{"id":32573,"date":"2026-09-22T16:22:05","date_gmt":"2026-09-22T16:22:05","guid":{"rendered":"https:\/\/thecloud.group\/?p=32573"},"modified":"2026-09-22T16:24:55","modified_gmt":"2026-09-22T16:24:55","slug":"security-by-design-ia-company","status":"publish","type":"post","link":"https:\/\/thecloud.group\/en\/security-by-design-ia-empresa\/","title":{"rendered":"Security by design or guardrails attached to the end"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
<\/div>\n\t\t\t\t\t\t
\n\t\t\t\n\t\n<\/svg>\t\t<\/div>\n\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"logo\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Security by design or guardrails attached to the end\n\n<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

September 22, 2026<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The security of an AI-powered system is decided during the design phase, or it isn't decided at all: what's added at the end are partial mitigations of decisions already made. A guardrail that filters responses doesn't fix a poorly designed permissions model, just as a railing doesn't correct the foundations.<\/span><\/p>

The difference between the two ways of working isn't one of security. It's one of cost, and it's enormous: what a two-hour conversation costs before starting can cost an entire project later.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

What is decided in the design and can no longer be changed cheaply\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Decision<\/b><\/p><\/th>

If taken at the beginning<\/b><\/p><\/th>

If you try to add it later<\/b><\/p><\/th><\/tr><\/thead>

What identity does the system use to access it?<\/b><\/p><\/td>

Configuration<\/span><\/p><\/td>

Redo integrations and permissions model<\/span><\/p><\/td><\/tr>

What actions can you perform?<\/b><\/p><\/td>

List closed from the start<\/span><\/p><\/td>

Audit and limit code already in production<\/span><\/p><\/td><\/tr>

What is recorded for each execution<\/b><\/p><\/td>

Instrumentation from day one<\/span><\/p><\/td>

The past cannot be reconstructed<\/span><\/p><\/td><\/tr>

Separation of environments<\/b><\/p><\/td>

Project structure<\/span><\/p><\/td>

Migration at risk of disruption<\/span><\/p><\/td><\/tr>

Where they reside and who processes the data<\/b><\/p><\/td>

Choice of architecture<\/span><\/p><\/td>

Contract renegotiation and migration<\/span><\/p><\/td><\/tr><\/tbody><\/table>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The third row has a property that makes it especially expensive: <\/span>It is irreversible.<\/b>. If it wasn't registered, it doesn't exist. When a client, an auditor, or a court asks what the system did three months ago, the answer won't depend on a willingness to cooperate, but on a technical decision someone made\u2014or didn't make\u2014before starting.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Guardrails do work, but not for that.\n\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

It's important to be precise, because this article could be interpreted as disparaging guardrails, which it isn't. Filtering inappropriate content, detecting known manipulation patterns, and limiting response length are all useful measures.<\/span><\/p>

What they fail to do is contain structural damage. A guardrail acts on the text that enters and leaves; it doesn't act on what the system can do. If the system has permission to process a payment, no content filter prevents that payment from being processed when something causes the system to decide to do so.<\/span><\/p>

The correct hierarchy is this:<\/span><\/p>

  1. <\/b>Reduce what the system can do.<\/b> Minimum permission, whitelist of actions, amount and volume limits.<\/span><\/li>
  2. <\/b>Separate what the system can see.<\/b> Query with user identity, bounded index.<\/span><\/li>
  3. <\/b>Record everything you do.<\/b> Input, decision, action, validation.<\/span><\/li>
  4. <\/b>Filter inputs and outputs.<\/b> This is where the guardrails come in.<\/span><\/li><\/ol>

    Order matters. Starting with point 4 is the usual thing to do because that's what you can buy; starting with 1 is what works because that's what you design.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t

    The six decisions of the first week\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    These are the questions we ask ourselves before writing code in any project with AI components:<\/span><\/p>

