A secure enterprise RAG system must enforce the user’s permissions at retrieval time, treat every retrieved passage as untrusted data, minimise what reaches the model, and prevent generated text from directly authorising an action. The biggest mistake is relying on the prompt to protect data that the surrounding architecture has already exposed.
Where can an enterprise RAG system leak data?
The attack surface spans ingestion, storage, retrieval, model context, output, logging, and downstream tools. A poisoned document can try to override instructions. A weak retrieval filter can surface another department’s files. A verbose trace can copy confidential text into an observability vendor. A generated link can expose an object the user was never allowed to open.
OWASP’s AI Agent Security Cheat Sheet recommends treating external data as untrusted and enforcing least privilege around tools and memory. The 2026 agentic risk taxonomy also covers goal hijack, identity abuse, memory poisoning, and tool misuse.
How should access control work?
Authorisation must travel with the request. Resolve user and tenant before retrieval; filter candidate documents by access metadata; and re-check access when the original object is opened. Do not retrieve a global result set and ask the model to ignore forbidden passages. The model is not an access-control boundary.
Preserve source identifiers, owner, classification, jurisdiction, retention state, and permissions when content is chunked. If those attributes disappear during indexing, the retrieval layer cannot enforce them later.
How do you contain indirect prompt injection?
- Reduce exposure: retrieve only the minimum relevant content and exclude active markup, scripts, hidden text, or unsupported files.
- Separate instructions from evidence: mark retrieved passages as quoted material that cannot modify system policy.
- Detect suspicious patterns: flag instruction-like content, encoded payloads, credential requests, and attempts to redirect tools.
- Constrain capabilities: even if manipulation succeeds, the agent should lack permission to disclose unrelated data or execute dangerous actions.
- Require provenance: important answers should cite the underlying object so a reviewer can inspect it.
No detector catches every attack. Defence depends on layered containment: access control, context minimisation, tool policy, output filtering, monitoring, and safe failure.
What belongs in the ingestion pipeline?
Authenticate the source; scan files; normalise safely; remove executable content; classify sensitivity; attach access metadata; record lineage; and quarantine uncertain content. Re-index when source permissions change. Deletion must propagate to embeddings, caches, evaluation corpora, and backups according to policy.
What should teams log—and avoid logging?
Log document identifiers, policy decisions, retrieval scores, model and prompt versions, redaction events, and tool outcomes. Avoid copying full sensitive passages into general-purpose telemetry. Apply the source data’s access, retention, and regional controls to traces.
Which tests expose real weaknesses?
- Cross-tenant and cross-role retrieval using deliberately similar documents.
- Poisoned files containing hidden and visible instructions.
- Questions designed to reconstruct secrets across permitted snippets.
- Deletion and permission changes across index, cache, and logs.
- Tool calls generated from hostile documents.
- Citations that prove material claims come from accessible objects.
What is the minimum release standard?
A RAG release is not ready until permissions are enforced outside the model, retrieved material is attributable, hostile content cannot expand authority, sensitive traces are controlled, and the team can revoke a document everywhere it appears. These checks belong in both AI strategy and governance and engineering acceptance criteria.