AI Red Teaming: Technical Requirements Document

Customer intake for AIRS AI Red Teaming engagements

Required Attendees

The roles below must be present on the TRD discovery call to unblock all configuration decisions. If any required role is absent, record which sections are deferred and schedule a targeted follow-up before the deployment session begins.

1 Engagement Overview Scoping

Stakeholder Contacts

Engagement Sizing

Calculated from §2 (target count), §1 (credits — see Licensing section), and the Network & Connectivity section in Prerequisites. This section is completed by the consultant.

Why this matters: Engagement sizing drives both the commercial package tier and the practical shape of how the engagement runs. The number of targets determines credit consumption and total scan duration. The scan types selected determine what personnel the customer needs available and how long each phase takes. Getting sizing wrong means either running out of credits mid-engagement or under-utilizing the allocated budget. Walk through the scan type descriptions below with the customer so they understand what they are purchasing before the package is selected.

Scan Types

There are three scan types. Most engagements use all three in order. Each has a different purpose, duration, and credit cost.

Package Tiers

Add-Ons

Prerequisites

Complete every item in this section before the deployment call begins. Missing any item is a potential session-stopper. Use this as a pre-engagement gate: unresolved items one week before the call warrant rescheduling.

Licensing & Credits

Feeds: Guide Step 3.1 (Create a Deployment Profile)

Licensing & Credits

AI Red Teaming is licensed through Software NGFW Credits, not as a standalone SKU. Credits must be allocated in the Customer Support Portal (CSP) before a deployment profile can be created.

Strata Logging Service (SLS)

SLS is a mandatory prerequisite for AIRS. It must be enabled on the tenant before AIRS activation begins. If SLS is not active, the activation flow fails mid-process and cannot recover without starting over.

Tenant Service Group (TSG) & Region

AIRS is provisioned inside a Tenant Service Group (TSG) in the Palo Alto Networks hub. The region is set at TSG creation and cannot be changed. The AIRS deployment profile must be created in the same region as the TSG. This is a discovery question — confirm what region the customer's TSG is already in, not a free choice. The three available regions are: Americas (US and Canada), EU-Netherlands (GDPR-aligned, required for EU data residency), and Singapore (APAC).

Tenant & TSG — Data Capture

Feeds: Guide Step 3.1 (Create a Deployment Profile)

IAM & Permissions

Access & Identity — Data Capture

Feeds: Guide Step 3.2 (Configure IAM)

Network Readiness

Whether target endpoints are public or private determines whether a Network Channel must be deployed. This is the single most impactful question: confirm it before scheduling the call.

If all targets are publicly accessible:

If any target is on a private network (behind firewall, VPN, or private VPC):

A Network Channel must be deployed. This is a Helm-deployed client in the customer's Kubernetes cluster that tunnels scan traffic outbound to AIRS. No inbound firewall rules are needed.

SSL Verification and Proxy Configuration (Private Endpoints)

Two additional Network Channel settings that must be identified before the deployment call — both affect how the Helm install command is constructed.

Target Architecture

Feeds: Guide Step 4.2 (Add a Target) + Step 4.3 (Configure Target Details)

Multi-Turn Configuration

What is a conversational target?

Some AI targets are stateless — each request is completely independent and the target has no memory of previous messages. Others are stateful — the target maintains a session server-side and remembers the conversation history across turns.

Multi-turn attacks (such as the Crescendo pattern) work by building trust or context across several turns before extracting the harmful output in a later turn. For AIRS to run these correctly, it needs to know how the target handles conversation history — otherwise each prompt arrives without context and the attack fails.

Connection & Auth — Data Capture

Feeds: Guide Step 4.2 (Add a Target)

Connection type is determined by the target type selected in Target Architecture (above). Use the same value here when populating §16.

Network & Connectivity — Data Capture

Feeds: Guide Phase 5 (Network Channels) (skip or deploy)

Target Endpoint Readiness

What is a target? A target is the AI system being tested. Three types are supported:

• Model — a direct API connection to a foundation model with no application layer: GPT-4o at api.openai.com, Claude at api.anthropic.com, a Bedrock-hosted model, a self-hosted Llama or Mistral instance. Simplest to configure.
• Application — a model wrapped with a system prompt, business logic, and safety guardrails. Most enterprise targets are Applications: a customer service chatbot, an HR policy assistant, a legal document summarizer, a financial advisor application, a retail shopping assistant. Industry and use case are required fields.
• Agent — an autonomous system with tool access that can take multi-step actions: a code review agent with repository access, a data analysis agent that writes and runs SQL, a research assistant that browses the web, an IT support agent that manages tickets. Carries the highest risk due to tool misuse potential.

Understanding rate limits: RPM (Requests Per Minute) controls how many API calls AIRS can send to the target each minute. TPM (Tokens Per Minute) controls total token throughput (input plus output combined) per minute. AIRS sends attack prompts sequentially; rate limits cap the speed. An Attack Library scan runs hundreds of prompts over approximately 5 hours. At 20 RPM that is roughly 6,000 total requests, sufficient for a full scan. Below 10 RPM the scan cannot complete in a reasonable time window. TPM is a separate constraint: attack payloads are verbose when a full system prompt is included in every request, and a TPM limit below 10,000 causes throttling even when RPM is adequate.

Complete for each AI target before the call. A target that fails validation during the call adds 30–60 minutes of unplanned troubleshooting.

2 Target Overview Essential

List every AI system to be tested. Each row drives a Part C section. This table determines engagement sizing.

3 Compliance Requirements Important

4 Remediation Expectations Important

Target Index

List every AI system to be tested. Each row maps to a Part C (sections 10–16) block below. Type, Priority, and Connection are filled in after Part C is completed for each target.

Example (completed):

Fill in:

{
  "error": {
    "message": "Content policy violation",
    "type": "content_filter",
    "code": "content_policy_violation"
  }
}

{
  // request_template.body — customize for your target's API format
  "model": "[model-name]",
  "messages": [
    {
      "role": "user",
      "content": "{{prompt}}"
    }
  ],
  "temperature": 0.7,
  "max_tokens": 1024
}

D1 Logging & SIEM Integration Day-2

D2 Ongoing Program Design Day-2

D3 Reporting & Distribution Day-2