    With what identity does the system access each source?<\/b> The correct answer is almost always: with the user's, propagated.<\/span><\/p>

    What is the closed list of actions that can be performed?<\/b> Listed, not described. What is not listed does not exist.<\/span><\/p>

    Which actions are irreversible and who validates them?<\/b> Payments, external communications, production changes, and anything that affects third-party data.<\/span><\/p>

    What is recorded, where, and for how long?<\/b> With enough detail to reconstruct a specific case months later.<\/span><\/p>

    What data enters the system and what data is excluded by explicit decision?<\/b> The "just in case you need it" is the origin of most exhibitions.<\/span><\/p>

    How do you stop it and how do you reverse it?<\/b> A mechanism that does not require deploying code or depending on the provider.<\/span><\/p>

    Six questions, one meeting. It's the intervention with the best cost-benefit ratio of the entire project, and it's the one that's skipped the most because during the week everyone wants to see something working.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t

    Why this is no longer just a good practice\n\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    The opposing argument is always the same and it's reasonable: there's pressure to show results and security slows things down.<\/span><\/p>

    The useful response is not to appeal to abstract risk, but to offer a concrete alternative: <\/span>a smaller reach with the complete design<\/b>. In other words, not to reduce security to meet the deadline, but to reduce the functional scope and keep the six decisions intact.<\/span><\/p>

    A system that does three things well, with limited permissions and traceability, can be expanded. A system that does thirty things without control has to be rebuilt before it can be expanded, and by then there are already users depending on it.<\/span><\/p>

    Haste is not the enemy of safety. Scope is.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t

    Frequently Asked Questions\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t\n\t\t\t\t\t
    What is security by design in an AI project? <\/div><\/span>\n\t\t\t\t\t\t\t\n\t\t\t<\/i><\/span>\n\t\t\t<\/i><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    It's about making security decisions\u2014access identity, permitted actions, logging, environment separation, and data residency\u2014during the design phase, not after construction. These decisions are inexpensive to make initially but very costly to modify once the system is in production.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t

    \n\t\t\t\t\n\t\t\t\t\t
    So what are guardrails for? <\/div><\/span>\n\t\t\t\t\t\t\t\n\t\t\t<\/i><\/span>\n\t\t\t<\/i><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    To filter inappropriate content, detect known manipulation patterns, and limit response formats. What they don't do is contain structural damage: they act on incoming and outgoing text, not on what the system can execute with its granted permissions.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t

    \n\t\t\t\t\n\t\t\t\t\t
    What security decisions need to be made before writing code? <\/div><\/span>\n\t\t\t\t\t\t\t\n\t\t\t<\/i><\/span>\n\t\t\t<\/i><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Six: with what identity does the system access each source, what is the closed list of allowed actions, what actions are irreversible and who validates them, what is recorded and for how long, what data is excluded by explicit decision, and how is the system stopped and reversed.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t

    \n\t\t\t\t\n\t\t\t\t\t
    Why can't the record be added later? <\/div><\/span>\n\t\t\t\t\t\t\t\n\t\t\t<\/i><\/span>\n\t\t\t<\/i><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Because it's irreversible: if it wasn't recorded, the information doesn't exist. When a client, auditor, or court asks what the system did months ago, the ability to answer will depend on a technical decision made before it even began.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t

    \n\t\t\t\t\n\t\t\t\t\t
    What do regulatory frameworks require regarding AI security? <\/div><\/span>\n\t\t\t\t\t\t\t\n\t\t\t<\/i><\/span>\n\t\t\t<\/i><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    The NIST AI RMF structures risk management on the ability to identify, measure, and control; ISO\/IEC 42001 requires evidence of ongoing control for certification; and the European AI Regulation mandates event logging, technical documentation, and demonstrable human oversight for certain categories.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t

