Insider Threat in Departmental AI Systems

The breach report blamed prompt injection. The timeline showed a contract DBA exporting the vector index to a laptop 'to debug relevance' at 21:40, then syncing the laptop to a personal drive. The citizen who later received a strange answer was a sideshow. The insider was the plot.

Departmental AI creates new insider shapes. RAG admin is a read on the whole corpus. Prompt-policy admin is a write on the institution's voice. Eval sets are copies of production. Tool secrets are keys to registers. None of those shapes are in last decade's joiner-mover-leaver checklist unless you put them there.

This guide is for DPOs and CISOs. 17 August 2026. Not legal advice. We are not accusing your staff. We are refusing the fairy tale that the threat is only a teenager on the public URL. CERT-In still wants listed incidents reported in six hours when they meet the annexure. DPDP still wants security safeguards. Insiders are how both get tested.

Prcept will not train on your corpus. That does not stop your contractor from copying it. Your file has to.

Three kinds of insider

The privileged. They have the grant on purpose. Risk is excess grant, shared accounts, and no two-person rule on corpus export or secret read.

The hurried. They want the demo to work, so they paste production into a hosted notebook, or they open the gap with a personal hotspot. Motive is success. Effect is still a transfer.

The sold or coerced. Rarer, louder when it happens. Design as if they exist: no single person should be able to export the whole live corpus and the write secret in one sitting.

The new objects to lock

Corpus and index admin. Treat as a register. Two-person export. Watermark. Log.

Prompt and policy store. A changed refusal policy is a speech incident waiting for a screenshot.

Eval and fine-tune sets. If they contain personal data, they are production. They follow DPDP maps and erasure.

Tool secrets and break-glass. Time-bound, dual control, not in tickets, not in group chats.

Traces and logs. Operators can leak from the SIEM as easily as from the app. The logging article is the redaction half of this problem.

Insider-relevant objects on an agent estate. If a row has one owner and no log, it is a single point of betrayal.

Object	Minimum control	Common failure
RAG admin	Two-person export, ACL, log	One contractor, laptop copy
Prompt store	Change ticket, diff, dual review	Hot-edit in production
Eval set	Purpose, retention, no live extras	Prod dump 'for quality'
Tool secret	Vault, short TTL, no chat	Paste in a ticket
Break-glass	MFA, ticket, 30-minute TTL	Standing admin 'just in case'
Traces	Redact, role-based open	Full transcript for 'debug'

Joiner, mover, leaver — rewritten

Joiner: no RAG admin because they are 'the AI person'. Grant the unit they will actually run.

Mover: when an officer leaves the cell, their ability to open traces and to approve prompt changes dies the same day as their MIS roles. Agents create shadow roles. Put them on the same leaver form.

Leaver: rotate every secret they could have seen. De-authorise their eval copies. If they had a laptop extract, treat it as an incident until you know otherwise. Politeness is not a rotation policy.

Vendors are joiners too. Their engineers rotate. Your grant table should not assume the same face for a year.

• No shared 'ai-admin' password.
• No production extracts on personal mail or drives.
• No unexplained 21:40 exports.
• Alert on bulk retrieval and on secret read.
• Tabletop a sold admin once a year, awkwardly.

When the insider is the incident

Unauthorised export of personal data is a leak. Unauthorised use of a tool identity is unauthorised access. Map to CERT-In's existing annexure. Do not wait to decide whether an insider 'counts' as cyber. The directions are about incidents, not about strangers.

Preserve the log. Do not let the same admin delete the trail. Ship copies to a store they do not own.

HR and vigilance have their own paths. Do not let a cyber filing become a substitute for those, or the reverse. Parallel, with counsel.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

We trust our people.

Trust is not a control. Trusted people still hurry. Trusted people still get phished. Trusted people still leave. Design for the badge.

Background verification is enough.

BV is a joiner filter. It is not a grant table, not a dual control, and not a leaver rotation.

Insiders are an HR topic.

HR owns conduct. You own the objects. Both have to show up in the same tabletop.

If we lock export, we cannot improve the model.

Improve on a scrubbed or synthetic set in a clean room. If you cannot improve without a laptop full of citizens, you are not improving. You are copying.

A three-week insider pass

Assume one privileged, one hurried, one sold. Write the objects they can touch.

1. Week 1: inventory RAG admin, prompt editors, secret readers, trace openers, vendor engineers.
2. Week 1: kill shared accounts. Put names on grants.
3. Week 2: dual control on export and on production prompt change.
4. Week 2: leaver form rewrite; rotate a departed vendor as a drill.
5. Week 3: alert on bulk export and night-time secret read.
6. Week 3: tabletop with HR and vigilance in the room. Write the CERT-In mapping for an insider leak without invented codes.

How this shows up in the file

Subject: Insider controls — agent estate [name].

Privileged roles: [named]. Dual control required for: corpus export, production prompt change, tool-secret read. Leaver rotation: same day, including vendor faces. Debug extracts: clean room only, no personal drives. Logs of these actions retained 180 days in a store the acting admin cannot delete. CERT-In mapping uses existing types. Not legal advice and not a vigilance finding.

Trust is not listed as a control.

What to tell vigilance without over-claiming

Vigilance is not a SOC and the SOC is not vigilance. Give them the object list: who can export the corpus, who can edit a production prompt, who can read a tool secret. Give them the dual-control rule. Do not give them a lecture on prompt injection unless an insider used it.

If an export happened, preserve the log in a store the exporter cannot delete. Map the effect to CERT-In's existing annexure if it is a leak or unauthorised access. Do not invent an insider-AI type. Parallel the HR file. Counsel keeps the two files from contaminating each other.

A yearly awkward tabletop with HR in the room is cheaper than a messaging-group leak. Schedule it. Name the hurried contractor in the scenario, not only the sold villain. Hurry is the common case.

This article is informational field guidance for Indian public institutions, not legal, procurement, security-accreditation or engineering advice. Confirm against the current Gazette, GFR, GeM term, CVC instruction, CERT-In direction, DPDP text, departmental manual and your counsel before you file it.

How to fail this before citizens do

“Insider Threat in Departmental AI Systems” is a path problem. A P6 Compliance/DPO should be able to name the tool, the identity, the secret and the egress that would make “insider threat AI government” real. If the only control is a network diagram from last year, you have a story, not a threat model.

The badge opens more doors than the jailbreak. Contractors with RAG admin, officers with export rights, and vendors with break-glass are your real agent threat model. Air-gap is not automatically secure. Prompt injection is not a conference joke when the agent can write a ticket. CERT-In still wants specified logs in India and incidents on a six-hour clock. Write those clocks into the runbook.

1. Red-team the write tools, not only the chat UI.
2. Kill undeclared outbound paths on staging.
3. Redact personal data from logs you will actually keep.
4. Scope a pentest that includes RAG and connectors.
5. Cap metered spend so a loop cannot empty a budget.

Close this loop before the next CAB

Put “Insider Threat in Departmental AI Systems” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P6 Compliance/DPO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “insider threat AI government” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.