Courts IT is designing a legal-research assistant for clerks. Which design choice best layers AI-specific security into the solution?

A courts legal-research assistant for clerks introduces AI-specific risks—prompt injection, unsafe tool use, leakage of privileged matter in outputs, and jailbreaks—that encryption and role-based access alone do not see. The design choice that layers AI security into the solution is a prompt firewall and output filter between users and the legal research model. Those components inspect and constrain inputs before they reach the model and sanitize or block unsafe outputs before clerks act on them, giving Courts IT enforceable control points aligned with judicial confidentiality expectations. Enforcing SSO authentication and TLS encryption for model chat sessions for clerks fails because it secures the transport layer but leaves prompt injection, exfiltration, and policy-violating answers unmediated. Encrypting stored prompts and case-law completions at rest for clerk role-based access fails by concept: it secures storage and permissions, not semantic abuse of the model channel. Grounding assistant answers in the case-law index to filter malicious prompts for clerks fails because grounding retrieves context but does not inspect or block malicious inputs, leaving prompt injection, unsafe tool use, and leakage of privileged matter unmediated. Exam caveat: AAISM distinguishes AI-native controls (prompt/output mediation) from generic IT controls; encryption and role-based access alone are not an AI architecture answer for judicial assistants. Operational check: Place the research assistant behind prompt firewall and output-filter services with deny-by-default rules for sealed-matter patterns, log blocked events to the SIEM, and prohibit paths that rely only on SSO and TLS without prompt inspection in the architecture diagram.