    \n\t\t\t\t\n\t\t\t\t\t
    How do you reconcile safety with the pressure to deliver quickly? <\/div><\/span>\n\t\t\t\t\t\t\t\n\t\t\t<\/i><\/span>\n\t\t\t<\/i><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Reducing the functional scope, not the design decisions. A system that does three things well with limited permissions and traceability can be expanded; one that does thirty without control must be redesigned before expanding, especially when users are already depending on it.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Are you going to start an AI project?<\/b> The two-hour conversation about identity, permissions, actions, and registration is the most worthwhile investment in the entire project. We'll do it with you, no strings attached. <\/span>Let's talk \u2192<\/span><\/a><\/p><\/td><\/tr><\/tbody><\/table>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"Security\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"Software\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"Executive\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"

    In the vast digital landscape of the 21st century, security is the cornerstone of any business. Cybersecurity vulnerabilities make no distinction between corporate giants and promising startups.<\/p>","protected":false},"author":20,"featured_media":32575,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"elementor_header_footer","format":"standard","meta":{"footnotes":""},"categories":[858],"tags":[896,883],"class_list":["post-32573","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ingenieria-de-software","tag-producto-digital","tag-sistemas-empresariales"],"yoast_head":"\nSecurity by design o guardarra\u00edles pegados al final The Cloud Group<\/title>\n<meta name=\"description\" content=\"C\u00f3mo digitalizamos el archivo del Parlamentode Guinea Ecuatorial: alcance, retost\u00e9cnicos, soluci\u00f3n y resultado. Caso real publicado.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/thecloud.group\/en\/security-by-design-ia-company\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Security by design o guardarra\u00edles pegados al final\" \/>\n<meta property=\"og:description\" content=\"Descubre art\u00edculos sobre desarrollo de software a medida, automatizaci\u00f3n empresarial, inteligencia artificial, ERP, CRM, aplicaciones web y transformaci\u00f3n digital para empresas.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/thecloud.group\/en\/security-by-design-ia-company\/\" \/>\n<meta property=\"og:site_name\" content=\"The Cloud Group\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/thecloudgroupglobal\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-22T16:22:05+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-22T16:24:55+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/thecloud.group\/wp-content\/uploads\/2026\/09\/Security_by_design_or_guardrails_20260922112225.jpeg\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"1024\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Paula Franco\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@thecloudgroup\" \/>\n<meta name=\"twitter:site\" content=\"@thecloudgroup\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Paula Franco\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/thecloud.group\\\/security-by-design-ia-empresa\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/thecloud.group\\\/security-by-design-ia-empresa\\\/\"},\"author\":{\"name\":\"Paula Franco\",\"@id\":\"https:\\\/\\\/thecloud.group\\\/#\\\/schema\\\/person\\\/9292d905a1c98ea7345e5e71a5fe341f\"},\"headline\":\"Security by design o guardarra\u00edles pegados al final\",\"datePublished\":\"2026-09-22T16:22:05+00:00\",\"dateModified\":\"2026-09-22T16:24:55+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/thecloud.group\\\/security-by-design-ia-empresa\\\/\"},\"wordCount\":1517,\"publisher\":{\"@id\":\"https:\\\/\\\/thecloud.group\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/thecloud.group\\\/security-by-design-ia-empresa\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/thecloud.group\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/Security_by_design_or_guardrails_20260922112225.jpeg\",\"keywords\":[\"producto