# DatAInsights Composer Security

The DatAInsights Composer sends the user prompt and dataset metadata to an AI model, and turns the reply of the AI model into Grid, Chart, and Gauge components. The AI service, user access, and data are all part of the application. Security is therefore shared between the DatAInsights Composer and the app. This article describes the built-in protections and what the application should take care of separately.

## Responsibility Model

The following table lists:

* The DatAInsights Composer behaviors that relate to app and data security.
* Additional application enhancements that can improve security.

<table>
	<colgroup>
		<col style="width: 24%" />
		<col style="width: 38%" />
		<col style="width: 38%" />
	</colgroup>
	<thead>
		<tr>
			<th>Area</th>
			<th>What the component covers</th>
			<th>What your application covers</th>
		</tr>
	</thead>
	<tbody>
		<tr>
			<td>AI Service Connection</td>
			<td>
				- Calls the registered AI client (or custom backend).<br />
				- Passes an <code>AbortSignal</code> to the transport and aborts it when the user stops the request, submits a new prompt, or the component unmounts.<br />
				- Sets no timeout and no request size limit.
			</td>
			<td>
				- Configures and secures the AI service, including endpoint, credentials, and encrypted connection.<br />
				- Sets timeouts, request size limits, and output limits on the endpoint, and passes the <code>signal</code> to <code>fetch</code> so that a cancelled request stops the HTTP call.
			</td>
		</tr>
		<tr>
			<td>User Access</td>
			<td>No authentication or authorization.</td>
			<td>Applies restrictions through app authentication and authorization.</td>
		</tr>
		<tr>
			<td>Datasets</td>
			<td>
				- Sends metadata to the AI model: the <code>id</code> and <code>description</code> of each dataset, and the <code>name</code>, <code>type</code>, <code>label</code>, and <code>description</code> of its fields. The optional descriptions and labels are sent only when you define them. The <code>label</code> of the dataset is not sent.<br />
				- Does not send data items to the AI model.<br />
				- When the user refines a component, also sends its current configurations, which can include filter values. The built-in prompts refuse more than 100,000 characters of configurations, so that refine fails and is not sent.<br />
				- Works in-memory with all provided datasets and data items in the <code>datasets</code> prop or <code>onDataProcess</code> event.
			</td>
			<td>
				- Decides which datasets, fields, and items the user can see, and passes only those to the DatAInsights Composer.<br />
				- Returns from <code>onDataProcess</code> only the items the user can see. The handler runs in application code and receives the dataset, including its items.<br />
				- Keeps the dataset and field catalog small and curated, because a large one raises the cost and latency of every request.<br />
				- Pages or pre-aggregates large datasets on the server.
			</td>
		</tr>
		<tr>
			<td>Prompts</td>
			<td>
				- Passes prompts through the AI client without sanitizing control characters or markup-like content.<br />
				- <code>maxPromptLength</code> limits the input control but is unset by default and can be bypassed in the browser.
			</td>
			<td>Sets a prompt length limit and applies additional custom validation, rate limits, and usage quotas.</td>
		</tr>
		<tr>
			<td>AI Responses</td>
			<td>
				- Checks the response structure, including component configurations and field names.<br />
				- The default AI client requests structured JSON output, but a transport may ignore the schema. It rejects malformed JSON and responses over 2 million characters.<br />
				- Sanitizes AI responses into supported configurations and drops unknown field references.<br />
				- Limits number format strings to 100 characters and accepts only Kendo number and date formats, optionally wrapped in a <code>{0:...}</code> placeholder. <code>validateConfig</code> applies the same check.<br />
				- The DatAInsights Composer does not execute AI output as code or HTML.<br />
				- The DatAInsights Composer always renders titles, descriptions, messages, and errors as encoded text.<br />
				- Contains rendering failures of a generated component in an error boundary, so that the rest of the page keeps working.
			</td>
			<td>Decides how much to trust the generated result. Validates values such as formats, colors, and numbers.</td>
		</tr>
		<tr>
			<td>Saved State and History</td>
			<td>
				- Raises events with the configurations and the History items, such as <code>onConfirm</code>, <code>onHistoryItemCreate</code>, and <code>onHistoryItemRestore</code>.<br />
				- Validates the configurations that you supply or restore against their datasets before it renders them.<br />
				- Does not store or persist any state.
			</td>
			<td>
				- Stores the configurations and the History securely, and verifies them before you restore them.
			</td>
		</tr>
		<tr>
			<td>Logging and Auditing</td>
			<td>
				- Raises events such as <code>onPromptSubmit</code>, <code>onConfigChange</code>, <code>onConfirm</code>, <code>onHistoryItemCreate</code>, and <code>onError</code>.<br />
				- Passes the raw error and the submitted prompt to <code>onError</code>.
			</td>
			<td>
				- Logs user prompts, component configurations, and displayed data. Redacts sensitive information, including the prompt and the error in <code>onError</code>, before logging it.<br />
				- Treats the <code>onConfirm</code> and History payloads as user data and applies retention controls to logs and persisted History.
			</td>
		</tr>
	</tbody>
</table>

A [custom AI client](https://www.telerik.com/kendo-react-ui-develop/components/datainsights-composer/controlled-mode#controlled-with-a-custom-ai-client) should pass raw model output through [`toDatAInsightsComposerAIResponse`](https://www.telerik.com/kendo-react-ui-develop/components/datainsights-composer/api/todatainsightscomposerairesponse). The component validates configurations from every client, but custom clients are responsible for sanitizing other model-derived response values. When you build a configuration yourself, run it through [`validateConfig`](https://www.telerik.com/kendo-react-ui-develop/components/datainsights-composer/api/validateconfig) before you pass it to `applyDataOperations`. The filter is bounded, and a filter beyond the limits matches no rows.

