, output release, and tenant access. Content filters help, but authority comes from authenticated evidence and independently enforced service rules.
The labs run deterministic synthetic models in your browser. They do not call an LLM, inspect real people, send messages, or move money. Change one assumption at a time, inspect the decision trace, and export the result. The teaching outcomes are deliberately distinct from measured production security performance.
Attack mechanics and threat modeling
Why LLM Abuse and Fraud Prevention Needs a Threat Model
Map attacker goals, trust boundaries, business losses, and enforceable controls before selecting an LLM guardrail.
CHAPTER 02How LLM Jailbreaks Happen: Instruction Confusion and Context Pressure
Understand direct jailbreak mechanisms, long-context influence, attack transfer, and what model-level defenses can and cannot prove.
CHAPTER 03Indirect Prompt Injection in RAG: When Retrieved Data Becomes an Instruction
Trace poisoned documents through retrieval, summarization, tool use, and answer rendering, then enforce source-specific authority.
CHAPTER 04Multi-turn Jailbreaks and Memory Poisoning: Preserve Provenance Across Time
Protect conversation state, summaries, and persistent memory from gradual privilege changes and untrusted instructions.
CHAPTER 05Multimodal Prompt Injection: PDFs, OCR, Images, and Voice Boundaries
Trace how extracted text and synthetic media can influence an agent, and design modality-aware screening and verification.
ADK enforcement
ADK Guardrail Callbacks: Enforce the Right Boundary Before Side Effects
Place checks around model and tool execution, return explicit denials, and test that rejected ADK calls have no side effects.
CHAPTER 07ADK Security Plugins: Shared Policy, Ordering, and Short-circuit Hazards
Centralize cross-agent checks while testing plugin precedence, cached responses, and per-request isolation.
CHAPTER 08ADK Tool Authorization: Bind User Identity, Tenant Scope, and Capabilities
Design narrow tools whose backend permissions remain correct even when the model proposes unauthorized arguments.
CHAPTER 09ADK Human Confirmation: Bind Approval to the Exact Action
Build confirmation flows that resist changed arguments, stale permissions, replay, and misleading approval screens.
CHAPTER 10ADK Output Guardrails and Streaming: Prevent Disclosure Before Release
Design output validation around irreversible streaming, tool results, generated links, and authoritative action status.
Other guardrail methods
Model Armor in an AFP Pipeline: Coverage, Failure Policy, and Evidence
Integrate a screening service without confusing a successful API call with complete inspection or permission to act.
CHAPTER 12Gemini Safety Settings and Business Guardrails: Different Scores, Different Jobs
Configure content filtering deliberately while keeping fraud, authorization, and action limits in application policy.
CHAPTER 13LangChain Guardrails and LangGraph Approval Flows: Enforce Across Resume
Compare middleware screening with durable workflow interrupts, and prevent replay or stale approval from authorizing effects.
CHAPTER 14NeMo Guardrails and Policy-as-Code: Separate Dialogue Rules from Authority
Design input, retrieval, dialogue, execution, and output controls with explicit policy ownership and testable business invariants.
CHAPTER 15MCP Tool Security for AFP: Authorization, Tool Metadata, and Egress
Protect an agent from overprivileged MCP integrations, misleading tool descriptions, token misuse, and unsafe outbound requests.
Abuse and fraud workflows
Refund Fraud in LLM Agents: Atomic Reservations, Approval Binding, and Replay
Protect refund workflows from persuasive claims, concurrent requests, changed destinations, and uncertain processor outcomes.
CHAPTER 17Account Takeover and Deepfake Requests: Identity Controls for LLM Support
Keep conversational persuasion, synthetic media, and recovery claims from becoming account access or payment authority.
CHAPTER 18LLM Abuse Velocity: Quotas, Campaign Signals, and Bounded Agent Work
Limit repeated misuse and runaway workloads using shared budgets, behavioral evidence, and fair enforcement.
CHAPTER 19LLM Fraud Scoring: Base Rates, Evidence, and Human Review Capacity
Use models to organize fraud evidence without turning uncertain scores into automatic accusations or unsafe approvals.
CHAPTER 20Preventing Outbound Abuse: Consent, Recipient Scope, and Agent Messaging
Keep email, messaging, and document-sharing tools from turning an LLM assistant into an unapproved bulk-action service.
Evaluation and operations
Red-team Evaluation for AFP: Test Attempts, Effects, and Legitimate Use
Build authorized synthetic evaluations that distinguish model violations, blocked tool calls, and actual business harm.
CHAPTER 22Guardrail Metrics: Precision, Recall, Escape Rate, and Review Burden
Choose metrics that reveal both missed harm and unnecessary friction, with explicit denominators and production assumptions.
CHAPTER 23Guardrail Outages and Fail-closed Design: Keep Useful Service Without Unsafe Actions
Define per-capability fallback behavior for classifier timeouts, policy failures, budget-store outages, and partial inspection.
CHAPTER 24AFP Observability and Incident Response: Reconstruct Decisions Without Leaking Data
Build privacy-conscious decision traces, containment controls, and evidence-driven recovery for LLM abuse and fraud incidents.
CHAPTER 25A Production AFP Blueprint: From Read-only ADK Pilot to Controlled Actions
Combine threat modeling, guardrails, authorization, evaluation, rollout, and incident readiness into a staged deployment plan.
Five hands-on experiments
Prompt injection: inspect the trust boundaries
Compare synthetic cross-tenant reads and data exports while changing model behavior, authorization, egress, and final-output checks.
INTERACTIVE LABADK plugin ordering and short-circuit lab
Inspect policy, cache, local callback, and backend paths to see how a returned result can skip later checks and release private data.
INTERACTIVE LABAFP detector thresholds and review-capacity lab
Explore synthetic prevalence, true-positive and false-positive rates, precision, missed cases, and the review workload they create.
INTERACTIVE LABRefund authorization, replay, and ledger-race lab
Compare approval binding, expiry, tenant ownership, idempotency, and atomic reservations using a synthetic 100-unit refund ledger.
INTERACTIVE LABAgent abuse budgets and retry-amplification lab
Inspect how child-task fan-out and retries multiply work, then compare request-only admission with atomic job and tenant budgets.