Design a secure API for an AI assistant

Design the API through which clients call an AI assistant, with the focus on security. How are callers authenticated, how are tokens issued, signed and validated, how is each request authorized against the user's data, and how do you stop misuse (stolen tokens, abuse, prompt-driven data leaks)? Also discuss what security concerns appear as the API scales.