digital\",\"sistemas empresariales\"],\"articleSection\":[\"Ingenier\u00eda de Software\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/thecloud.group\\\/security-by-design-ia-empresa\\\/\",\"url\":\"https:\\\/\\\/thecloud.group\\\/security-by-design-ia-empresa\\\/\",\"name\":\"Security by design o guardarra\u00edles pegados al final The Cloud Group\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/thecloud.group\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/thecloud.group\\\/security-by-design-ia-empresa\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/thecloud.group\\\/security-by-design-ia-empresa\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/thecloud.group\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/Security_by_design_or_guardrails_20260922112225.jpeg\",\"datePublished\":\"2026-09-22T16:22:05+00:00\",\"dateModified\":\"2026-09-22T16:24:55+00:00\",\"description\":\"C\u00f3mo digitalizamos el archivo del Parlamentode Guinea Ecuatorial: alcance, retost\u00e9cnicos, soluci\u00f3n y resultado. Caso real publicado.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/thecloud.group\\\/security-by-design-ia-empresa\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/thecloud.group\\\/security-by-design-ia-empresa\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/thecloud.group\\\/security-by-design-ia-empresa\\\/#primaryimage\",\"url\":\"https:\\\/\\\/thecloud.group\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/Security_by_design_or_guardrails_20260922112225.jpeg\",\"contentUrl\":\"https:\\\/\\\/thecloud.group\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/Security_by_design_or_guardrails_20260922112225.jpeg\",\"width\":1024,\"height\":1024,\"caption\":\"La seguridad no deber\u00eda a\u00f1adirse cuando el sistema ya est\u00e1 construido. Debe formar parte de su dise\u00f1o desde el principio.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/thecloud.group\\\/security-by-design-ia-empresa\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/thecloud.group\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security by design o guardarra\u00edles pegados al final\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/thecloud.group\\\/#website\",\"url\":\"https:\\\/\\\/thecloud.group\\\/\",\"name\":\"The Cloud Group\",\"description\":\"Empresa especializada en desarrollo de software a medida, automatizaci\u00f3n empresarial e inteligencia artificial para empresas.\",\"publisher\":{\"@id\":\"https:\\\/\\\/thecloud.group\\\/#organization\"},\"alternateName\":\"TCG Software\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/thecloud.group\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/thecloud.group\\\/#organization\",\"name\":\"The Cloud Group\",\"alternateName\":\"TCG\",\"url\":\"https:\\\/\\\/thecloud.group\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/thecloud.group\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/thecloud.group\\\/wp-content\\\/uploads\\\/2020\\\/05\\\/logoSmallFirmaCorreo.png\",\"contentUrl\":\"https:\\\/\\\/thecloud.group\\\/wp-content\\\/uploads\\\/2020\\\/05\\\/logoSmallFirmaCorreo.png\",\"width\":300,\"height\":190,\"caption\":\"The Cloud Group\"},\"image\":{\"@id\":\"https:\\\/\\\/thecloud.group\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/thecloudgroupglobal\",\"https:\\\/\\\/x.com\\\/thecloudgroup\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/the-cloud-group\",\"https:\\\/\\\/www.instagram.com\\\/thecloudgroupglobal\",\"https:\\\/\\\/www.youtube.com\\\/@TheCloudGroup\"],\"description\":\"The Cloud Group es una empresa internacional especializada en desarrollo de software a medida, automatizaci\u00f3n empresarial, inteligencia artificial, ERP, CRM, aplicaciones web y m\u00f3viles y transformaci\u00f3n digital. Ayudamos a empresas a optimizar procesos, reducir costos y acelerar su crecimiento mediante soluciones tecnol\u00f3gicas personalizadas.