## Trust Boundaries and Entry Points

The application should focus on the following potentially harmful inputs or potentially sensitive outputs:

* **User prompts**—Free text typed by the user is the main route for prompt-injection attempts. The React component does not sanitize prompts; validate them and enforce a length limit on your backend. The `maxPromptLength` property is unset by default and can be bypassed in the browser.
* **Dataset metadata**—The `id` and `description` of each dataset, and the `name`, `type`, `label`, and `description` of each field, are sent to the AI model by design. If these come from user input or external systems, sanitize them too. Do not include sensitive information in dataset metadata. The React component inserts dataset and field descriptions directly into the system prompt, so keep them trusted and host-curated.
* **System prompt customization**—The built-in prompt tells the model to treat the user prompt and the dataset text as data, not as instructions. If you change the prompt with the `transformSystemPrompt` option of [`createDefaultAIClient`](https://www.telerik.com/kendo-react-ui-develop/components/datainsights-composer/api/createdefaultaiclient), append your rules to the received prompt. A replaced prompt loses this protection, and the other protections in the prompt.
* **AI responses and persisted state**—Treat generated configurations and restored History as untrusted input. The component validates configuration structure and field references, but your app must enforce business rules and protect stored data.
* **AI service connection**—Use a trusted, encrypted endpoint. Keep credentials out of client-accessible code. Review the AI provider's data retention policy. In browser-based React apps, route calls through a server-side backend.
* **Request limits and cancellation**—The DatAInsights Composer cancels a request with an `AbortSignal` but sets no timeout. Set timeouts, request size limits, output limits, and per-user rate limits on the endpoint, because it spends the AI provider's budget. Pass the `signal` of the custom transport to `fetch`. If the transport ignores it, the component stops waiting but the HTTP request and the AI provider call continue.

> New prompt injection attacks are discovered regularly. When making AI service calls, the application must apply the latest best practices that validate user prompts and prevent potential prompt injection.

## Suggested Links

* [DatAInsights Composer Controlled Mode](https://www.telerik.com/kendo-react-ui-develop/components/datainsights-composer/controlled-mode)
* [DatAInsights Composer Data Binding](https://www.telerik.com/kendo-react-ui-develop/components/datainsights-composer/data-binding)
* [DatAInsights Composer Events](https://www.telerik.com/kendo-react-ui-develop/components/datainsights-composer/events)
* [API Reference of the DatAInsights Composer](https://www.telerik.com/kendo-react-ui-develop/components/datainsights-composer/api)
Area	What the component covers	What your application covers
AI Service Connection	- Calls the registered AI client (or custom backend). - Passes an `AbortSignal` to the transport and aborts it when the user stops the request, submits a new prompt, or the component unmounts. - Sets no timeout and no request size limit.	- Configures and secures the AI service, including endpoint, credentials, and encrypted connection. - Sets timeouts, request size limits, and output limits on the endpoint, and passes the `signal` to `fetch` so that a cancelled request stops the HTTP call.
User Access	No authentication or authorization.	Applies restrictions through app authentication and authorization.
Datasets	- Sends metadata to the AI model: the `id` and `description` of each dataset, and the `name`, `type`, `label`, and `description` of its fields. The optional descriptions and labels are sent only when you define them. The `label` of the dataset is not sent. - Does not send data items to the AI model. - When the user refines a component, also sends its current configurations, which can include filter values. The built-in prompts refuse more than 100,000 characters of configurations, so that refine fails and is not sent. - Works in-memory with all provided datasets and data items in the `datasets` prop or `onDataProcess` event.	- Decides which datasets, fields, and items the user can see, and passes only those to the DatAInsights Composer. - Returns from `onDataProcess` only the items the user can see. The handler runs in application code and receives the dataset, including its items. - Keeps the dataset and field catalog small and curated, because a large one raises the cost and latency of every request. - Pages or pre-aggregates large datasets on the server.
Prompts	- Passes prompts through the AI client without sanitizing control characters or markup-like content. - `maxPromptLength` limits the input control but is unset by default and can be bypassed in the browser.	Sets a prompt length limit and applies additional custom validation, rate limits, and usage quotas.
AI Responses	- Checks the response structure, including component configurations and field names. - The default AI client requests structured JSON output, but a transport may ignore the schema. It rejects malformed JSON and responses over 2 million characters. - Sanitizes AI responses into supported configurations and drops unknown field references. - Limits number format strings to 100 characters and accepts only Kendo number and date formats, optionally wrapped in a `{0:...}` placeholder. `validateConfig` applies the same check. - The DatAInsights Composer does not execute AI output as code or HTML. - The DatAInsights Composer always renders titles, descriptions, messages, and errors as encoded text. - Contains rendering failures of a generated component in an error boundary, so that the rest of the page keeps working.	Decides how much to trust the generated result. Validates values such as formats, colors, and numbers.
Saved State and History	- Raises events with the configurations and the History items, such as `onConfirm`, `onHistoryItemCreate`, and `onHistoryItemRestore`. - Validates the configurations that you supply or restore against their datasets before it renders them. - Does not store or persist any state.	- Stores the configurations and the History securely, and verifies them before you restore them.
Logging and Auditing	- Raises events such as `onPromptSubmit`, `onConfigChange`, `onConfirm`, `onHistoryItemCreate`, and `onError`. - Passes the raw error and the submitted prompt to `onError`.	- Logs user prompts, component configurations, and displayed data. Redacts sensitive information, including the prompt and the error in `onError`, before logging it. - Treats the `onConfirm` and History payloads as user data and applies retention controls to logs and persisted History.