Safe GenAI Adoption for a National Retailer

A national Australian retailer launching a generative AI shopping assistant connected to product, loyalty, and order-history data across cloud and SaaS systems.

The retailer wanted the commercial upside of a GenAI assistant but couldn't risk leaking customer or loyalty data through it. They had limited visibility into where sensitive data lived across their cloud and SaaS estate, and how much of it the assistant could reach.

• Ran data discovery and classification across cloud stores, SaaS, and the RAG pipeline.
• Tested the assistant for prompt injection, context leakage, and insecure output handling.
• Scoped the assistant's data access down to only what each feature required.
• Established ongoing posture monitoring for the data feeding the model.

• The RAG pipeline could surface loyalty data unrelated to the customer's query.
• Shadow copies of customer data sat in an analytics bucket the assistant could read.
• Output handling didn't strip sensitive fields before responding.

The retailer launched its GenAI assistant on schedule with classified, least-privilege data access, output filtering, and continuous posture monitoring, adopting AI without expanding its customer-data exposure.