\",\"email\":\"paula.franco@thecloud.group\",\"telephone\":\"3042544988\",\"legalName\":\"THE CLOUD COLOMBIA SAS\",\"vatID\":\"902084280\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/thecloud.group\\\/#\\\/schema\\\/person\\\/9292d905a1c98ea7345e5e71a5fe341f\",\"name\":\"Paula Franco\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8622dc6801e07daa51e09fd706fb55b2bdf9cada1ade4ab996fb3b4549e9214c?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8622dc6801e07daa51e09fd706fb55b2bdf9cada1ade4ab996fb3b4549e9214c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8622dc6801e07daa51e09fd706fb55b2bdf9cada1ade4ab996fb3b4549e9214c?s=96&d=mm&r=g\",\"caption\":\"Paula Franco\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Security by design or guardrails attached to the end The Cloud Group","description":"How we digitized the archive of the Parliament of Equatorial Guinea: scope, technical challenges, solution and result. Real case published.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/thecloud.group\/en\/security-by-design-ia-company\/","og_locale":"en_US","og_type":"article","og_title":"Security by design o guardarra\u00edles pegados al final","og_description":"Descubre art\u00edculos sobre desarrollo de software a medida, automatizaci\u00f3n empresarial, inteligencia artificial, ERP, CRM, aplicaciones web y transformaci\u00f3n digital para empresas.","og_url":"https:\/\/thecloud.group\/en\/security-by-design-ia-company\/","og_site_name":"The Cloud Group","article_publisher":"https:\/\/www.facebook.com\/thecloudgroupglobal","article_published_time":"2026-09-22T16:22:05+00:00","article_modified_time":"2026-09-22T16:24:55+00:00","og_image":[{"width":1024,"height":1024,"url":"https:\/\/thecloud.group\/wp-content\/uploads\/2026\/09\/Security_by_design_or_guardrails_20260922112225.jpeg","type":"image\/jpeg"}],"author":"Paula Franco","twitter_card":"summary_large_image","twitter_creator":"@thecloudgroup","twitter_site":"@thecloudgroup","twitter_misc":{"Written by":"Paula Franco","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/thecloud.group\/security-by-design-ia-empresa\/#article","isPartOf":{"@id":"https:\/\/thecloud.group\/security-by-design-ia-empresa\/"},"author":{"name":"Paula Franco","@id":"https:\/\/thecloud.group\/#\/schema\/person\/9292d905a1c98ea7345e5e71a5fe341f"},"headline":"Security by design o guardarra\u00edles pegados al final","datePublished":"2026-09-22T16:22:05+00:00","dateModified":"2026-09-22T16:24:55+00:00","mainEntityOfPage":{"@id":"https:\/\/thecloud.group\/security-by-design-ia-empresa\/"},"wordCount":1517,"publisher":{"@id":"https:\/\/thecloud.group\/#organization"},"image":{"@id":"https:\/\/thecloud.group\/security-by-design-ia-empresa\/#primaryimage"},"thumbnailUrl":"https:\/\/thecloud.group\/wp-content\/uploads\/2026\/09\/Security_by_design_or_guardrails_20260922112225.jpeg","keywords":["producto digital","sistemas empresariales"],"articleSection":["Ingenier\u00eda de Software"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/thecloud.group\/security-by-design-ia-empresa\/","url":"https:\/\/thecloud.group\/security-by-design-ia-empresa\/","name":"Security by design or guardrails attached to the end The Cloud Group","isPartOf":{"@id":"https:\/\/thecloud.group\/#website"},"primaryImageOfPage":{"@id":"https:\/\/thecloud.group\/security-by-design-ia-empresa\/#primaryimage"},"image":{"@id":"https:\/\/thecloud.group\/security-by-design-ia-empresa\/#primaryimage"},"thumbnailUrl":"https:\/\/thecloud.group\/wp-content\/uploads\/2026\/09\/Security_by_design_or_guardrails_20260922112225.jpeg","datePublished":"2026-09-22T16:22:05+00:00","dateModified":"2026-09-22T16:24:55+00:00","description":"How we digitized the archive of the Parliament of Equatorial Guinea: scope, technical challenges, solution and result. Real case published.","breadcrumb":{"@id":"https:\/\/thecloud.group\/security-by-design-ia-empresa\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/thecloud.group\/security-by-design-ia-empresa\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/thecloud.group\/security-by-design-ia-empresa\/#primaryimage","url":"https:\/\/thecloud.group\/wp-content\/uploads\/2026\/09\/Security_by_design_or_guardrails_20260922112225.jpeg","contentUrl":"https:\/\/thecloud.group\/wp-content\/uploads\/2026\/09\/Security_by_design_or_guardrails_20260922112225.jpeg","width":1024,"height":1024,"caption":"La seguridad no deber\u00eda a\u00f1adirse cuando el sistema ya est\u00e1 construido. Debe formar parte de su dise\u00f1o desde el principio."