New to KendoReact? Start a free 30-day trial
DatAInsights Composer Security
DatAInsights Composer SecurityPremium
Updated on Nov 4, 2026
The DatAInsights Composer sends the user prompt and dataset metadata to an AI model, and turns the reply of the AI model into Grid, Chart, and Gauge components. The AI service, user access, and data are all part of the application. Security is therefore shared between the DatAInsights Composer and the app. This article describes the built-in protections and what the application should take care of separately.
Responsibility Model
The following table lists:
- The DatAInsights Composer behaviors that relate to app and data security.
- Additional application enhancements that can improve security.
| Area | What the component covers | What your application covers |
|---|---|---|
| AI Service Connection |
- Calls the registered AI client (or custom backend). - Passes an AbortSignal to the transport and aborts it when the user stops the request, submits a new prompt, or the component unmounts.- Sets no timeout and no request size limit. |
- Configures and secures the AI service, including endpoint, credentials, and encrypted connection. - Sets timeouts, request size limits, and output limits on the endpoint, and passes the signal to fetch so that a cancelled request stops the HTTP call.
|
| User Access | No authentication or authorization. | Applies restrictions through app authentication and authorization. |
| Datasets |
- Sends metadata to the AI model: the id and description of each dataset, and the name, type, label, and description of its fields. The optional descriptions and labels are sent only when you define them. The label of the dataset is not sent.- Does not send data items to the AI model. - When the user refines a component, also sends its current configurations, which can include filter values. The built-in prompts refuse more than 100,000 characters of configurations, so that refine fails and is not sent. - Works in-memory with all provided datasets and data items in the datasets prop or onDataProcess event.
|
- Decides which datasets, fields, and items the user can see, and passes only those to the DatAInsights Composer. - Returns from onDataProcess only the items the user can see. The handler runs in application code and receives the dataset, including its items.- Keeps the dataset and field catalog small and curated, because a large one raises the cost and latency of every request. - Pages or pre-aggregates large datasets on the server. |
| Prompts |
- Passes prompts through the AI client without sanitizing control characters or markup-like content. - maxPromptLength limits the input control but is unset by default and can be bypassed in the browser.
| Sets a prompt length limit and applies additional custom validation, rate limits, and usage quotas. |
| AI Responses |
- Checks the response structure, including component configurations and field names. - The default AI client requests structured JSON output, but a transport may ignore the schema. It rejects malformed JSON and responses over 2 million characters. - Sanitizes AI responses into supported configurations and drops unknown field references. - Limits number format strings to 100 characters and accepts only Kendo number and date formats, optionally wrapped in a {0:...} placeholder. validateConfig applies the same check.- The DatAInsights Composer does not execute AI output as code or HTML. - The DatAInsights Composer always renders titles, descriptions, messages, and errors as encoded text. - Contains rendering failures of a generated component in an error boundary, so that the rest of the page keeps working. | Decides how much to trust the generated result. Validates values such as formats, colors, and numbers. |
| Saved State and History |
- Raises events with the configurations and the History items, such as onConfirm, onHistoryItemCreate, and onHistoryItemRestore.- Validates the configurations that you supply or restore against their datasets before it renders them. - Does not store or persist any state. | - Stores the configurations and the History securely, and verifies them before you restore them. |
| Logging and Auditing |
- Raises events such as onPromptSubmit, onConfigChange, onConfirm, onHistoryItemCreate, and onError.- Passes the raw error and the submitted prompt to onError.
|
- Logs user prompts, component configurations, and displayed data. Redacts sensitive information, including the prompt and the error in onError, before logging it.- Treats the onConfirm and History payloads as user data and applies retention controls to logs and persisted History.
|
A custom AI client should pass raw model output through toDatAInsightsComposerAIResponse. The component validates configurations from every client, but custom clients are responsible for sanitizing other model-derived response values. When you build a configuration yourself, run it through validateConfig before you pass it to applyDataOperations. The filter is bounded, and a filter beyond the limits matches no rows.
Trust Boundaries and Entry Points
The application should focus on the following potentially harmful inputs or potentially sensitive outputs:
- User prompts—Free text typed by the user is the main route for prompt-injection attempts. The React component does not sanitize prompts; validate them and enforce a length limit on your backend. The
maxPromptLengthproperty is unset by default and can be bypassed in the browser. - Dataset metadata—The
idanddescriptionof each dataset, and thename,type,label, anddescriptionof each field, are sent to the AI model by design. If these come from user input or external systems, sanitize them too. Do not include sensitive information in dataset metadata. The React component inserts dataset and field descriptions directly into the system prompt, so keep them trusted and host-curated. - System prompt customization—The built-in prompt tells the model to treat the user prompt and the dataset text as data, not as instructions. If you change the prompt with the
transformSystemPromptoption ofcreateDefaultAIClient, append your rules to the received prompt. A replaced prompt loses this protection, and the other protections in the prompt. - AI responses and persisted state—Treat generated configurations and restored History as untrusted input. The component validates configuration structure and field references, but your app must enforce business rules and protect stored data.
- AI service connection—Use a trusted, encrypted endpoint. Keep credentials out of client-accessible code. Review the AI provider's data retention policy. In browser-based React apps, route calls through a server-side backend.
- Request limits and cancellation—The DatAInsights Composer cancels a request with an
AbortSignalbut sets no timeout. Set timeouts, request size limits, output limits, and per-user rate limits on the endpoint, because it spends the AI provider's budget. Pass thesignalof the custom transport tofetch. If the transport ignores it, the component stops waiting but the HTTP request and the AI provider call continue.
New prompt injection attacks are discovered regularly. When making AI service calls, the application must apply the latest best practices that validate user prompts and prevent potential prompt injection.