},{"@type":"BreadcrumbList","@id":"https:\/\/thecloud.group\/security-by-design-ia-empresa\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/thecloud.group\/"},{"@type":"ListItem","position":2,"name":"Security by design o guardarra\u00edles pegados al final"}]},{"@type":"WebSite","@id":"https:\/\/thecloud.group\/#website","url":"https:\/\/thecloud.group\/","name":"The Cloud Group","description":"Company specializing in custom software development, business automation and artificial intelligence for businesses.","publisher":{"@id":"https:\/\/thecloud.group\/#organization"},"alternateName":"TCG Software","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/thecloud.group\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/thecloud.group\/#organization","name":"The Cloud Group","alternateName":"TCG","url":"https:\/\/thecloud.group\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/thecloud.group\/#\/schema\/logo\/image\/","url":"https:\/\/thecloud.group\/wp-content\/uploads\/2020\/05\/logoSmallFirmaCorreo.png","contentUrl":"https:\/\/thecloud.group\/wp-content\/uploads\/2020\/05\/logoSmallFirmaCorreo.png","width":300,"height":190,"caption":"The Cloud Group"},"image":{"@id":"https:\/\/thecloud.group\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/thecloudgroupglobal","https:\/\/x.com\/thecloudgroup","https:\/\/www.linkedin.com\/company\/the-cloud-group","https:\/\/www.instagram.com\/thecloudgroupglobal","https:\/\/www.youtube.com\/@TheCloudGroup"],"description":"The Cloud Group is an international company specializing in custom software development, business automation, artificial intelligence, ERP, CRM, web and mobile applications, and digital transformation. We help companies optimize processes, reduce costs, and accelerate their growth through customized technology solutions.","email":"paula.franco@thecloud.group","telephone":"3042544988","legalName":"THE CLOUD COLOMBIA SAS","vatID":"902084280"},{"@type":"Person","@id":"https:\/\/thecloud.group\/#\/schema\/person\/9292d905a1c98ea7345e5e71a5fe341f","name":"Paula Franco","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/8622dc6801e07daa51e09fd706fb55b2bdf9cada1ade4ab996fb3b4549e9214c?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/8622dc6801e07daa51e09fd706fb55b2bdf9cada1ade4ab996fb3b4549e9214c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/8622dc6801e07daa51e09fd706fb55b2bdf9cada1ade4ab996fb3b4549e9214c?s=96&d=mm&r=g","caption":"Paula Franco"}}]}},"_links":{"self":[{"href":"https:\/\/thecloud.group\/en\/wp-json\/wp\/v2\/posts\/32573","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thecloud.group\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thecloud.group\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thecloud.group\/en\/wp-json\/wp\/v2\/users\/20"}],"replies":[{"embeddable":true,"href":"https:\/\/thecloud.group\/en\/wp-json\/wp\/v2\/comments?post=32573"}],"version-history":[{"count":4,"href":"https:\/\/thecloud.group\/en\/wp-json\/wp\/v2\/posts\/32573\/revisions"}],"predecessor-version":[{"id":32578,"href":"https:\/\/thecloud.group\/en\/wp-json\/wp\/v2\/posts\/32573\/revisions\/32578"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thecloud.group\/en\/wp-json\/wp\/v2\/media\/32575"}],"wp:attachment":[{"href":"https:\/\/thecloud.group\/en\/wp-json\/wp\/v2\/media?parent=32573"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thecloud.group\/en\/wp-json\/wp\/v2\/categories?post=32573"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thecloud.group\/en\/wp-json\/wp\/v2\/tags?post=32573"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}